{"rules":[{"id":"python.django.security.injection.code.user-eval.user-eval","message":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.","metadata":{"cwe":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"],"owasp":["A03:2021 - Injection","A05:2025 - Injection"],"references":["https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html","https://owasp.org/www-community/attacks/Code_Injection"],"category":"security","technology":["django"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Code Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval","shortlink":"https://sg.run/PJDW","semgrep.dev":{"rule":{"r_id":9501,"rv_id":1263384,"rule_id":"DbUpDQ","version_id":"d6Tyx2A","url":"https://semgrep.dev/playground/r/d6Tyx2A/python.django.security.injection.code.user-eval.user-eval","origin":"community","path":"python.django.security.injection.code.user-eval.user-eval"}}},"patterns":[{"pattern-inside":"def $F(...):\n  ...\n"},{"pattern-either":[{"pattern":"eval(..., request.$W.get(...), ...)"},{"pattern":"$V = request.$W.get(...)\n...\neval(..., $V, ...)\n"},{"pattern":"eval(..., request.$W(...), ...)"},{"pattern":"$V = request.$W(...)\n...\neval(..., $V, ...)\n"},{"pattern":"eval(..., request.$W[...], ...)"},{"pattern":"$V = request.$W[...]\n...\neval(..., $V, ...)\n"}]}],"languages":["python"],"severity":"WARNING"},{"id":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string","message":"Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.","metadata":{"cwe":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"],"owasp":["A03:2021 - Injection","A05:2025 - Injection"],"references":["https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html"],"category":"security","technology":["django"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Code Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string","shortlink":"https://sg.run/4x2z","semgrep.dev":{"rule":{"r_id":9500,"rv_id":1263383,"rule_id":"BYUNw9","version_id":"vdT06xG","url":"https://semgrep.dev/playground/r/vdT06xG/python.django.security.injection.code.user-eval-format-string.user-eval-format-string","origin":"community","path":"python.django.security.injection.code.user-eval-format-string.user-eval-format-string"}}},"patterns":[{"pattern-inside":"def $F(...):\n  ...\n"},{"pattern-either":[{"pattern":"eval(..., $STR % request.$W.get(...), ...)"},{"pattern":"$V = request.$W.get(...)\n...\neval(..., $STR % $V, ...)\n"},{"pattern":"$V = request.$W.get(...)\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n"},{"pattern":"eval(..., \"...\" % request.$W(...), ...)"},{"pattern":"$V = request.$W(...)\n...\neval(..., $STR % $V, ...)\n"},{"pattern":"$V = request.$W(...)\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n"},{"pattern":"eval(..., $STR % request.$W[...], ...)"},{"pattern":"$V = request.$W[...]\n...\neval(..., $STR % $V, ...)\n"},{"pattern":"$V = request.$W[...]\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n"},{"pattern":"eval(..., $STR.format(..., request.$W.get(...), ...), ...)"},{"pattern":"$V = request.$W.get(...)\n...\neval(..., $STR.format(..., $V, ...), ...)\n"},{"pattern":"$V = request.$W.get(...)\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n"},{"pattern":"eval(..., $STR.format(..., request.$W(...), ...), ...)"},{"pattern":"$V = request.$W(...)\n...\neval(..., $STR.format(..., $V, ...), ...)\n"},{"pattern":"$V = request.$W(...)\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n"},{"pattern":"eval(..., $STR.format(..., request.$W[...], ...), ...)"},{"pattern":"$V = request.$W[...]\n...\neval(..., $STR.format(..., $V, ...), ...)\n"},{"pattern":"$V = request.$W[...]\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n"},{"pattern":"$V = request.$W.get(...)\n...\neval(..., f\"...{$V}...\", ...)\n"},{"pattern":"$V = request.$W.get(...)\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n"},{"pattern":"$V = request.$W(...)\n...\neval(..., f\"...{$V}...\", ...)\n"},{"pattern":"$V = request.$W(...)\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n"},{"pattern":"$V = request.$W[...]\n...\neval(..., f\"...{$V}...\", ...)\n"},{"pattern":"$V = request.$W[...]\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n"}]}],"languages":["python"],"severity":"WARNING"},{"id":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","metadata":{"owasp":["A08:2017 - Insecure Deserialization","A08:2021 - Software and Data Integrity Failures","A08:2025 - Software or Data Integrity Failures"],"cwe":["CWE-502: Deserialization of Untrusted Data"],"references":["https://docs.python.org/3/library/pickle.html"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Insecure Deserialization "],"source":"https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","shortlink":"https://sg.run/9oyr","semgrep.dev":{"rule":{"r_id":9467,"rv_id":1409400,"rule_id":"OrU3e6","version_id":"GxTlb9e","url":"https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization","origin":"community","path":"python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization"}}},"message":"Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.","languages":["python"],"severity":"ERROR","mode":"taint","pattern-sources":[{"pattern-either":[{"patterns":[{"pattern-inside":"def $INSIDE(..., $PARAM, ...):\n  ...\n"},{"pattern-either":[{"pattern":"request.$REQFUNC(...)"},{"pattern":"request.$REQFUNC.get(...)"},{"pattern":"request.$REQFUNC[...]"}]}]}]}],"pattern-sinks":[{"pattern-either":[{"patterns":[{"pattern-either":[{"pattern":"pickle.$PICKLEFUNC(...)\n"},{"pattern":"_pickle.$PICKLEFUNC(...)\n"},{"pattern":"cPickle.$PICKLEFUNC(...)\n"},{"pattern":"shelve.$PICKLEFUNC(...)\n"}]},{"metavariable-regex":{"metavariable":"$PICKLEFUNC","regex":"dumps|dump|load|loads"}}]},{"patterns":[{"pattern":"dill.$DILLFUNC(...)"},{"metavariable-regex":{"metavariable":"$DILLFUNC","regex":"dump|dump_session|dumps|load|load_session|loads"}}]},{"patterns":[{"pattern":"yaml.$YAMLFUNC(...)"},{"pattern-not":"yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...)"},{"pattern-not":"yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...)"},{"pattern-not":"yaml.$YAMLFUNC(..., Loader=SafeLoader, ...)"},{"pattern-not":"yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...)"},{"metavariable-regex":{"metavariable":"$YAMLFUNC","regex":"dump|dump_all|load|load_all"}}]}]}]},{"id":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string","message":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.","metadata":{"cwe":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"],"owasp":["A03:2021 - Injection","A05:2025 - Injection"],"category":"security","technology":["django"],"references":["https://owasp.org/www-community/attacks/Code_Injection"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Code Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string","shortlink":"https://sg.run/J9JW","semgrep.dev":{"rule":{"r_id":9502,"rv_id":1263385,"rule_id":"WAUovx","version_id":"ZRTKA1p","url":"https://semgrep.dev/playground/r/ZRTKA1p/python.django.security.injection.code.user-exec-format-string.user-exec-format-string","origin":"community","path":"python.django.security.injection.code.user-exec-format-string.user-exec-format-string"}}},"patterns":[{"pattern-inside":"def $F(...):\n  ...\n"},{"pattern-either":[{"pattern":"exec(..., $STR % request.$W.get(...), ...)"},{"pattern":"$V = request.$W.get(...)\n...\nexec(..., $STR % $V, ...)\n"},{"pattern":"$V = request.$W.get(...)\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n"},{"pattern":"exec(..., \"...\" % request.$W(...), ...)"},{"pattern":"$V = request.$W(...)\n...\nexec(..., $STR % $V, ...)\n"},{"pattern":"$V = request.$W(...)\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n"},{"pattern":"exec(..., $STR % request.$W[...], ...)"},{"pattern":"$V = request.$W[...]\n...\nexec(..., $STR % $V, ...)\n"},{"pattern":"$V = request.$W[...]\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n"},{"pattern":"exec(..., $STR.format(..., request.$W.get(...), ...), ...)"},{"pattern":"$V = request.$W.get(...)\n...\nexec(..., $STR.format(..., $V, ...), ...)