False red lint 'sql-injection'

[yoanymora]

@moylop260

During the preparation of an MR the following lint error appeared:

The code with the error is the following, the exact lines are highlighted in yellow:

The problem is that the code seems to be alright.

[hbto]

May the problem be the two percentage signs?

On Thu 26 Aug 2021 at 15:07 Yoany Stephany Mora Pérez Vauxoo < @.***> wrote:

During the preparation of an MR the following lint error appeared: [image: image] https://user-images.githubusercontent.com/25866693/131028658-97690b66-cb0a-4079-b497-28e286016f37.png

The code with the error is the following, the exact lines are highlighted in yellow: [image: OnPaste 20210826-150442] https://user-images.githubusercontent.com/25866693/131028608-8eacf96a-b60a-4b65-b5ca-d380e2f78e6f.png

The problem is that the code seems to be alright.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/Vauxoo/pylint-odoo/issues/179, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABZ67OX3BW64DNX75VFX2HLT62NIDANCNFSM5C4C2B2Q . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

-- Quien suscribe,

Humberto Arocha

[moylop260]

@yoanymora

Could you share a link with the sha to source code that reproduced the issue, please?

[yoanymora]

@moylop260 https://git.vauxoo.com/absa/absa/-/merge_requests/1980/diffs?commit_id=5f3dcd765fe3d880287157ebae72c79e366adc08

[moylop260]

FYI Using that commit is not reproduced

[moylop260]

I just noticed that the field has a pylint disable comment

So, I just removed it and I could reproduced it

Debugging a little bit I found that the problem is that you are using the same name of variable

So, It is detecting the variable called query has concatenation

Try using query1 = ..., query2 = ... and so on, please

[yoanymora]

@moylop260 I did this but the problem remains https://git.vauxoo.com/absa/absa/-/commit/ae8458a7ef8e26374b83f1f2d26324d66a988754

[moylop260]

That commit has valid sql injection cases since that you are concatenating domain variable

The old one didn't concatenate it that