---
source: crates/ruff_linter/src/rules/flake8_bandit/mod.rs
---
S610 Use of Django `extra` can lead to SQL injection vulnerabilities
 --> S610.py:4:44
  |
3 | # Errors
4 | User.objects.filter(username='admin').extra(dict(could_be='insecure'))
  |                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^
5 | User.objects.filter(username='admin').extra(select=dict(could_be='insecure'))
6 | User.objects.filter(username='admin').extra(select={'test': '%secure' % 'nos'})
  |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
 --> S610.py:5:44
  |
3 | # Errors
4 | User.objects.filter(username='admin').extra(dict(could_be='insecure'))
5 | User.objects.filter(username='admin').extra(select=dict(could_be='insecure'))
  |                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
6 | User.objects.filter(username='admin').extra(select={'test': '%secure' % 'nos'})
7 | User.objects.filter(username='admin').extra(select={'test': '{}secure'.format('nos')})
  |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
 --> S610.py:6:44
  |
4 | User.objects.filter(username='admin').extra(dict(could_be='insecure'))
5 | User.objects.filter(username='admin').extra(select=dict(could_be='insecure'))
6 | User.objects.filter(username='admin').extra(select={'test': '%secure' % 'nos'})
  |                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
7 | User.objects.filter(username='admin').extra(select={'test': '{}secure'.format('nos')})
8 | User.objects.filter(username='admin').extra(where=['%secure' % 'nos'])
  |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
 --> S610.py:7:44
  |
5 | User.objects.filter(username='admin').extra(select=dict(could_be='insecure'))
6 | User.objects.filter(username='admin').extra(select={'test': '%secure' % 'nos'})
7 | User.objects.filter(username='admin').extra(select={'test': '{}secure'.format('nos')})
  |                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
8 | User.objects.filter(username='admin').extra(where=['%secure' % 'nos'])
9 | User.objects.filter(username='admin').extra(where=['{}secure'.format('no')])
  |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
 --> S610.py:8:44
  |
6 | User.objects.filter(username='admin').extra(select={'test': '%secure' % 'nos'})
7 | User.objects.filter(username='admin').extra(select={'test': '{}secure'.format('nos')})
8 | User.objects.filter(username='admin').extra(where=['%secure' % 'nos'])
  |                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^
9 | User.objects.filter(username='admin').extra(where=['{}secure'.format('no')])
  |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
  --> S610.py:9:44
   |
 7 | User.objects.filter(username='admin').extra(select={'test': '{}secure'.format('nos')})
 8 | User.objects.filter(username='admin').extra(where=['%secure' % 'nos'])
 9 | User.objects.filter(username='admin').extra(where=['{}secure'.format('no')])
   |                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
10 |
11 | query = '"username") AS "username", * FROM "auth_user" WHERE 1=1 OR "username"=? --'
   |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
  --> S610.py:12:44
   |
11 | query = '"username") AS "username", * FROM "auth_user" WHERE 1=1 OR "username"=? --'
12 | User.objects.filter(username='admin').extra(select={'test': query})
   |                                            ^^^^^^^^^^^^^^^^^^^^^^^^
13 |
14 | where_var = ['1=1) OR 1=1 AND (1=1']
   |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
  --> S610.py:15:44
   |
14 | where_var = ['1=1) OR 1=1 AND (1=1']
15 | User.objects.filter(username='admin').extra(where=where_var)
   |                                            ^^^^^^^^^^^^^^^^^
16 |
17 | where_str = '1=1) OR 1=1 AND (1=1'
   |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
  --> S610.py:18:44
   |
17 | where_str = '1=1) OR 1=1 AND (1=1'
18 | User.objects.filter(username='admin').extra(where=[where_str])
   |                                            ^^^^^^^^^^^^^^^^^^^
19 |
20 | tables_var = ['django_content_type" WHERE "auth_user"."username"="admin']
   |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
  --> S610.py:21:25
   |
20 | tables_var = ['django_content_type" WHERE "auth_user"."username"="admin']
21 | User.objects.all().extra(tables=tables_var).distinct()
   |                         ^^^^^^^^^^^^^^^^^^^
22 |
23 | tables_str = 'django_content_type" WHERE "auth_user"."username"="admin'
   |

S610 Use of Django `extra` can lead to SQL injection vulnerabilities
  --> S610.py:24:25
   |
23 | tables_str = 'django_content_type" WHERE "auth_user"."username"="admin'
24 | User.objects.all().extra(tables=[tables_str]).distinct()
   |                         ^^^^^^^^^^^^^^^^^^^^^
25 |
26 | # OK
   |