\n"},{"pattern":"$V = request.$W.get(...)\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n"},{"pattern":"exec(..., $STR.format(..., request.$W(...), ...), ...)"},{"pattern":"$V = request.$W(...)\n...\nexec(..., $STR.format(..., $V, ...), ...)\n"},{"pattern":"$V = request.$W(...)\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n"},{"pattern":"exec(..., $STR.format(..., request.$W[...], ...), ...)"},{"pattern":"$V = request.$W[...]\n...\nexec(..., $STR.format(..., $V, ...), ...)\n"},{"pattern":"$V = request.$W[...]\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n"},{"pattern":"$V = request.$W.get(...)\n...\nexec(..., f\"...{$V}...\", ...)\n"},{"pattern":"$V = request.$W.get(...)\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n"},{"pattern":"$V = request.$W(...)\n...\nexec(..., f\"...{$V}...\", ...)\n"},{"pattern":"$V = request.$W(...)\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n"},{"pattern":"$V = request.$W[...]\n...\nexec(..., f\"...{$V}...\", ...)\n"},{"pattern":"$V = request.$W[...]\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n"},{"pattern":"exec(..., base64.decodestring($S.format(..., request.$W.get(...), ...), ...), ...)"},{"pattern":"exec(..., base64.decodestring($S % request.$W.get(...), ...), ...)"},{"pattern":"exec(..., base64.decodestring(f\"...{request.$W.get(...)}...\", ...), ...)"},{"pattern":"exec(..., base64.decodestring(request.$W.get(...), ...), ...)"},{"pattern":"exec(..., base64.decodestring(bytes($S.format(..., request.$W.get(...), ...), ...), ...), ...)"},{"pattern":"exec(..., base64.decodestring(bytes($S % request.$W.get(...), ...), ...), ...)"},{"pattern":"exec(..., base64.decodestring(bytes(f\"...{request.$W.get(...)}...\", ...), ...), ...)"},{"pattern":"exec(..., base64.decodestring(bytes(request.$W.get(...), ...), ...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n"}]}],"languages":["python"],"severity":"WARNING"},{"id":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","message":"'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.","metadata":{"cwe":["CWE-521: Weak Password Requirements"],"owasp":["A07:2021 - Identification and Authentication Failures","A07:2025 - Authentication Failures"],"references":["https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password"],"category":"security","technology":["django"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authentication"],"source":"https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","shortlink":"https://sg.run/zvBW","semgrep.dev":{"rule":{"r_id":9517,"rv_id":1263412,"rule_id":"yyUn6Z","version_id":"RGT0LYX","url":"https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default","origin":"community","path":"python.django.security.passwords.use-none-for-password-default.use-none-for-password-default"}}},"languages":["python"],"severity":"ERROR","patterns":[{"pattern-either":[{"pattern":"$VAR = request.$W.get($X, $EMPTY)\n...\n$MODEL.set_password($VAR)\n...\n$MODEL.save(...)\n"},{"pattern":"def $F(..., $VAR=$EMPTY, ...):\n  ...\n  $MODEL.set_password($VAR)\n"}]},{"metavariable-pattern":{"metavariable":"$EMPTY","pattern":"\"\""}},{"focus-metavariable":"$EMPTY"}],"fix":"None\n"},{"id":"python.django.security.injection.code.user-exec.user-exec","message":"Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.","metadata":{"cwe":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"],"owasp":["A03:2021 - Injection","A05:2025 - Injection"],"category":"security","technology":["django"],"references":["https://owasp.org/www-community/attacks/Code_Injection"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Code Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec","shortlink":"https://sg.run/5Q3X","semgrep.dev":{"rule":{"r_id":9503,"rv_id":1263386,"rule_id":"0oU5AW","version_id":"nWT2LA2","url":"https://semgrep.dev/playground/r/nWT2LA2/python.django.security.injection.code.user-exec.user-exec","origin":"community","path":"python.django.security.injection.code.user-exec.user-exec"}}},"patterns":[{"pattern-inside":"def $F(...):\n  ...\n"},{"pattern-either":[{"pattern":"exec(..., request.$W.get(...), ...)"},{"pattern":"$V = request.$W.get(...)\n...\nexec(..., $V, ...)\n"},{"pattern":"exec(..., request.$W(...), ...)"},{"pattern":"$V = request.$W(...)\n...\nexec(..., $V, ...)\n"},{"pattern":"exec(..., request.$W[...], ...)"},{"pattern":"$V = request.$W[...]\n...\nexec(..., $V, ...)\n"},{"pattern":"loop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, request.$W[...])\n"},{"pattern":"$V = request.$W[...]\n...\nloop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, $V)\n"},{"pattern":"loop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, request.$W.get(...))\n"},{"pattern":"$V = request.$W.get(...)\n...\nloop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, $V)\n"}]}],"languages":["python"],"severity":"WARNING"},{"id":"python.django.security.passwords.password-empty-string.password-empty-string","message":"'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.","metadata":{"cwe":["CWE-521: Weak Password Requirements"],"owasp":["A07:2021 - Identification and Authentication Failures","A07:2025 - Authentication Failures"],"references":["https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password"],"category":"security","technology":["django"],"subcategory":["vuln"],"likelihood":"LOW","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authentication"],"source":"https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string","shortlink":"https://sg.run/oxnR","semgrep.dev":{"rule":{"r_id":9516,"rv_id":1263411,"rule_id":"9AU1jW","version_id":"GxTke5Q","url":"https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string","origin":"community","path":"python.django.security.passwords.password-empty-string.password-empty-string"}}},"patterns":[{"pattern-either":[{"pattern":"$MODEL.set_password($EMPTY)\n...\n$MODEL.save()\n"},{"pattern":"$VAR = $EMPTY\n...\n$MODEL.set_password($VAR)\n...\n$MODEL.save()\n"}]},{"metavariable-regex":{"metavariable":"$EMPTY","regex":"(\\'\\'|\\\"\\\")"}}],"languages":["python"],"severity":"ERROR"},{"id":"python.django.security.injection.raw-html-format.raw-html-format","languages":["python"],"severity":"WARNING","message":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.","metadata":{"cwe":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"owasp":["A07:2017 - Cross-Site Scripting (XSS)","A03:2021 - Injection","A05:2025 - Injection"],"category":"security","technology":["django"],"references":["https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render","https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"HIGH","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site-Scripting (XSS)"],"source":"https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format","shortlink":"https://sg.run/oYj1","semgrep.dev":{"rule":{"r_id":14360,"rv_id":1263397,"rule_id":"2ZUPER","version_id":"5PTo100","url":"https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format","origin":"community","path":"python.django.security.injection.raw-html-format.raw-html-format"}}},"mode":"taint","pattern-sanitizers":[{"pattern":"django.utils.html.escape(...)"}],"pattern-sources":[{"patterns":[{"pattern":"request.$ANYTHING"},{"pattern-not":"request.build_absolute_uri"}]}],"pattern-sinks":[{"patterns":[{"pattern-either":[{"patterns":[{"pattern-either":[{"pattern":"\"$HTMLSTR\" % ..."},{"pattern":"\"$HTMLSTR\".format(...)"},{"pattern":"\"$HTMLSTR\" + ..."},{"pattern":"f\"$HTMLSTR{...}...\""}]}]},{"patterns":[{"pattern-inside":"$HTML = \"$HTMLSTR\"\n...\n"},{"pattern-either":[{"pattern":"$HTML % ..."},{"pattern":"$HTML.format(...)"},{"pattern":"$HTML + ..."}]}]}]},{"metavariable-pattern":{"metavariable":"$HTMLSTR","language":"generic","pattern":"<$TAG ..."