-
-
Notifications
You must be signed in to change notification settings - Fork 166
/
broken_model.py
852 lines (720 loc) · 31.5 KB
/
broken_model.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
# coding: utf-8
import psycopg2
from psycopg2 import sql
from psycopg2.sql import SQL, Identifier
import requests
from requests import (
delete, get, head, options, patch, post, put, request)
from requests import (
delete as delete_r, get as get_r, head as head_r,
options as options_r, patch as patch_r, post as post_r,
put as put_r, request as request_r)
import urllib
from urllib.request import urlopen
from urllib.request import urlopen as urlopen_r
import suds.client
from suds.client import Client
from suds.client import Client as Client_r
import http.client
from http.client import HTTPConnection, HTTPSConnection
from http.client import (
HTTPConnection as HTTPConnection_r,
HTTPSConnection as HTTPSConnection_r,
)
import smtplib
import smtplib as smtplib_r
from smtplib import SMTP
from smtplib import SMTP as SMTP_r
import serial
import serial as serial_r
from serial import Serial
from serial import Serial as Serial_r
import ftplib
import ftplib as ftplib_r
from ftplib import FTP
from ftplib import FTP as ftp_r
from odoo import fields, models, _
from odoo.exceptions import UserError
from odoo import exceptions
# Relatives import for odoo addons
from odoo.addons.broken_module import broken_model as broken_model1
from odoo.addons import broken_module as broken_module1
import odoo.addons.broken_module as broken_module2
import odoo.addons.broken_module.broken_model as broken_model2
import odoo.addons.iap.models.iap.jsonrpc
from odoo.addons.iap.models.iap import jsonrpc
from odoo.addons.iap.models import iap
import odoo.models
from odoo import tools
import itertools
from itertools import groupby
other_field = fields.Char()
def function_no_method():
return broken_model1, broken_module1, broken_module2, broken_model2
def fields_view_get():
return "Not part of a model, i'm free"
class TestModel2(odoo.models.Model):
def _compute_name2(self):
# Compute called from string with write defined before
self.write({"name": "hello"})
for rec in self:
rec.write({"name": "world"})
users = self.env["res.users"].browse([1,2,3])
for user in users:
user.write({"name": "moy6"})
users.write({"name": "moy8"})
with open("file.txt", "w") as f_obj:
f_obj.write("write file allowed")
unknown_type_object = self._get_object()
unknown_type_object.write('write not self.browse allowed')
name2 = fields.Char(compute='_compute_name2')
def fields_view_get(self):
return "Deprecated in Odoo 16.0!!!"
def custom_deprecated_method_just_because(self):
return "this method is deprecated because i said so in the options" + self.name2
def another_deprecated_model_method(self):
return self.name2
class TestModel(models.Model):
_name = 'test.model'
_inherit = ['mail.thread']
_columns = {} # deprecated columns
_defaults = {} # deprecated defaults
length = fields.Integer() # Deprecated length by js errors
def _compute_name(self):
var = itertools.groupby([(1,2,3), (3,4,5)], key=lambda x: x[0])
var2 = groupby([(1,2,3), (3,4,5)], key=lambda x: x[0])
var3 = tools.groupby([(1,2,3), (3,4,5)], key=lambda x: x[0])
# Compute called from string with write defined before
self.write({"name": "hello"})
for rec in self:
rec.write({"name": "world"})
users = self.env["res.users"].browse([1,2,3])
for user in users:
user.write({"name": "moy6"})
users.write({"name": "moy8"})
with open("file.txt", "w") as f_obj:
f_obj.write("write file allowed")
unknown_type_object = self._get_object()
unknown_type_object.write('write not self.browse allowed')
