Friday, July 10, 2020
1 change · master
Security fixes and vulnerability patches
This update improves internal checks that help developers catch unsafe database query patterns before they reach users. It reduces missed warnings and clarifies how legitimate dynamic database queries should be written, lowering the risk of security issues.
Original PR description
With the current lint we have very similar queries which lead to different flagging:
```python
self.env.cr.execute("SELECT %s FROM table WHERE %s" % (self._table, ''.join(where_list)))
```
triggers a lint failure but
```python
self.env.cr.execute("SELECT %s FROM table WHERE %s" % (self._table, where))
```
does not.
Now there's one part which is a bit unclear: is the first one a false positive or the second one a false negative? It basically boils down to whether what we're allowing is the specific `self._table` being injected directly, or whether `self._table` means all injection is now allowed aka is it ok if *all* injected parameters are `self._...` or *any* of them?
@moylop260 since you were the original author, do you remember the intent? (ignore the existing commits in this PR, basically I assumed the former situation where each parameter was whitelisted but that is quite noisy and unwieldy, which led me to believe your intent had been different).