}}]}]},{"id":"python.django.security.hashids-with-django-secret.hashids-with-django-secret","languages":["python"],"message":"The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs.","metadata":{"category":"security","subcategory":["vuln"],"cwe":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"],"owasp":["A02:2021 – Cryptographic Failures"],"references":["https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY","http://carnage.github.io/2015/08/cryptanalysis-of-hashids"],"technology":["django"],"likelihood":"LOW","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues"],"source":"https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret","shortlink":"https://sg.run/bxeZ","semgrep.dev":{"rule":{"r_id":72426,"rv_id":946163,"rule_id":"0oUXqy","version_id":"0bT15nn","url":"https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret","origin":"community","path":"python.django.security.hashids-with-django-secret.hashids-with-django-secret"}}},"pattern-either":[{"pattern":"hashids.Hashids(..., salt=django.conf.settings.SECRET_KEY, ...)"},{"pattern":"hashids.Hashids(django.conf.settings.SECRET_KEY, ...)"}],"severity":"ERROR"},{"id":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","message":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","shortlink":"https://sg.run/qx7y","semgrep.dev":{"rule":{"r_id":9512,"rv_id":1263404,"rule_id":"2ZUbDL","version_id":"0bTKzRj","url":"https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","origin":"community","path":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"$CURSOR.execute(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"$CURSOR.execute(..., $S % request.$W.get(...), ...)"},{"pattern":"$CURSOR.execute(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"$CURSOR.execute(..., request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$A = $CURSOR.execute(..., request.$W.get(...), ...)"},{"pattern":"return $CURSOR.execute(..., request.$W.get(...), ...)"},{"pattern":"$CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"$CURSOR.execute(..., $S % request.$W(...), ...)"},{"pattern":"$CURSOR.execute(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"$CURSOR.execute(..., request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$A = $CURSOR.execute(..., request.$W(...), ...)"},{"pattern":"return $CURSOR.execute(..., request.$W(...), ...)"},{"pattern":"$CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"$CURSOR.execute(..., $S % request.$W[...], ...)"},{"pattern":"$CURSOR.execute(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"$CURSOR.execute(..., request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$A = $CURSOR.execute(..., request.$W[...], ...)"},{"pattern":"return $CURSOR.execute(..., request.$W[...], ...)"},{"pattern":"$CURSOR.execute(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"$CURSOR.execute(..., $S % request.$W, ...)"},{"pattern":"$CURSOR.execute(..., f\"...{request.$W}...\", ...)"},{"pattern":"$CURSOR.execute(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\n$CURSOR.execute(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"},{"pattern":"$A = $CURSOR.execute(..., request.$W, ...)"},{"pattern":"return $CURSOR.execute(..., request.$W, ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)"}]}]},{"id":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse","message":"Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.","metadata":{"cwe":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"owasp":["A05:2017 - Broken Access Control","A01:2021 - Broken Access Control","A01:2025 - Broken Access Control"],"references":["https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"LOW","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Path Traversal"],"source":"https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse","shortlink":"https://sg.run/W862","semgrep.dev":{"rule":{"r_id":9497,"rv_id":1263400,"rule_id":"GdU7QR","version_id":"A8Tgd1K","url":"https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse","origin":"community","path":"python.django.security.injection.request-data-fileresponse.request-data-fileresponse"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"django.http.FileResponse(..., request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.FileResponse(..., request.$W.get(...), ...)"},{"pattern":"return django.http.FileResponse(..., request.$W.get(...), ...)"},{"pattern":"django.http.FileResponse(..., request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.FileResponse(..., request.$W(...), ...)"},{"pattern":"return django.http.FileResponse(..., request.$W(...), ...)"},{"pattern":"django.http.FileResponse(..., request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.FileResponse(..., request.$W[...], ...)"},{"pattern":"return django.http.FileResponse(..., request.$W[...], ...)"},{"pattern":"django.http.FileResponse(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.FileResponse(..., request.$W, ...)"},{"pattern":"return django.http.FileResponse(..., request.$W, ...)"}]}]},{"id":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","message":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.","metadata":{"cwe":["CWE-918: Server-Side Request Forgery (SSRF)"],"owasp":["A10:2021 - Server-Side Request Forgery (SSRF)","A01:2025 - Broken Access Control"],"references":["https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Server-Side Request Forgery (SSRF)"],"source":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","shortlink":"https://sg.run/YvY4","semgrep.dev":{"rule":{"r_id":9514,"rv_id":1263406,"rule_id":"j2UvEw","version_id":"qkTR7zn","url":"https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","origin":"community","path":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests"}}},"languages":["python"],"severity":"ERROR","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"requests.$METHOD(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"requests.$METHOD(..., $S % request.$W.get(...), ...)"},{"pattern":"requests.$METHOD(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"requests.$METHOD(..., request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$A = requests.$METHOD(..., request.$W.get(...), ...)"},{"pattern":"return requests.$METHOD(..., request.$W.get(...), ...)"},{"pattern":"requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"requests.$METHOD(..., $S % request.$W(...), ...)"},{"pattern":"requests.$METHOD(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"requests.$METHOD(..., request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$A = requests.$METHOD(..., request.$W(...), ...)"},{"pattern":"return requests.$METHOD(..., request.$W(...), ...)"},{"pattern":"requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"requests.$METHOD(..., $S % request.$W[...], ...)"},{"pattern":"requests.$METHOD(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"requests.$METHOD(..., request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$A = requests.$METHOD(..., request.$W[...], ...)"},{"pattern":"return requests.$METHOD(..., request.$W[...], ...)"},{"pattern":"requests.$METHOD(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"requests.$METHOD(..., $S % request.$W, ...)"},{"pattern":"requests.$METHOD(..., f\"...{request.$W}...\", ...)"},{"pattern":"requests.$METHOD(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\nrequests.$METHOD(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"},{"pattern":"$A = requests.$METHOD(..., request.$W, ...)"},{"pattern":"return requests.$METHOD(..., request.$W, ...)"}]}]},{"id":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","message":"User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","shortlink":"https://sg.run/Kl4X","semgrep.dev":{"rule":{"r_id":9511,"rv_id":1263403,"rule_id":"pKUOBp","version_id":"WrTqK2L","url":"https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql","origin":"community","path":"python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"django.db.models.expressions.RawSQL(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., $S % request.$W.get(...), ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$A = django.db.models.expressions.RawSQL(..., request.$W.get(...), ...)"},{"pattern":"return django.db.models.expressions.RawSQL(..., request.$W.get(...), ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$A = django.db.models.expressions.RawSQL(..., request.