django-raw-sql (S611)
Derived from the flake8-bandit linter.
What it does
Checks for uses of Django's RawSQL function.
Why is this bad?
Django's RawSQL function can be used to execute arbitrary SQL queries,
which can in turn lead to SQL injection vulnerabilities.
Example
from django.db.models.expressions import RawSQL
from django.contrib.auth.models import User
User.objects.annotate(val=("%secure" % "nos", []))