Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Exclude access to request.user from view #3241

Merged
merged 3 commits into from
Dec 20, 2023

Conversation

tartieret
Copy link
Contributor

The django test for access to foreign keys exclude request.user but fails if we do this within a view and use self.request.user. This PR fixes the issue by excluding this common use case in django & django rest framework.

@CLAassistant
Copy link

CLAassistant commented Dec 12, 2023

CLA assistant check
All committers have signed the CLA.

@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@tartieret
Copy link
Contributor Author

@0xDC0DE sorry to ping you, but I saw that you recently approved another django-related rule and that you work at Semgrep. I am wondering if we could get this merged as it leads to false positive and would be a super quick review?

Copy link
Collaborator

@p4p3r p4p3r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tartieret, it looks good to me!

@p4p3r
Copy link
Collaborator

p4p3r commented Dec 20, 2023

I'm going to merge in develop and it will make its way into release later this week!

@p4p3r p4p3r merged commit 11d1ee7 into semgrep:develop Dec 20, 2023
7 checks passed
@tartieret
Copy link
Contributor Author

I'm going to merge in develop and it will make its way into release later this week!

Thanks a lot!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants