From b89daa74127f186b50e2da1a544870d0f846e071 Mon Sep 17 00:00:00 2001 From: flvr-odoo Date: Tue, 4 Apr 2023 08:38:27 +0000 Subject: [PATCH] [IMP] test_lint: adding check to starred argument Adding the if condition to handle starred argument passed to cr.execute Adding two test to test that case closes odoo/odoo#117688 X-original-commit: 4ab64dcd21ecd99c081975beee5ac13d2aa70a6b Signed-off-by: Vranckx Florian (flvr) --- .../tests/_odoo_checker_sql_injection.py | 2 ++ odoo/addons/test_lint/tests/test_checkers.py | 17 ++++++++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/odoo/addons/test_lint/tests/_odoo_checker_sql_injection.py b/odoo/addons/test_lint/tests/_odoo_checker_sql_injection.py index d8b1ed1eb7b..4af86bb6dd1 100644 --- a/odoo/addons/test_lint/tests/_odoo_checker_sql_injection.py +++ b/odoo/addons/test_lint/tests/_odoo_checker_sql_injection.py @@ -149,6 +149,8 @@ class OdooBaseChecker(BaseChecker): self._is_constexpr(k, args_allowed=args_allowed) and self._is_constexpr(v, args_allowed=args_allowed) for k, v in node.items ) + elif isinstance(node, astroid.Starred): + return self._is_constexpr(node.value, args_allowed=args_allowed, position=position) elif isinstance(node, astroid.BinOp): # recusively infer both side of the operation. Failing if either side is not inferable left_operand = self._is_constexpr(node.left, args_allowed=args_allowed) right_operand = self._is_constexpr(node.right, args_allowed=args_allowed) diff --git a/odoo/addons/test_lint/tests/test_checkers.py b/odoo/addons/test_lint/tests/test_checkers.py index 2186137dd02..d7abd8f160f 100644 --- a/odoo/addons/test_lint/tests/test_checkers.py +++ b/odoo/addons/test_lint/tests/test_checkers.py @@ -418,5 +418,20 @@ class TestSqlLint(TransactionCase): a, _ = return_tuple(var) cr.execute(a)#@ """) - with self.assertMessages(): # this should pass + with self.assertMessages(): + checker.visit_call(node) + node = _odoo_checker_sql_injection.astroid.extract_node(""" + def not_injectable5(var): + star = ('defined','constant','string') + cr.execute(*star)#@ + """) + with self.assertMessages(): + checker.visit_call(node) + + node = _odoo_checker_sql_injection.astroid.extract_node(""" + def injectable6(var): + star = ('defined','variable','string',var) + cr.execute(*star)#@ + """) + with self.assertMessages("sql-injection"): checker.visit_call(node)