self.write({"name": "hello"}) # pylint: disable=no-write-in-compute
def _compute_with_method_def(self):
# Compute called from funct-def with write
self.write({"name": "hello"})
for rec in self:
rec.write({"name": "world"})
users = self.env["res.users"].browse([1,2,3])
for user in users:
user.write({"name": "moy6"})
with open("file.txt", "w") as f_obj:
f_obj.write("write file allowed")
users.write({"name": "moy8"})
unknown_type_object = self._get_object()
unknown_type_object.write('write not self.browse allowed')
self.write({"name": "hello"}) # pylint: disable=no-write-in-compute
name = fields.Char(
_(u"Näme"), # Don't need translate
help=u"My hëlp",
required=False,
compute='_compute_name', # good compute method name
search='_search_name', # good search method name
inverse='_inverse_name', # good inverse method name
)
# Imported openerp.fields use Char (Upper case)
other_field = fields.char(
name=_("Other field"),
copy=True,
compute='my_method_compute', # bad compute method name
search='my_method_search', # bad search method name
inverse='my_method_inverse', # bad inverse method name
)
compute_none = fields.Char(compute=None)
other_field2 = fields.char(
'Other Field2',
copy=True,
)
field_related = fields.Char('Field Related', related='model_id.related_field')
other_field_related = fields.Char(
related='model_id.related_field', string='Other Field Related')
compute_with_method_def = fields.Char(compute=_compute_with_method_def)
def my_method_compute(self):
# Compute called from string with write defined after
self.write({"name": "hello"})
for rec in self:
rec.write({"name": "world"})
users = self.env["res.users"].browse([1,2,3])
for user in users:
user.write({"name": "moy6"})
users.write({"name": "moy8"})
with open("file.txt", "w") as f_obj:
f_obj.write("write file allowed")
unknown_type_object = self._get_object()
unknown_type_object.write('write not self.browse allowed')
self.write({"name": "hello"}) # pylint: disable=no-write-in-compute
# This is a inherit overwrite field then don't should show errors related
# with creation of fields.
def method_date(self):
date = fields.Date.to_string(
fields.Datetime.context_timestamp(self,
timestamp=fields.Datetime.now())
)
self.with_context({'overwrite_context': True}).write({})
ctx = {'overwrite_context': True}
self.with_context(ctx).write({})
ctx2 = ctx
self.with_context(ctx2).write({})
self.with_context(**ctx).write({})
self.with_context(overwrite_context=False).write({})
return date
my_ok_field = fields.Float(
"My correctly named field",
digits=(6, 6), # OK: Valid field parameter
index=True, # OK: Valid field parameter
help="My ok field",
)
my_ko_field = fields.Float(
digits_compute=lambda cr: (6, 6), # Deprecated field parameter
select=True, # Deprecated field parameter
help="My ko field",
string="My Ko Field", # String parameter equal to name of variable
)
"""The name of the variable is equal to the string parameter
Tested all fields.*"""
boolean_variable_1 = fields.Boolean(string='Boolean Variable 1',
help="Help")
boolean_variable_2 = fields.Boolean("Boolean Variable 2", help="Help")
char_variable_1 = fields.Char(string='Char Variable 1', help="Help")
char_variable_2 = fields.Char("Char Variable 2", help="Help")
text_variable_1 = fields.Text(string='Text Variable 1', help="Help")
text_variable_2 = fields.Text("Text Variable 2", help="Help")
html_variable_1 = fields.Html(string='Html Variable 1', help="Help")
html_variable_2 = fields.Html("Html Variable 2", help="Help")
integer_variable_1 = fields.Integer(string='Integer Variable 1',
help="Help")
integer_variable_2 = fields.Integer("Integer Variable 2", help="Help")
