django-extra (S610)
Derived from the flake8-bandit linter.
What it does
Checks for uses of Django's extra function where one or more arguments
passed are not literal expressions.
Why is this bad?
Django's extra function can be used to execute arbitrary SQL queries,
which can in turn lead to SQL injection vulnerabilities.
Example
from django.contrib.auth.models import User
# String interpolation creates a security loophole that could be used
# for SQL injection:
User.objects.all().extra(select={"test": "%secure" % "nos"})
Use instead:
from django.contrib.auth.models import User
# SQL injection is impossible if all arguments are literal expressions:
User.objects.all().extra(select={"test": "secure"})