| 86 | # ============================================================ |
| 87 | |
| 88 | class TestORM001: |
| 89 | def test_fstring_in_text_fires(self): |
| 90 | code = """ |
| 91 | uid = request.GET.get('id') |
| 92 | result = session.execute(text(f"SELECT * FROM users WHERE id={uid}")) |
| 93 | """ |
| 94 | assert fires(code, "ORM001"), "ORM001 must fire: f-string inside text()" |
| 95 | |
| 96 | def test_percent_format_in_text_fires(self): |
| 97 | code = """ |
| 98 | result = session.execute(text("SELECT * FROM users WHERE name='%s'" % name)) |
| 99 | """ |
| 100 | assert fires(code, "ORM001"), "ORM001 must fire: %-format inside text()" |
| 101 | |
| 102 | def test_safe_parameterized_text_safe(self): |
| 103 | code = """ |
| 104 | result = session.execute(text("SELECT * FROM users WHERE id = :uid"), {"uid": uid}) |
| 105 | """ |
| 106 | assert not_fires(code, "ORM001"), "ORM001 must NOT fire for static text() with params" |
| 107 | |
| 108 | |
| 109 | # ============================================================ |
nothing calls this directly
no outgoing calls
no test coverage detected