[IMP] test_lint: adding check to starred argument

Adding the if condition to handle starred argument passed to
cr.execute

Adding two test to test that case

closes odoo/odoo#117688

X-original-commit: 4ab64dcd21ecd99c081975beee5ac13d2aa70a6b
Signed-off-by: Vranckx Florian (flvr) <flvr@odoo.com>

odoo/addons/test_lint/tests/_odoo_checker_sql_injection.py

@@ -149,6 +149,8 @@ class OdooBaseChecker(BaseChecker):
                 self._is_constexpr(k, args_allowed=args_allowed) and self._is_constexpr(v, args_allowed=args_allowed)
                 for k, v in node.items
             )
+        elif isinstance(node, astroid.Starred):
+            return self._is_constexpr(node.value, args_allowed=args_allowed, position=position)
         elif isinstance(node, astroid.BinOp): # recusively infer both side of the operation. Failing if either side is not inferable
             left_operand = self._is_constexpr(node.left, args_allowed=args_allowed)
             right_operand = self._is_constexpr(node.right, args_allowed=args_allowed)

odoo/addons/test_lint/tests/test_checkers.py

@@ -418,5 +418,20 @@ class TestSqlLint(TransactionCase):
             a, _ =  return_tuple(var)
             cr.execute(a)#@
         """)
-        with self.assertMessages(): # this should pass
+        with self.assertMessages():
+            checker.visit_call(node)
+        node = _odoo_checker_sql_injection.astroid.extract_node("""
+        def not_injectable5(var):
+            star = ('defined','constant','string')
+            cr.execute(*star)#@
+        """)
+        with self.assertMessages():
+            checker.visit_call(node)
+
+        node = _odoo_checker_sql_injection.astroid.extract_node("""
+        def injectable6(var):
+            star = ('defined','variable','string',var)
+            cr.execute(*star)#@
+        """)
+        with self.assertMessages("sql-injection"):
             checker.visit_call(node)