Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Flag str.replace as possible sql injection #1044

Merged
merged 6 commits into from Dec 16, 2023
Merged

Flag str.replace as possible sql injection #1044

merged 6 commits into from Dec 16, 2023

Commits on Dec 15, 2023

  1. Flag str.replace as possible sql injection 

    This extends the existing implementation for detecting possible
cases of SQL injection to account for `str.replace` used in the
string construction.

Use of `str.replace` can lead to SQL injection in much the same
way as `str.format` can, and that is already considered in the
pre-existing implementation, along with other common string
constructions.

Resolves PyCQA#878
    @costaparas @sigmavirus24
    costaparas authored and sigmavirus24 committed Dec 15, 2023
    Configuration menu
    Copy the full SHA
    d909043 View commit details
    Browse the repository at this point in the history

  2. Revert cosmetic change

    @costaparas @sigmavirus24
    costaparas authored and sigmavirus24 committed Dec 15, 2023
    Configuration menu
    Copy the full SHA
    1e79042 View commit details
    Browse the repository at this point in the history

  3. Fix lint

    @costaparas @sigmavirus24
    costaparas authored and sigmavirus24 committed Dec 15, 2023
    Configuration menu
    Copy the full SHA
    6c71336 View commit details
    Browse the repository at this point in the history

  4. Reduce str.replace to LOW confidence in all cases 

    Since the rate of false positives may be higher for
str.replace over other string constructions like str.format,
we should reduce to LOW confidence to compensate for this.
    @costaparas @sigmavirus24
    costaparas authored and sigmavirus24 committed Dec 15, 2023
    Configuration menu
    Copy the full SHA
    8879d9b View commit details
    Browse the repository at this point in the history

  5. Update bandit/plugins/injection_sql.py 

    Correct version in versionchanged directive

Co-authored-by: Eric Brown <ericwb@users.noreply.github.com>
    @sigmavirus24 @ericwb
    sigmavirus24 and ericwb committed Dec 15, 2023
    Configuration menu
    Copy the full SHA
    9ee876d View commit details
    Browse the repository at this point in the history

  6. Fix typo in comment

    @costaparas
    costaparas committed Dec 15, 2023
    Configuration menu
    Copy the full SHA
    0a5bc64 View commit details
    Browse the repository at this point in the history