sql-injection (ODOO052)

Preview (since 0.16.2.5) · Related issues · View source

Derived from the odoo linter.

This rule is unstable and in preview. The --preview flag is required for use.

What it does

Checks for cursor execute/executemany calls whose query is built with string formatting or concatenation from non-constant values, e.g. cr.execute("... %s" % name) or cr.execute(f"... {name}").

Why is this bad?

Interpolating values into SQL text lets crafted input change the query itself (SQL injection). Values must be passed as query parameters (cr.execute("... %s", (name,))) so the database driver escapes them.

Formatting with constants, self._table-style private attributes/methods, or psycopg2.sql objects is allowed: those can't be controlled by user input.

Example

self.env.cr.execute("SELECT id FROM res_partner WHERE name = '%s'" % name)

Use instead:

self.env.cr.execute("SELECT id FROM res_partner WHERE name = %s", (name,))