| 111 | # ============================================================ |
| 112 | |
| 113 | class TestORM002: |
| 114 | def test_raw_tainted_sql_fires(self): |
| 115 | code = """ |
| 116 | sql = request.GET.get('q') |
| 117 | users = User.objects.raw(sql) |
| 118 | """ |
| 119 | assert fires(code, "ORM002"), "ORM002 must fire: tainted SQL in raw()" |
| 120 | |
| 121 | def test_order_by_tainted_fires(self): |
| 122 | code = """ |
| 123 | sort = request.GET.get('sort') |
| 124 | qs = User.objects.order_by(sort) |
| 125 | """ |
| 126 | assert fires(code, "ORM002"), "ORM002 must fire: tainted field in order_by (CVE-2021-35042)" |
| 127 | |
| 128 | def test_order_by_literal_safe(self): |
| 129 | code = """ |
| 130 | qs = User.objects.order_by('username') |
| 131 | """ |
| 132 | assert not_fires(code, "ORM002"), "ORM002 must NOT fire for literal field name in order_by" |
| 133 | |
| 134 | |
| 135 | # ============================================================ |
nothing calls this directly
no outgoing calls
no test coverage detected