Update views.py #3
Conversation
|
Kudos, SonarCloud Quality Gate passed!
|
![jit-ci[bot]](https://avatars.githubusercontent.com/in/142441?s=60&v=4){kind=small}
introduction/views.py
Outdated
| print(sql_query) | ||
| try: | ||
| print("\nin try\n") | ||
| val=login.objects.raw(sql_query) |
There was a problem hiding this comment.
Security control: Static Code Analysis Python Semgrep
Type: Gitlab.Bandit.B611
Description: You should be very careful whenever you write raw SQL. Consider using Django ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
introduction/views.py
Outdated
|
|
||
| if login.objects.filter(user=name): | ||
|
|
||
| sql_query = "SELECT * FROM introduction_login WHERE user='"+name+"'AND password='"+password+"'" |
There was a problem hiding this comment.
Security control: Static Code Analysis Python Semgrep
Type: Python.Django.Security.Injection.Tainted-Sql-String.Tainted-Sql-String
Description: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries.
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
PavelLinearB
force-pushed
the
rotemshynes-patch-3
branch
from
395362c
to
d6dc96e
Compare
.