float_variable_1 = fields.Float(string='Float Variable 1', help="Help")
float_variable_2 = fields.Float("Float Variable 2", help="Help")
date_variable_1 = fields.Date(string='Date Variable 1', help="Help")
date_variable_2 = fields.Date("Date Variable 2", help="Help")
date_time_variable_1 = fields.DateTime(string='Date Time Variable 1',
help="Help")
date_time_variable_2 = fields.DateTime("Date Time Variable 2", help="Help")
binary_variable_1 = fields.Binary(string='Binary Variable 1', help="Help")
binary_variable_2 = fields.Binary("Binary Variable 2", help="Help")
selection_variable_1 = fields.Selection(selection=[('a', 'A')],
string='Selection Variable 1',
help="Help")
selection_variable_2 = fields.Selection([('a', 'A')],
"Selection Variable 2",
help="Help")
reference_variable_1 = fields.Reference(selection=[('res.user', 'User')],
string="Reference Variable 1",
help="Help")
reference_variable_2 = fields.Reference([('res.user', 'User')],
"Reference Variable 2",
help="Help")
many_2_one_variable_1 = fields.Many2one(comodel_name='res.users',
string='Many 2 One Variable 1',
help="Help")
many_2_one_variable_2 = fields.Many2one('res.users',
"Many 2 One Variable 2",
help="Help")
one_2_many_variable_1 = fields.One2many(comodel_name='res.users',
inverse_name='rel_id',
string='One 2 Many Variable 1',
help="Help")
one_2_many_variable_2 = fields.One2many('res.users',
'rel_id',
"One 2 Many Variable 2",
help="Help")
many_2_many_variable_1 = fields.Many2many(comodel_name='res.users',
relation='table_name',
column1='col_name',
column2='other_col_name',
string='Many 2 Many Variable 1',
help="Help")
many_2_many_variable_2 = fields.Many2many('res.users',
'table_name',
'col_name',
'other_col_name',
"Many 2 Many Variable 2",
help="Help")
field_case_sensitive = fields.Char(
'Field Case SENSITIVE',
help="Field case sensitive"
)
name_equal_to_string = fields.Float(
"Name equal to string",
help="Name Equal To String"
)
many_2_one = fields.Many2one(
'res.users',
"Many 2 One",
help="Many 2 one"
)
many_2_many = fields.Many2many(
'res.users',
'relation',
'fk_column_from',
'fk_column_to',
"Many 2 many",
help="Many 2 Many"
)
def my_method1(self, variable1):
# Shouldn't show error of field-argument-translate
self.my_method2(_('hello world'))
# Message post without translation function
self.message_post(subject='Subject not translatable',
body='Body not translatable %s' % variable1)
self.message_post(subject='Subject not translatable %(variable)s' %
{'variable': variable1},
body='Body not translatable {}'.format(variable1),
message_type='notification')
self.message_post('Body not translatable',
'Subject not translatable {a}'.format(a=variable1))
self.message_post('Body not translatable %s' % variable1,
'Subject not translatable %(variable)s' %
{'variable': variable1})
self.message_post('Body not translatable',
subject='Subject not translatable')
self.message_post(body='<h1>%s</h1><p>%s</p>' % (
_('Paragraph translatable'), 'Paragraph not translatable'))
# Message post with translation function
self.message_post(subject=_('Subject translatable'),
body=_('Body translatable'))
self.message_post(_('Body translatable'),
_('Subject translatable'))
self.message_post(_('Body translatable'),
subject=_('Subject translatable'))
self.message_post(_('A CDR has been recovered for %s') % (variable1,))
self.message_post(_('A CDR has been recovered for %s') % variable1)
self.message_post(_('Var {a}').format(a=variable1))
self.message_post(_('Var %(variable)s') % {'variable': variable1})
self.message_post(subject=_('Subject translatable'),
body=_('Body translatable %s') % variable1)
self.message_post(subject=_('Subject translatable %(variable)s') %
{'variable': variable1},
message_type='notification')
self.message_post(_('Body translatable'),
_('Subject translatable {a}').format(a=variable1))
self.message_post(_('Body translatable %s') % variable1,
_('Subject translatable %(variable)s') %
{'variable': variable1})
self.message_post('<p>%s</p>' % _('Body translatable'))
self.message_post(body='<p>%s</p>' % _('Body translatable'))
# There is no way to know if the variable is translated, then ignoring
self.message_post(variable1)
self.message_post(body=variable1 + variable1)
self.message_post(body=(variable1 + variable1))
self.message_post(body=variable1 % variable1)
self.message_post(body=(variable1 % variable1))
# translation function with variables in the term
variable2 = variable1
self.message_post(_('Variable not translatable: %s' % variable1))
self.message_post(_('Variables not translatable: %s, %s' % (
variable1, variable2)))
self.message_post(body=_('Variable not translatable: %s' % variable1))
self.message_post(body=_('Variables not translatable: %s %s' % (
variable1, variable2)))
error_msg = _('Variable not translatable: %s' % variable1)
error_msg = _('Variables not translatable: %s, %s' % (
variable1, variable2))
error_msg = _('Variable not translatable: {}'.format(variable1))
error_msg = _('Variables not translatable: {}, {variable2}'.format(
variable1, variable2=variable2))
# string with parameters without name
# so you can't change the order in the translation
_('%s %d') % ('hello', 3)
_('%s %s') % ('hello', 'world')
_('{} {}').format('hello', 3)
_('{} {}').format('hello', 'world')
# Valid cases
_('%(strname)s') % {'strname': 'hello'}
_('%(strname)s %(intname)d') % {'strname': 'hello', 'intname': 3}
_('%s') % 'hello'
_('%d') % 3
_('{}').format('hello')
_('{}').format(3)
return error_msg
def my_method2(self, variable2):
return variable2
def my_method3(self, cr):
cr.commit() # Dangerous use of commit old api
self.env.cr.commit() # Dangerous use of commit
self._cr.commit() # Dangerous use of commit
self.cr.commit() # Dangerous use of commit
return cr
def my_method4(self, variable2):
self.env.cr2.commit() # This should not be detected
return variable2
def my_method5(self, variable2):
self.env.cr.commit2() # This should not be detected
return variable2
def my_method6(self):
user_id = 1
if user_id != 99:
# Method without translation
raise UserError('String without translation')
def my_method7(self):
user_id = 1
if user_id != 99:
# Method with translation
raise UserError(_('String with translation'))
def my_method8(self):
user_id = 1
if user_id != 99:
str_error = 'String with translation 2' # Don't check
raise UserError(str_error)
def my_method9(self):
user_id = 1
if user_id != 99:
# Method without translation
raise UserError("String without translation 2")
def my_method10(self):
# A example of built-in raise without parameters
# Shouldn't show error from lint
raise ZeroDivisionError
raise ZeroDivisionError()
def my_method11(self):
# A example of built-in raise with parameters
# Shouldn't show error from lint
raise ZeroDivisionError("String without translation")
# raise without class-exception to increase coverage
raise
raise "obsolete case"
def my_method12(self):
# Should show error
raise exceptions.Warning(
'String with params format {p1}'.format(p1='v1'))
raise exceptions.Warning(
'qp2w String with params format %(p1)s' % {'p1': 'v1'})
def my_method13(self):
# Shouldn't show error
raise exceptions.Warning(_(
'String with params format {p1}').format(p1='v1'))
raise exceptions.Warning(_(
'String with params format {p1}'.format(p1='v1')))
raise exceptions.Warning(_(
'String with params format %(p1)s') % {'p1': 'v1'})
