Moises Lopez - https://www.vauxoo.com/
ae7184eb21
* [FIX] test_lint: Consider variables for sql-injection
Using the following code:
```python
var = 'SELECT name FROM account WHERE id IN {}'
values = (1, 2, 3)
self._cr.execute(var.format(values))
```
It has a risky sql injection ignored before of this change
And allow psycopg2.SQL way mapping the variables declaration
* [FIX] sql-injection: AttributeError: 'NoneType' object has no attribute 'parent'
Using the following code:
queries = [
"SELECT id FROM res_partner",
"SELECT id FROM res_users",
]
for query in queries:
self.env.cr.execute(query)
The check sql-injection shows the following error:
- AttributeError: 'NoneType' object has no attribute 'parent'
So, Now it is validating if it is not None
* [REF] sql-injection: Using better naming for node_ofc -> node_assign
* [FIX] sql-injection: Fix false positive using BinOp "+"
Considering the following valid case:
cr.execute('SELECT ' + operator + ' FROM table' + 'WHERE')
The representation tree is:
node.repr_tree()
BinOp(
op='+',
left=BinOp(
op='+',
left=BinOp(
op='+',
left=Const(value='SELECT '),
right=Name(name='operator')),
right=Const(value=' FROM table')),
right=Const(value='WHERE'))
Notice that left node is another BinOp node
So, it need to be considered recursively
closes odoo/odoo#77864
X-original-commit: ce1a0171f61d2808470c185a91e9f8299e4efd25
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Odoo
Odoo is a suite of web based open source business apps.
The main Odoo Apps include an Open Source CRM, Website Builder, eCommerce, Warehouse Management, Project Management, Billing & Accounting, Point of Sale, Human Resources, Marketing, Manufacturing, ...
Odoo Apps can be used as stand-alone applications, but they also integrate seamlessly so you get a full-featured Open Source ERP when you install several Apps.
Getting started with Odoo
For a standard installation please follow the Setup instructions from the documentation.
To learn the software, we recommend the Odoo eLearning, or Scale-up, the business game. Developers can start with the developer tutorials