mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-30 18:56:16 +00:00
20 lines
1.1 KiB
Text
20 lines
1.1 KiB
Text
# Semgrep Ignore File for NoDupeLabs
|
|
#
|
|
# EXCLUSION RATIONALE:
|
|
# The SQL queries in nodupe/tools/databases/*.py files use the _validate_identifier()
|
|
# function to sanitize all table and column names before constructing SQL queries.
|
|
# This function validates that identifiers match the pattern ^[a-zA-Z_][a-zA-Z0-9_]*$,
|
|
# which effectively prevents SQL injection attacks by only allowing alphanumeric
|
|
# characters and underscores, with the requirement that identifiers start with a letter.
|
|
#
|
|
# Semgrep's sqlalchemy-execute-raw-query and formatted-sql-query rules flag these
|
|
# as potential vulnerabilities because they cannot track data flow through custom
|
|
# validation functions. These are false positives because the _validate_identifier()
|
|
# function provides equivalent or stronger protection than parameterized queries
|
|
# for identifier sanitization.
|
|
#
|
|
# Reference: nodupe/tools/databases/security.py and nodupe/tools/databases/wrapper.py
|
|
|
|
# Exclude database files from Semgrep scanning
|
|
# These files use _validate_identifier() to prevent SQL injection
|
|
nodupe/tools/databases/*
|