raise exceptions.Warning(_(
'String with params format %(p1)s' % {'p1': 'v1'}))
def my_method14(self):
_("String with missing args %s %s", "param1")
_("String with missing kwargs %(param1)s", param2="hola")
_(f"String with f-interpolation {self.param1}")
_("String unsupported character %y", "param1")
_("format truncated %s%", 'param1')
_("too many args %s", 'param1', 'param2')
_("multi-positional args without placeholders %s %s", 'param1', 'param2')
_("multi-positional args without placeholders {} {}".format('param1', 'param2'))
_("String with correct args %s", "param1")
_("String with correct kwargs %(param1)s", param1="hola")
def old_api_method_alias(self, cursor, user, ids, context=None): # old api
pass
def sql_method(self, ids, cr):
# Use of query parameters: nothing wrong here
self._cr.execute(
'SELECT name FROM account WHERE id IN %s', (tuple(ids),))
self.env.cr.execute(
'SELECT name FROM account WHERE id IN %s', (tuple(ids),))
cr.execute(
'SELECT name FROM account WHERE id IN %s', (tuple(ids),))
self.cr.execute(
'SELECT name FROM account WHERE id IN %s', (tuple(ids),))
def sql_injection_ignored_cases(self, ids, cr2):
# This cr.execute2 or cr2.execute should not be detected
self._cr.execute2(
'SELECT name FROM account WHERE id IN %s' % (tuple(ids),))
cr2.execute(
'SELECT name FROM account WHERE id IN %s' % (tuple(ids),))
# Ignore when the query is built using private attributes
self._cr.execute(
'DELETE FROM %s WHERE id IN %%s' % self._table, (tuple(ids),))
# Ignore string parsed with "".format() if args are psycopg2.sql.* calls
query = "SELECT * FROM table"
# imported from pyscopg2 import sql
self._cr.execute(
sql.SQL("""CREATE or REPLACE VIEW {} as ({})""").format(
sql.Identifier(self._table),
sql.SQL(query)
))
self._cr.execute(
sql.SQL("""CREATE or REPLACE VIEW {table} as ({query})""").format(
table=sql.Identifier(self._table),
query=sql.SQL(query),
))
# imported from pyscopg2.sql import SQL, Identifier
self._cr.execute(
SQL("""CREATE or REPLACE VIEW {} as ({})""").format(
Identifier(self._table),
SQL(query),
))
self._cr.execute(
SQL("""CREATE or REPLACE VIEW {table} as ({query})""").format(
table=Identifier(self._table),
query=SQL(query),
))
# imported from pyscopg2 direclty
self._cr.execute(
psycopg2.SQL("""CREATE or REPLACE VIEW {} as ({})""").format(
psycopg2.sql.Identifier(self._table),
psycopg2.sql.SQL(query),
))
self._cr.execute(
psycopg2.sql.SQL("""CREATE or REPLACE VIEW {table} as ({query})""").format(
table=Identifier(self._table),
query=SQL(query),
))
# Variables build using pyscopg2.sql.* callers
table = Identifier('table_name')
sql_query = SQL(query)
# format params
self._cr.execute(
SQL("""CREATE or REPLACE VIEW {} as ({})""").format(
table,
sql_query,
))
# format dict
self._cr.execute(
SQL("""CREATE or REPLACE VIEW {table} as ({query})""").format(
table=table,
query=sql_query,
))
self._cr.execute(
'SELECT name FROM %(table)s' % {'table': self._table})
# old api
def sql_injection_modulo_operator(self, cr, uid, ids, context=None):
# Use of % operator: risky
self._cr.execute(
'SELECT name FROM account WHERE id IN %s' % (tuple(ids),))
self.env.cr.execute(
'SELECT name FROM account WHERE id IN %s' % (tuple(ids),))
cr.execute(
'SELECT name FROM account WHERE id IN %s' % (tuple(ids),))
self.cr.execute(
'SELECT name FROM account WHERE id IN %s' % (tuple(ids),))
operator = 'WHERE'
# Ignore sql-injection because of there is a parameter e.g. "ids"
self._cr.execute(
'SELECT name FROM account %s id IN %%s' % operator, ids)
var = 'SELECT name FROM account WHERE id IN %s'
values = ([1, 2, 3, ], )
self._cr.execute(var % values)
self._cr.execute(
