rules:
- id: no-csrf-exempt
  pattern: |
    @django.views.decorators.csrf.csrf_exempt
    def $R(...):
      ...
  message: There is rarely a good reason to use @csrf_exempt as is used for `$R`.
  metadata:
    cwe: 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp: 'A6: Security Misconfiguration'
    category: security
    technology:
    - django
  languages: [python]
  severity: WARNING