| 215 | # =========================================================================== |
| 216 | |
| 217 | class TestKeywordArgSinks: |
| 218 | |
| 219 | def test_getattr_with_keyword_name_arg(self): |
| 220 | """Phase 3: getattr(obj, name=attr) with tainted attr must fire.""" |
| 221 | code = """ |
| 222 | attr = request.GET.get('field') |
| 223 | value = getattr(user, attr) |
| 224 | """ |
| 225 | # Both positional and keyword should fire |
| 226 | assert findings_for(code, "GETATTR828"), \ |
| 227 | "GETATTR828 must fire for positional getattr(obj, tainted)" |
| 228 | |
| 229 | |
| 230 | # =========================================================================== |
nothing calls this directly
no outgoing calls
no test coverage detected