SQLAlchemy is the most-used Python ORM. The text() wrapper and raw execute() are SQL injection sinks when the SQL is built from user input. Core and ORM query APIs with bound parameters are safe.
.text().Engine.execute().Connection.execute().Session.execute().text()Sinksqlalchemy.text(text: str) -> TextClause
Wraps a raw SQL string. SQL injection sink when text is built from user input without :bindparams.
0.Engine.execute()SinkEngine.execute(statement, *multiparams, **params) -> CursorResult
Executes a statement. Injection sink when statement is a raw string.
0.Connection.execute()SinkConnection.execute(statement, parameters=None, ...) -> CursorResult
Executes a statement. Injection sink when statement is a raw string without text() + bindparams.
0.Session.execute()SinkSession.execute(statement, params=None, ...) -> Result
Executes a statement. Injection sink on raw strings.
0| FQN | Field | |
|---|---|---|
| sqlalchemy | fqns[0] | |
| sqlalchemy.engine.Engine | fqns[1] | |
| sqlalchemy.orm.Session | fqns[2] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PySqlalchemy