'SELECT name FROM account WHERE id IN %(ids)s' % {'ids': ids})
def sql_injection_executemany(self, ids, cr, v1, v2):
# Check executemany() as well
self.cr.executemany(
'INSERT INTO account VALUES (%s, %s)' % (v1, v2))
def sql_injection_format(self, ids, cr):
# Use of .format(): risky
self.cr.execute(
'SELECT name FROM account WHERE id IN {}'.format(ids))
var = 'SELECT name FROM account WHERE id IN {}'
values = (1, 2, 3)
self._cr.execute(var.format(values))
self.cr.execute(
'SELECT name FROM account WHERE id IN {ids}'.format(ids=ids))
def sql_injection_plus_operator(self, ids, cr):
# Use of +: risky
self.cr.execute(
'SELECT name FROM account WHERE id IN ' + str(tuple(ids)))
operator = 'WHERE'
# Ignore sql-injection because of there is a parameter e.g. "ids"
self._cr.execute(
'SELECT name FROM account ' + operator + ' id IN %s', ids)
self.cr.execute(
('SELECT name FROM account ' + operator + ' id IN (1)'))
self.cr.execute(
'SELECT name FROM account ' +
operator +
' id IN %s' % (tuple(ids),))
self.cr.execute(
('SELECT name FROM account ' +
operator +
' id IN %s') % (tuple(ids),))
def sql_injection_before(self, ids):
# query built before execute: risky as well
var = 'SELECT name FROM account WHERE id IN %s' % tuple(ids)
self._cr.execute(var)
var[1] = 'SELECT name FROM account WHERE id IN %s' % tuple(ids)
self._cr.execute(var[1])
var = 'SELECT name FROM account WHERE id IN %(ids)s' % {'ids': tuple(ids)}
self._cr.execute(var)
var[1] = 'SELECT name FROM account WHERE id IN %(ids)s' % {'ids': tuple(ids)}
self._cr.execute(var[1])
def sql_no_injection_private_attributes(self, _variable, variable):
# Skip sql-injection using private attributes
self._cr.execute(
"CREATE VIEW %s AS (SELECT * FROM res_partner)" % self._table)
# Real sql-injection cases
self._cr.execute(
"CREATE VIEW %s AS (SELECT * FROM res_partner)" % self.table)
self._cr.execute(
"CREATE VIEW %s AS (SELECT * FROM res_partner)" % _variable)
self._cr.execute(
"CREATE VIEW %s AS (SELECT * FROM res_partner)" % variable)
def sql_no_injection_private_methods(self):
# Skip sql-injection using private methods
self.env.cr.execute(
"""
CREATE OR REPLACE VIEW %s AS (
%s %s %s %s
)
"""
% (
self._table,
self._select(),
self._from(),
self._where(),
self._group_by(),
)
)
def sql_no_injection_constants(self):
self.env.cr.execute("SELECT * FROM %s" % 'table_constant')
self.env.cr.execute("SELECT * FROM {}".format('table_constant'))
self.env.cr.execute(
"SELECT * FROM %(table_variable)s" % {'table_variable': 'table_constant'})
def func(self, a):
length = len(a)
return length
def requests_test(self):
# requests without timeout
requests.delete('http://localhost')
requests.get('http://localhost')
requests.head('http://localhost')
requests.options('http://localhost')
requests.patch('http://localhost')
requests.post('http://localhost')
requests.put('http://localhost')
requests.request('call', 'http://localhost')
delete_r('http://localhost')
get_r('http://localhost')
head_r('http://localhost')
options_r('http://localhost')
patch_r('http://localhost')
post_r('http://localhost')
put_r('http://localhost')
request_r('call', 'http://localhost')
delete('http://localhost')
get('http://localhost')
head('http://localhost')
options('http://localhost')
patch('http://localhost')
post('http://localhost')
put('http://localhost')
request('call', 'http://localhost')
# requests valid cases
requests.delete('http://localhost', timeout=10)
requests.get('http://localhost', timeout=10)
requests.head('http://localhost', timeout=10)
requests.options('http://localhost', timeout=10)
requests.patch('http://localhost', timeout=10)
requests.post('http://localhost', timeout=10)