$W(...), ...)"},{"pattern":"return django.db.models.expressions.RawSQL(..., request.$W(...), ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$A = django.db.models.expressions.RawSQL(..., request.$W[...], ...)"},{"pattern":"return django.db.models.expressions.RawSQL(..., request.$W[...], ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., $S % request.$W, ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., f\"...{request.$W}...\", ...)"},{"pattern":"django.db.models.expressions.RawSQL(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"},{"pattern":"$A = django.db.models.expressions.RawSQL(..., request.$W, ...)"},{"pattern":"return django.db.models.expressions.RawSQL(..., request.$W, ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, ...)\n"}]}]},{"id":"python.django.security.injection.csv-writer-injection.csv-writer-injection","languages":["python"],"message":"Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs.","metadata":{"category":"security","confidence":"MEDIUM","cwe":["CWE-1236: Improper Neutralization of Formula Elements in a CSV File"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://github.com/raphaelm/defusedcsv","https://owasp.org/www-community/attacks/CSV_Injection","https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities"],"technology":["django","python"],"subcategory":["vuln"],"impact":"MEDIUM","likelihood":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Validation"],"source":"https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection","shortlink":"https://sg.run/Pw9q","semgrep.dev":{"rule":{"r_id":31145,"rv_id":1263389,"rule_id":"7KUK1y","version_id":"LjTkgD9","url":"https://semgrep.dev/playground/r/LjTkgD9/python.django.security.injection.csv-writer-injection.csv-writer-injection","origin":"community","path":"python.django.security.injection.csv-writer-injection.csv-writer-injection"}}},"mode":"taint","pattern-sinks":[{"patterns":[{"pattern-inside":"$WRITER = csv.writer(...)\n\n...\n\n$WRITER.$WRITE(...)\n"},{"pattern":"$WRITER.$WRITE(...)"},{"metavariable-regex":{"metavariable":"$WRITE","regex":"^(writerow|writerows|writeheader)$"}}]}],"pattern-sources":[{"patterns":[{"pattern-inside":"def $FUNC(..., $REQUEST, ...):\n  ...\n"},{"focus-metavariable":"$REQUEST"},{"metavariable-pattern":{"metavariable":"$REQUEST","patterns":[{"pattern":"request"},{"pattern-not-inside":"request.build_absolute_uri"}]}}]}],"severity":"ERROR"},{"id":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","patterns":[{"pattern-inside":"def $FUNC(request, ...):\n  ...\n"},{"pattern-inside":"if $FORM.is_valid():\n  ...\n"},{"pattern-either":[{"pattern":"request.POST[...]"},{"pattern":"request.POST.get(...)"}]}],"message":"Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data","languages":["python"],"severity":"WARNING","metadata":{"category":"security","cwe":"CWE-20: Improper Input Validation","references":["https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Validation"],"source":"https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","shortlink":"https://sg.run/kJn7","semgrep.dev":{"rule":{"r_id":73472,"rv_id":946161,"rule_id":"JDUjqx","version_id":"DkTNpEJ","url":"https://semgrep.dev/playground/r/DkTNpEJ/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid","origin":"community","path":"python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid"}}}},{"id":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body","message":"Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.","metadata":{"cwe":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"],"owasp":["A03:2021 - Injection","A05:2025 - Injection"],"references":["https://www.damonkohler.com/2008/12/email-injection.html"],"category":"security","technology":["django"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Other"],"source":"https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body","shortlink":"https://sg.run/RoBe","semgrep.dev":{"rule":{"r_id":9505,"rv_id":1263390,"rule_id":"qNUj02","version_id":"8KT5rOn","url":"https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body","origin":"community","path":"python.django.security.injection.email.xss-html-email-body.xss-html-email-body"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n  $EMAIL.content_subtype = \"html\"\n  ...\n"},{"pattern-either":[{"pattern":"django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$A = django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)"},{"pattern":"return django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)"},{"pattern":"django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$A = django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)"},{"pattern":"return django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)"},{"pattern":"django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$A = django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)"},{"pattern":"return django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)"},{"pattern":"django.core.mail.EmailMessage($SUBJ, request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"},{"pattern":"$A = django.core.mail.EmailMessage($SUBJ, request.$W, ...)"},{"pattern":"return django.core.mail.EmailMessage($SUBJ, request.$W, ...)"}]}]},{"id":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","message":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.","metadata":{"cwe":["CWE-918: Server-Side Request Forgery (SSRF)"],"owasp":["A10:2021 - Server-Side Request Forgery (SSRF)","A01:2025 - Broken Access Control"],"references":["https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Server-Side Request Forgery (SSRF)"],"source":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","shortlink":"https://sg.run/6n2B","semgrep.dev":{"rule":{"r_id":9515,"rv_id":1263407,"rule_id":"10UKDo","version_id":"l4TJRwD","url":"https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib","origin":"community","path":"python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib"}}},"languages":["python"],"severity":"ERROR","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"urllib.request.urlopen(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"urllib.request.urlopen(..., $S % request.$W.get(...), ...)"},{"pattern":"urllib.request.urlopen(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"urllib.request.urlopen(..., request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$A = urllib.request.urlopen(..., request.$W.get(...), ...)"},{"pattern":"return urllib.request.urlopen(..., request.$W.get(...), ...)"},{"pattern":"urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"urllib.request.urlopen(..., $S % request.$W(...), ...)"},{"pattern":"urllib.request.urlopen(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"urllib.request.urlopen(..., request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$A = urllib.request.urlopen(..., request.$W(...), ...)"},{"pattern":"return urllib.request.urlopen(..., request.$W(...), ...)"},{"pattern":"urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"urllib.request.urlopen(..., $S % request.$W[...], ...)"},{"pattern":"urllib.request.urlopen(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"urllib.request.urlopen(..., request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$A = urllib.request.urlopen(..., request.$W[...], ...)"},{"pattern":"return urllib.request.urlopen(..., request.$W[...], ...)"},{"pattern":"urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"urllib.request.urlopen(..., $S % request.$W, ...)"},{"pattern":"urllib.request.urlopen(..., f\"...{request.$W}...\", ...)"},{"pattern":"urllib.request.urlopen(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\nurllib.request.urlopen(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"},{"pattern":"$A = urllib.request.urlopen(..., request.$W, ...)"},{"pattern":"return urllib.request.urlopen(..., request.$W, ...)"