---
source: crates/ruff_linter/src/rules/flake8_bandit/mod.rs
snapshot_kind: text
---
S611.py:5:27: S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
  |
4 | User.objects.annotate(val=RawSQL('secure', []))
5 | User.objects.annotate(val=RawSQL('%secure' % 'nos', []))
  |                           ^^^^^^ S611
6 | User.objects.annotate(val=RawSQL('{}secure'.format('no'), []))
7 | raw = '"username") AS "val" FROM "auth_user" WHERE "username"="admin" --'
  |

S611.py:6:27: S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
  |
4 | User.objects.annotate(val=RawSQL('secure', []))
5 | User.objects.annotate(val=RawSQL('%secure' % 'nos', []))
6 | User.objects.annotate(val=RawSQL('{}secure'.format('no'), []))
  |                           ^^^^^^ S611
7 | raw = '"username") AS "val" FROM "auth_user" WHERE "username"="admin" --'
8 | User.objects.annotate(val=RawSQL(raw, []))
  |

S611.py:8:27: S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
   |
 6 | User.objects.annotate(val=RawSQL('{}secure'.format('no'), []))
 7 | raw = '"username") AS "val" FROM "auth_user" WHERE "username"="admin" --'
 8 | User.objects.annotate(val=RawSQL(raw, []))
   |                           ^^^^^^ S611
 9 | raw = '"username") AS "val" FROM "auth_user"' \
10 |       ' WHERE "username"="admin" OR 1=%s --'
   |

S611.py:11:27: S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
   |
 9 | raw = '"username") AS "val" FROM "auth_user"' \
10 |       ' WHERE "username"="admin" OR 1=%s --'
11 | User.objects.annotate(val=RawSQL(raw, [0]))
   |                           ^^^^^^ S611
12 | User.objects.annotate(val=RawSQL(sql='{}secure'.format('no'), params=[]))
13 | User.objects.annotate(val=RawSQL(params=[], sql='{}secure'.format('no')))
   |

S611.py:12:27: S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
   |
10 |       ' WHERE "username"="admin" OR 1=%s --'
11 | User.objects.annotate(val=RawSQL(raw, [0]))
12 | User.objects.annotate(val=RawSQL(sql='{}secure'.format('no'), params=[]))
   |                           ^^^^^^ S611
13 | User.objects.annotate(val=RawSQL(params=[], sql='{}secure'.format('no')))
   |

S611.py:13:27: S611 Use of `RawSQL` can lead to SQL injection vulnerabilities
   |
11 | User.objects.annotate(val=RawSQL(raw, [0]))
12 | User.objects.annotate(val=RawSQL(sql='{}secure'.format('no'), params=[]))
13 | User.objects.annotate(val=RawSQL(params=[], sql='{}secure'.format('no')))
   |                           ^^^^^^ S611
   |
