| 325 | # ============================================================ |
| 326 | |
| 327 | class TestPLAINPWD001: |
| 328 | def test_create_with_tainted_password_fires(self): |
| 329 | code = """ |
| 330 | pwd = request.POST.get('password') |
| 331 | User.objects.create(username='alice', password=pwd) |
| 332 | """ |
| 333 | assert fires(code, "PLAIN_PWD001"), "PLAIN_PWD001 must fire: tainted password in ORM create()" |
| 334 | |
| 335 | def test_hashed_password_safe(self): |
| 336 | code = """ |
| 337 | from django.contrib.auth.hashers import make_password |
| 338 | User.objects.create(username='alice', password=make_password(raw_pwd)) |
| 339 | """ |
| 340 | assert not_fires(code, "PLAIN_PWD001"), "PLAIN_PWD001 must NOT fire when password is hashed" |
| 341 | |
| 342 | |
| 343 | # ============================================================ |
nothing calls this directly
no outgoing calls
no test coverage detected