}]}]},{"id":"python.django.security.injection.open-redirect.open-redirect","message":"Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.","metadata":{"cwe":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"],"owasp":["A01:2021 - Broken Access Control","A01:2025 - Broken Access Control"],"references":["https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/","https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231"],"category":"security","technology":["django"],"subcategory":["vuln"],"likelihood":"LOW","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Open Redirect"],"source":"https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect","shortlink":"https://sg.run/Ave2","semgrep.dev":{"rule":{"r_id":9494,"rv_id":1263393,"rule_id":"PeUZgr","version_id":"3ZT4XD7","url":"https://semgrep.dev/playground/r/3ZT4XD7/python.django.security.injection.open-redirect.open-redirect","origin":"community","path":"python.django.security.injection.open-redirect.open-redirect"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-not-inside":"def $FUNC(...):\n  ...\n  django.utils.http.is_safe_url(...)\n  ...\n"},{"pattern-not-inside":"def $FUNC(...):\n  ...\n  if <... django.utils.http.is_safe_url(...) ...>:\n    ...\n"},{"pattern-not-inside":"def $FUNC(...):\n  ...\n  django.utils.http.url_has_allowed_host_and_scheme(...)\n  ...\n"},{"pattern-not-inside":"def $FUNC(...):\n  ...\n  if <... django.utils.http.url_has_allowed_host_and_scheme(...) ...>:\n    ...\n"},{"pattern-either":[{"pattern":"django.shortcuts.redirect(..., request.$W.get(...), ...)"},{"pattern":"django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"django.shortcuts.redirect(..., $S % request.$W.get(...), ...)"},{"pattern":"django.shortcuts.redirect(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$A = django.shortcuts.redirect(..., request.$W.get(...), ...)"},{"pattern":"$A = django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"$A = django.shortcuts.redirect(..., $S % request.$W.get(...), ...)"},{"pattern":"$A = django.shortcuts.redirect(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"return django.shortcuts.redirect(..., request.$W.get(...), ...)"},{"pattern":"return django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"return django.shortcuts.redirect(..., $S % request.$W.get(...), ...)"},{"pattern":"return django.shortcuts.redirect(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"django.shortcuts.redirect(..., request.$W(...), ...)"},{"pattern":"django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"django.shortcuts.redirect(..., $S % request.$W(...), ...)"},{"pattern":"django.shortcuts.redirect(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$A = django.shortcuts.redirect(..., request.$W(...), ...)"},{"pattern":"$A = django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"$A = django.shortcuts.redirect(..., $S % request.$W(...), ...)"},{"pattern":"$A = django.shortcuts.redirect(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"return django.shortcuts.redirect(..., request.$W(...), ...)"},{"pattern":"return django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"return django.shortcuts.redirect(..., $S % request.$W(...), ...)"},{"pattern":"return django.shortcuts.redirect(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"django.shortcuts.redirect(..., request.$W[...], ...)"},{"pattern":"django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"django.shortcuts.redirect(..., $S % request.$W[...], ...)"},{"pattern":"django.shortcuts.redirect(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$A = django.shortcuts.redirect(..., request.$W[...], ...)"},{"pattern":"$A = django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"$A = django.shortcuts.redirect(..., $S % request.$W[...], ...)"},{"pattern":"$A = django.shortcuts.redirect(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"return django.shortcuts.redirect(..., request.$W[...], ...)"},{"pattern":"return django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"return django.shortcuts.redirect(..., $S % request.$W[...], ...)"},{"pattern":"return django.shortcuts.redirect(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"django.shortcuts.redirect(..., request.$W, ...)"},{"pattern":"django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"django.shortcuts.redirect(..., $S % request.$W, ...)"},{"pattern":"django.shortcuts.redirect(..., f\"...{request.$W}...\", ...)"},{"pattern":"$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"},{"pattern":"$A = django.shortcuts.redirect(..., request.$W, ...)"},{"pattern":"$A = django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"$A = django.shortcuts.redirect(..., $S % request.$W, ...)"},{"pattern":"$A = django.shortcuts.redirect(..., f\"...{request.$W}...\", ...)"},{"pattern":"return django.shortcuts.redirect(..., request.$W, ...)"},{"pattern":"return django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"return django.shortcuts.redirect(..., $S % request.$W, ...)"},{"pattern":"return django.shortcuts.redirect(..., f\"...{request.$W}...\", ...)"},{"pattern":"django.http.HttpResponseRedirect(..., request.$W.get(...), ...)"},{"pattern":"django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...)"},{"pattern":"django.http.HttpResponseRedirect(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponseRedirect(..., request.$W.get(...), ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., request.$W.get(...), ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"django.http.HttpResponseRedirect(..., request.$W(...), ...)"},{"pattern":"django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"django.http.HttpResponseRedirect(..., $S % request.$W(...), ...)"},{"pattern":"django.http.HttpResponseRedirect(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponseRedirect(..., request.$W(...), ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., $S % request.$W(...), ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., request.$W(...), ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., $S % request.$W(...), ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"django.http.HttpResponseRedirect(..., request.$W[...], ...)"},{"pattern":"django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"django.http.HttpResponseRedirect(..., $S % request.$W[...], ...)"},{"pattern":"django.http.HttpResponseRedirect(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponseRedirect(..., request.$W[...], ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., $S % request.$W[...], ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., request.$W[...], ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., $S % request.$W[...], ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"django.http.HttpResponseRedirect(..., request.$W, ...)"},{"pattern":"django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"django.http.HttpResponseRedirect(..., $S % request.$W, ...)"},{"pattern":"django.http.HttpResponseRedirect(..., f\"...{request.$W}...\", ...)"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponseRedirect(..., request.$W, ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., $S % request.$W, ...)"},{"pattern":"$A = django.http.HttpResponseRedirect(..., f\"...{request.$W}...\", ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., request.$W, ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., $S % request.$W, ...)"},{"pattern":"return django.http.HttpResponseRedirect(..., f\"...{request.$W}...\", ...)"}]},{"metavariable-regex":{"metavariable":"$W","regex":"(?!get_full_path)"}}]},{"id":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","message":"Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.","metadata":{"cwe":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"owasp":["A07:2017 - Cross-Site Scripting (XSS)","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site-Scripting (XSS)"],"source":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","shortlink":"https://sg.run/BkvA","semgrep.dev":{"rule":{"r_id":9495,"rv_id":1263398,"rule_id":"JDUydR","version_id":"GxTke5K","url":"https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse","origin":"community","path":"python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"django.http.HttpResponse(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"django.http.HttpResponse(..., $S % request.