Commits on Feb 24, 2023

1. Improve detecting SQL injections in f-strings …

   This commit fixes detecting SQL injection
   in statements like:
   
   f"SELECT {column_name} FROM foo WHERE id = 1"
   f"INSERT INTO {table_name} VALUES (1)"
   f"UPDATE {table_name} SET id = 1"
   
   Before this change, the bandit was analyzing statements
   by parts, especially, in the case of:
   "SELECT {column_name} FROM foo WHERE id = 1"
   it was firstly checking "SELECT " for being
   an SQL statement and then " FROM foo WHERE id = 1".
   Neither of these parts match to defined
   regular expressions:
   
       r"(select\s.*from\s|"
       r"delete\s+from\s|"
       r"insert\s+into\s.*values\s|"
       r"update\s.*set\s)",
   
   Thus SQL injection was not detected.
   
   This commit makes bandit checking the whole SQL
   statement for matching the above regexps.
   
   Resolves: PyCQA#916

   

   kfrydel committed Feb 24, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 631a384
   • Browse repository at this point

   Copy the full SHA

   631a384 View commit details

   Browse the repository at this point in the history

2. Add tests for multiline strings

   

   kfrydel committed Feb 24, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for d703ae7
   • Browse repository at this point

   Copy the full SHA

   d703ae7 View commit details

   Browse the repository at this point in the history