Django
Security rules for Django web framework
Run All Django Rules
pathfinder scan --ruleset python/django --project .Rules
Django SQL Injection via cursor.execute()
CRITICALUser input flows to cursor.execute() without parameterization, enabling SQL injection attacks.
Django SQL Injection via QuerySet.raw()
CRITICALUser input flows to QuerySet.raw() without parameterization, enabling SQL injection through Django's ORM raw query interface.
Django SQL Injection via QuerySet.extra()
HIGHUser input flows to QuerySet.extra() without parameterization, enabling SQL injection through Django's legacy ORM extension interface.
Django SQL Injection via RawSQL Expression
CRITICALUser input flows to RawSQL() expression without parameterization, enabling SQL injection through Django's annotation system.
Raw SQL Usage Audit via RawSQL Expression
MEDIUMRawSQL() expression detected. Audit this usage to confirm parameterized queries are used for all user-controlled values.
Django Tainted SQL String Construction
HIGHUser input is used to construct a SQL string that flows to a database execution function, enabling SQL injection via string building.
Django Command Injection via os.system()
CRITICALUser input flows to os.system(), enabling arbitrary OS command execution with the privileges of the Django process.
Django Command Injection via subprocess
CRITICALUser input flows to subprocess with shell=True or as a string command, enabling OS command injection.
Django Code Injection via eval()
CRITICALUser input flows to eval(), enabling arbitrary Python code execution on the server.
Django Code Injection via exec()
CRITICALUser input flows to exec(), enabling arbitrary Python statement execution on the server.
Django globals() Misuse for Arbitrary Code Execution
HIGHUser input is used to index globals(), enabling arbitrary function dispatch and potential code execution.
Django SSRF via requests Library
HIGHUser input flows to requests.get/post/put/delete/head(), enabling the server to make HTTP requests to attacker-controlled URLs.
Django SSRF via urllib
HIGHUser input flows to urllib.request.urlopen() or urllib.request.Request(), enabling the server to make HTTP requests to attacker-controlled URLs.
Django Path Traversal via os.path.join()
HIGHUser input flows to os.path.join() leading to file operations, enabling path traversal to access files outside the intended directory.
Django XSS via Direct HttpResponse with User Input
HIGHUser input flows directly to HttpResponse without HTML escaping, enabling Cross-Site Scripting (XSS) attacks.
Django mark_safe() Usage Audit
MEDIUMmark_safe() bypasses Django's automatic HTML escaping. Audit all usages to confirm content is properly sanitized before being marked safe.
Django SafeString Subclass Audit
MEDIUMClass extends SafeString or SafeData, bypassing Django's auto-escaping for all instances. Audit to confirm the class properly sanitizes content.
Django XSS in HTML Email Body via EmailMessage
MEDIUMUser input flows into HTML email body content without sanitization, enabling HTML injection in emails.
Django XSS in send_mail html_message Parameter
MEDIUMUser input flows into the html_message parameter of send_mail() without sanitization, enabling HTML injection in emails.
Django Insecure Cookie Settings via set_cookie()
MEDIUMCookie set without secure, httponly, or samesite flags, making it vulnerable to interception, XSS-based theft, and CSRF attacks.
Django Insecure Deserialization of Request Data
CRITICALUser input flows to unsafe deserialization functions (pickle, yaml.load, dill, shelve), enabling arbitrary code execution during deserialization.
Django Empty Password in set_password()
HIGHEmpty string passed to set_password() creates an account with no password protection. Use None or set_unusable_password() instead.
Django Default Empty Password Value via flows()
HIGHrequest.POST.get('password', '') with empty string default flows to set_password(), potentially setting an empty password when the field is omitted.