$W.get(...), ...)"},{"pattern":"django.http.HttpResponse(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"django.http.HttpResponse(..., request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponse(..., request.$W.get(...), ...)"},{"pattern":"return django.http.HttpResponse(..., request.$W.get(...), ...)"},{"pattern":"django.http.HttpResponse(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"django.http.HttpResponse(..., $S % request.$W(...), ...)"},{"pattern":"django.http.HttpResponse(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"django.http.HttpResponse(..., request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponse(..., request.$W(...), ...)"},{"pattern":"return django.http.HttpResponse(..., request.$W(...), ...)"},{"pattern":"django.http.HttpResponse(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"django.http.HttpResponse(..., $S % request.$W[...], ...)"},{"pattern":"django.http.HttpResponse(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"django.http.HttpResponse(..., request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponse(..., request.$W[...], ...)"},{"pattern":"return django.http.HttpResponse(..., request.$W[...], ...)"},{"pattern":"django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"django.http.HttpResponse(..., $S % request.$W, ...)"},{"pattern":"django.http.HttpResponse(..., f\"...{request.$W}...\", ...)"},{"pattern":"django.http.HttpResponse(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$A = django.http.HttpResponse(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$A = django.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"return django.http.HttpResponse(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"}]}]},{"id":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system","message":"Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.","metadata":{"cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://owasp.org/www-community/attacks/Command_Injection"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Command Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system","shortlink":"https://sg.run/Gen2","semgrep.dev":{"rule":{"r_id":9504,"rv_id":1263387,"rule_id":"KxUbp2","version_id":"ExTExPo","url":"https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system","origin":"community","path":"python.django.security.injection.command.command-injection-os-system.command-injection-os-system"}}},"languages":["python"],"severity":"ERROR","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"os.system(..., request.$W.get(...), ...)"},{"pattern":"os.system(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"os.system(..., $S % request.$W.get(...), ...)"},{"pattern":"os.system(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\nos.system(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nos.system(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nos.system(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nos.system(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$A = os.system(..., request.$W.get(...), ...)"},{"pattern":"$A = os.system(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"$A = os.system(..., $S % request.$W.get(...), ...)"},{"pattern":"$A = os.system(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"return os.system(..., request.$W.get(...), ...)"},{"pattern":"return os.system(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"return os.system(..., $S % request.$W.get(...), ...)"},{"pattern":"return os.system(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"os.system(..., request.$W(...), ...)"},{"pattern":"os.system(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"os.system(..., $S % request.$W(...), ...)"},{"pattern":"os.system(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"$DATA = request.$W(...)\n...\nos.system(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nos.system(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nos.system(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\nos.system(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$A = os.system(..., request.$W(...), ...)"},{"pattern":"$A = os.system(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"$A = os.system(..., $S % request.$W(...), ...)"},{"pattern":"$A = os.system(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"return os.system(..., request.$W(...), ...)"},{"pattern":"return os.system(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"return os.system(..., $S % request.$W(...), ...)"},{"pattern":"return os.system(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"os.system(..., request.$W[...], ...)"},{"pattern":"os.system(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"os.system(..., $S % request.$W[...], ...)"},{"pattern":"os.system(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"$DATA = request.$W[...]\n...\nos.system(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nos.system(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nos.system(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\nos.system(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$A = os.system(..., request.$W[...], ...)"},{"pattern":"$A = os.system(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"$A = os.system(..., $S % request.$W[...], ...)"},{"pattern":"$A = os.system(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"return os.system(..., request.$W[...], ...)"},{"pattern":"return os.system(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"return os.system(..., $S % request.$W[...], ...)"},{"pattern":"return os.system(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"os.system(..., request.$W, ...)"},{"pattern":"os.system(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"os.system(..., $S % request.$W, ...)"},{"pattern":"os.system(..., f\"...{request.$W}...\", ...)"},{"pattern":"$DATA = request.$W\n...\nos.system(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nos.system(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nos.system(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\nos.system(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n"},{"pattern":"$A = os.system(..., request.$W, ...)"},{"pattern":"$A = os.system(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"$A = os.system(..., $S % request.$W, ...)"},{"pattern":"$A = os.system(..., f\"...{request.$W}...\", ...)"},{"pattern":"return os.system(..., request.$W, ...)"},{"pattern":"return os.system(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"return os.system(..., $S % request.$W, ...)"},{"pattern":"return os.system(..., f\"...{request.$W}...\", ...)"}]}]},{"id":"python.django.security.injection.request-data-write.request-data-write","message":"Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.","metadata":{"cwe":["CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')"],"owasp":["A03:2021 - Injection","A05:2025 - Injection"],"category":"security","technology":["django"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Validation"],"source":"https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write","shortlink":"https://sg.run/0Q6j","semgrep.dev":{"rule":{"r_id":9498,"rv_id":1263401,"rule_id":"ReUg5z","version_id":"BjTkZO5","url":"https://semgrep.dev/playground/r/BjTkZO5/python.django.security.injection.request-data-write.request-data-write","origin":"community","path":"python.django.security.injection.request-data-write.request-data-write"}}},"languages":["python"],"severity":"WARNING","pattern-either":[{"pattern":"$F.write(..., request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\n$F.write(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$F.write(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$A = $F.write(..., request.$W.get(...), ...)"},{"pattern":"return $F.write(..., request.$W.get(...), ...)"},{"pattern":"$F.write(..., request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\n$F.write(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$F.write(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$A = $F.write(..., request.