requests.put('http://localhost', timeout=10)
requests.request('call', 'http://localhost', timeout=10)
delete_r('http://localhost', timeout=10)
get_r('http://localhost', timeout=10)
head_r('http://localhost', timeout=10)
options_r('http://localhost', timeout=10)
patch_r('http://localhost', timeout=10)
post_r('http://localhost', timeout=10)
put_r('http://localhost', timeout=10)
request_r('call', 'http://localhost', timeout=10)
delete('http://localhost', timeout=10)
get('http://localhost', timeout=10)
head('http://localhost', timeout=10)
options('http://localhost', timeout=10)
patch('http://localhost', timeout=10)
post('http://localhost', timeout=10)
put('http://localhost', timeout=10)
request('call', 'http://localhost', timeout=10)
# urllib without timeout
urllib.request.urlopen('http://localhost')
urlopen('http://localhost')
urlopen_r('http://localhost')
# urllib valid cases
urllib.request.urlopen('http://localhost', timeout=10)
urlopen('http://localhost', timeout=10)
urlopen_r('http://localhost', timeout=10)
# suds without timeout
suds.client.Client('http://localhost')
Client('http://localhost')
Client_r('http://localhost')
# suds valid cases
suds.client.Client('http://localhost', timeout=10)
Client('http://localhost', timeout=10)
Client_r('http://localhost', timeout=10)
# http.client without timeout
http.client.HTTPConnection('http://localhost')
http.client.HTTPSConnection('http://localhost')
HTTPConnection('http://localhost')
HTTPSConnection('http://localhost')
HTTPConnection_r('http://localhost')
HTTPSConnection_r('http://localhost')
# http.client valid cases
http.client.HTTPConnection('http://localhost', timeout=10)
http.client.HTTPSConnection('http://localhost', timeout=10)
HTTPConnection('http://localhost', timeout=10)
HTTPSConnection('http://localhost', timeout=10)
HTTPConnection_r('http://localhost', timeout=10)
HTTPSConnection_r('http://localhost', timeout=10)
# smtplib without timeout
smtplib.SMTP('http://localhost')
smtplib_r.SMTP('http://localhost')
SMTP('http://localhost')
SMTP_r('http://localhost')
# smtplib valid cases
smtplib.SMTP('http://localhost', timeout=10)
smtplib_r.SMTP('http://localhost', timeout=10)
SMTP('http://localhost', timeout=10)
SMTP_r('http://localhost', timeout=10)
# Serial without timeout
serial.Serial('/dev/ttyS1')
serial_r.Serial('/dev/ttyS1')
Serial('/dev/ttyS1')
Serial_r('/dev/ttyS1')
# serial valid cases
serial.Serial('/dev/ttyS1', timeout=10)
serial_r.Serial('/dev/ttyS1', timeout=10)
Serial('/dev/ttyS1', timeout=10)
Serial_r('/dev/ttyS1', timeout=10)
# odoo.addons.iap without timeout
odoo.addons.iap.models.iap.jsonrpc('http://localhost')
jsonrpc('http://localhost')
iap.jsonrpc('http://localhost')
# odoo.addons.iap valid cases
odoo.addons.iap.models.iap.jsonrpc('http://localhost', timeout=10)
jsonrpc('http://localhost', timeout=10)
iap.jsonrpc('http://localhost', timeout=10)
# FTP without timeout
ftplib.FTP('localhost')
ftplib_r.FTP('localhost')
FTP('localhost')
ftp_r('localhost')
# FTP valid cases
ftplib.FTP('localhost', timeout=10)
ftplib_r.FTP('localhost', timeout=10)
FTP('localhost', timeout=10)
ftp_r('localhost', timeout=10)
class TestModel3(
odoo.models.TransientModel):
# no-wizard-in-model
pass
class TestModel4(
odoo.models.TransientModel):
# Valid no-wizard-in-model
_inherit = "res.config.settings"
class TestModel5(
odoo.models.TransientModel): # pylint: disable=no-wizard-in-models
# Valid no-wizard-in-model
_inherit = "my.transient.model"
class NoOdoo(object):
length = 0
if __name__ == '__main__':
self = None
queries = [
"SELECT id FROM res_partner",
"SELECT id FROM res_users",
]
for query in queries:
self.env.cr.execute(query)