chore: remove warning rules
semgrep-action doesn't consider severity, hence ignoring these rules for now.
This commit is contained in:
parent
6fbb2d3507
commit
28d52c4a95
15
.github/helper/semgrep_rules/security.yml
vendored
15
.github/helper/semgrep_rules/security.yml
vendored
@ -8,18 +8,3 @@ rules:
|
|||||||
dynamic content. Avoid it or use safe_eval().
|
dynamic content. Avoid it or use safe_eval().
|
||||||
languages: [python]
|
languages: [python]
|
||||||
severity: ERROR
|
severity: ERROR
|
||||||
|
|
||||||
- id: frappe-sqli-format-strings
|
|
||||||
patterns:
|
|
||||||
- pattern-inside: |
|
|
||||||
@frappe.whitelist()
|
|
||||||
def $FUNC(...):
|
|
||||||
...
|
|
||||||
- pattern-either:
|
|
||||||
- pattern: frappe.db.sql("..." % ...)
|
|
||||||
- pattern: frappe.db.sql(f"...", ...)
|
|
||||||
- pattern: frappe.db.sql("...".format(...), ...)
|
|
||||||
message: |
|
|
||||||
Detected use of raw string formatting for SQL queries. This can lead to sql injection vulnerabilities. Refer security guidelines - https://github.com/frappe/erpnext/wiki/Code-Security-Guidelines
|
|
||||||
languages: [python]
|
|
||||||
severity: WARNING
|
|
||||||
|
Loading…
Reference in New Issue
Block a user