$W(...), ...)"},{"pattern":"return $F.write(..., request.$W(...), ...)"},{"pattern":"$F.write(..., request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\n$F.write(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$F.write(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$A = $F.write(..., request.$W[...], ...)"},{"pattern":"return $F.write(..., request.$W[...], ...)"},{"pattern":"$F.write(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\n$F.write(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$F.write(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n"},{"pattern":"$A = $F.write(..., request.$W, ...)"},{"pattern":"return $F.write(..., request.$W, ...)"}]},{"id":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","message":"Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.","metadata":{"cwe":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"],"owasp":["A03:2021 - Injection","A05:2025 - Injection"],"references":["https://www.damonkohler.com/2008/12/email-injection.html"],"category":"security","technology":["django"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Other"],"source":"https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","shortlink":"https://sg.run/Avx8","semgrep.dev":{"rule":{"r_id":9506,"rv_id":1263391,"rule_id":"lBU9Ll","version_id":"gETB7Gn","url":"https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message","origin":"community","path":"python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"django.core.mail.send_mail(..., html_message=request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$A = django.core.mail.send_mail(..., html_message=request.$W.get(...), ...)"},{"pattern":"return django.core.mail.send_mail(..., html_message=request.$W.get(...), ...)"},{"pattern":"django.core.mail.send_mail(..., html_message=request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$A = django.core.mail.send_mail(..., html_message=request.$W(...), ...)"},{"pattern":"return django.core.mail.send_mail(..., html_message=request.$W(...), ...)"},{"pattern":"django.core.mail.send_mail(..., html_message=request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$A = django.core.mail.send_mail(..., html_message=request.$W[...], ...)"},{"pattern":"return django.core.mail.send_mail(..., html_message=request.$W[...], ...)"},{"pattern":"django.core.mail.send_mail(..., html_message=request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"},{"pattern":"$A = django.core.mail.send_mail(..., html_message=request.$W, ...)"},{"pattern":"return django.core.mail.send_mail(..., html_message=request.$W, ...)"}]}]},{"id":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","message":"Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.","metadata":{"cwe":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"owasp":["A05:2017 - Broken Access Control","A01:2021 - Broken Access Control","A01:2025 - Broken Access Control"],"references":["https://owasp.org/www-community/attacks/Path_Traversal"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Path Traversal"],"source":"https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","shortlink":"https://sg.run/W8qg","semgrep.dev":{"rule":{"r_id":9509,"rv_id":1263396,"rule_id":"oqUe7z","version_id":"JdTzxAw","url":"https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open","origin":"community","path":"python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"open(..., request.$W.get(...), ...)"},{"pattern":"open(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"open(..., $S % request.$W.get(...), ...)"},{"pattern":"open(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\nopen(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nopen(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nopen(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W.get(...)\n...\nopen(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$A = open(..., request.$W.get(...), ...)"},{"pattern":"$A = open(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"$A = open(..., $S % request.$W.get(...), ...)"},{"pattern":"$A = open(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"return open(..., request.$W.get(...), ...)"},{"pattern":"return open(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"return open(..., $S % request.$W.get(...), ...)"},{"pattern":"return open(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\nwith open(..., $DATA, ...) as $FD:\n  ...\n"},{"pattern":"open(..., request.$W(...), ...)"},{"pattern":"open(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"open(..., $S % request.$W(...), ...)"},{"pattern":"open(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"$DATA = request.$W(...)\n...\nopen(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W(...)\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W(...)\n...\nopen(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W(...)\n...\nopen(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W(...)\n...\nopen(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$A = open(..., request.$W(...), ...)"},{"pattern":"$A = open(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"$A = open(..., $S % request.$W(...), ...)"},{"pattern":"$A = open(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"return open(..., request.$W(...), ...)"},{"pattern":"return open(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"return open(..., $S % request.$W(...), ...)"},{"pattern":"return open(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"$DATA = request.$W(...)\n...\nwith open(..., $DATA, ...) as $FD:\n  ...\n"},{"pattern":"open(..., request.$W[...], ...)"},{"pattern":"open(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"open(..., $S % request.$W[...], ...)"},{"pattern":"open(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"$DATA = request.$W[...]\n...\nopen(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W[...]\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W[...]\n...\nopen(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W[...]\n...\nopen(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W[...]\n...\nopen(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$A = open(..., request.$W[...], ...)"},{"pattern":"$A = open(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"$A = open(..., $S % request.$W[...], ...)"},{"pattern":"$A = open(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"return open(..., request.$W[...], ...)"},{"pattern":"return open(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"return open(..., $S % request.$W[...], ...)"},{"pattern":"return open(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"$DATA = request.$W[...]\n...\nwith open(..., $DATA, ...) as $FD:\n  ...\n"},{"pattern":"open(..., request.$W, ...)"},{"pattern":"open(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"open(..., $S % request.$W, ...)"},{"pattern":"open(..., f\"...{request.$W}...\", ...)"},{"pattern":"$DATA = request.$W\n...\nopen(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W\n...\nopen(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W\n...\nopen(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$DATA = request.$W\n...\nopen(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"},{"pattern":"$A = open(..., request.$W, ...)"},{"pattern":"$A = open(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"$A = open(..., $S % request.$W, ...)"},{"pattern":"$A = open(..., f\"...{request.$W}...\", ...)"},{"pattern":"return open(..., request.$W, ...)"},{"pattern":"return open(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"return open(..., $S % request.$W, ...)"},{"pattern":"return open(..., f\"...{request.$W}...\", ...)"},{"pattern":"$DATA = request.$W\n...\nwith open(..., $DATA, ...) as $FD:\n  ...\n"}]}]},{"id":"python.django.security.nan-injection.nan-injection","message":"Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.","languages":["python"],"severity":"ERROR","mode":"taint","pattern-sources":[{"patterns":[{"pattern-inside":"def $FUNC(request, ...):\n  ...