DJG103

This check looks for ways that Django SQL Injection protection is being bypassed in the extra() query set function, by using quoted parameters.

This check will inspect any string literal within the keyword-arguments:

  • “where”, “select”, “tables”, “order_by”, “params”

Example

In this example, the value of the othercol is vulnerable to SQL injection:

qs.extra(
    select={'val': "select col from sometable where othercol = '%s'"},
    select_params=(someparam,),
)

This would also apply to the where argument:

MyDataModel.objects.extra(where=['headline="%s"'], params=['Lennon'])

Fixes

Remove the quotations from the string values:

MyDataModel.objects.extra(where=['headline=%s'], params=['Lennon'])