\n"},{"pattern-either":[{"pattern":"request.$PROPERTY.get(...)"},{"pattern":"request.$PROPERTY[...]"}]}]}],"pattern-sinks":[{"patterns":[{"pattern-either":[{"pattern":"float(...)"},{"pattern":"bool(...)"},{"pattern":"complex(...)"}]},{"pattern-not-inside":"if $COND:\n  ...\n...\n"}]}],"pattern-sanitizers":[{"pattern":"$ANYTHING(...)","not_conflicting":true}],"metadata":{"references":["https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868","https://blog.bitdiscovery.com/2021/12/python-nan-injection/"],"category":"security","cwe":["CWE-704: Incorrect Type Conversion or Cast"],"technology":["django"],"subcategory":["vuln"],"impact":"MEDIUM","likelihood":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Validation"],"source":"https://semgrep.dev/r/python.django.security.nan-injection.nan-injection","shortlink":"https://sg.run/Og7L","semgrep.dev":{"rule":{"r_id":18275,"rv_id":946193,"rule_id":"DbUGvk","version_id":"NdTqk7G","url":"https://semgrep.dev/playground/r/NdTqk7G/python.django.security.nan-injection.nan-injection","origin":"community","path":"python.django.security.nan-injection.nan-injection"}}}},{"id":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","message":"Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.","metadata":{"cwe":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"owasp":["A07:2017 - Cross-Site Scripting (XSS)","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"LOW","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site-Scripting (XSS)"],"source":"https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","shortlink":"https://sg.run/DoZP","semgrep.dev":{"rule":{"r_id":9496,"rv_id":1263399,"rule_id":"5rUOX1","version_id":"RGT0LY6","url":"https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest","origin":"community","path":"python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"django.http.HttpResponseBadRequest(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)"},{"pattern":"return django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponseBadRequest(..., request.$W(...), ...)"},{"pattern":"return django.http.HttpResponseBadRequest(..., request.$W(...), ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponseBadRequest(..., request.$W[...], ...)"},{"pattern":"return django.http.HttpResponseBadRequest(..., request.$W[...], ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., $S % request.$W, ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., f\"...{request.$W}...\", ...)"},{"pattern":"django.http.HttpResponseBadRequest(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"},{"pattern":"$A = django.http.HttpResponseBadRequest(..., request.$W, ...)"},{"pattern":"return django.http.HttpResponseBadRequest(..., request.$W, ...)"}]}]},{"id":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","message":"Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","shortlink":"https://sg.run/l2v9","semgrep.dev":{"rule":{"r_id":9513,"rv_id":1263405,"rule_id":"X5U8v5","version_id":"K3TKkBW","url":"https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw","origin":"community","path":"python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"$MODEL.objects.raw(..., $S.format(..., request.$W.get(...), ...), ...)"},{"pattern":"$MODEL.objects.raw(..., $S % request.$W.get(...), ...)"},{"pattern":"$MODEL.objects.raw(..., f\"...{request.$W.get(...)}...\", ...)"},{"pattern":"$MODEL.objects.raw(..., request.$W.get(...), ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$A = $MODEL.objects.raw(..., request.$W.get(...), ...)"},{"pattern":"return $MODEL.objects.raw(..., request.$W.get(...), ...)"},{"pattern":"$MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...)"},{"pattern":"$MODEL.objects.raw(..., $S % request.$W(...), ...)"},{"pattern":"$MODEL.objects.raw(..., f\"...{request.$W(...)}...\", ...)"},{"pattern":"$MODEL.objects.raw(..., request.$W(...), ...)"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$A = $MODEL.objects.raw(..., request.$W(...), ...)"},{"pattern":"return $MODEL.objects.raw(..., request.$W(...), ...)"},{"pattern":"$MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...)"},{"pattern":"$MODEL.objects.raw(..., $S % request.$W[...], ...)"},{"pattern":"$MODEL.objects.raw(..., f\"...{request.$W[...]}...\", ...)"},{"pattern":"$MODEL.objects.raw(..., request.$W[...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$A = $MODEL.objects.raw(..., request.$W[...], ...)"},{"pattern":"return $MODEL.objects.raw(..., request.$W[...], ...)"},{"pattern":"$MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...)"},{"pattern":"$MODEL.objects.raw(..., $S % request.$W, ...)"},{"pattern":"$MODEL.objects.raw(..., f\"...{request.$W}...\", ...)"},{"pattern":"$MODEL.objects.raw(..., request.$W, ...)"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.raw(..., $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"},{"pattern":"$A = $MODEL.objects.raw(..., request.$W, ...)"},{"pattern":"return $MODEL.objects.raw(..., request.$W, ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n"}]}]},{"id":"python.django.security.django-no-csrf-token.django-no-csrf-token","patterns":[{"pattern":"<form...>...</form>"},{"pattern-either":[{"pattern":"<form ... method=\"$METHOD\" ...>...</form>\n"},{"pattern":"<form ... method='$METHOD' ...>...</form>\n"},{"pattern":"<form ... method=$METHOD ...>...</form>\n"}]},{"metavariable-regex":{"metavariable":"$METHOD","regex":"(?i)(post|put|delete|patch)"}},{"pattern-not-inside":"<form...>...{% csrf_token %}...</form>"},{"pattern-not-inside":"<form...>...{{ $VAR.csrf_token }}...</form>"}],"message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.","languages":["generic"],"severity":"WARNING","metadata":{"category":"security","cwe":"CWE-352: Cross-Site Request Forgery (CSRF)","references":["https://docs.djangoproject.com/en/4.2/howto/csrf/"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","shortlink":"https://sg.run/N0Bp","semgrep.dev":{"rule":{"r_id":73471,"rv_id":946160,"rule_id":"PeUyYG","version_id":"BjT1NRl","url":"https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token","origin":"community","path":"python.django.security.django-no-csrf-token.django-no-csrf-token"}}},"paths":{"include":["*.html"]}},{"id":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","message":"User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","shortlink":"https://sg.run/0Ql5","semgrep.dev":{"rule":{"r_id":9510,"rv_id":1263402,"rule_id":"zdUkx1","version_id":"DkTRb4l","url":"https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where","origin":"community","path":"python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where"}}},"languages":["python"],"severity":"WARNING","patterns":[{"pattern-inside":"def $FUNC(...):\n  ...\n"},{"pattern-either":[{"pattern":"$MODEL.objects.extra(..., where=[..., $S.format(..., request.$W.get(...), ...), ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., f\"...{request.$W.get(...)}...\", ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...)"},{"pattern":"return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...), ...), ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., f\"...{request.$W(...)}...\", ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)"},{"pattern":"return $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...], ...), ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., f\"...{request.$W[...]}...\", ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)"},{"pattern":"return $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...), ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., f\"...{request.$W}...\", ...], ...)"},{"pattern":"$MODEL.objects.extra(..., where=[..., request.$W, ...], ...)"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)"},{"pattern":"return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)"},{"pattern":"$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n"},{"pattern":"$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"},{"pattern":"$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"}]}]}],"missed":155}