rules:
- id: avoid-raw-sql
  message: You should be very careful whenever you write raw SQL. Consider using Django ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw
  metadata:
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
    owasp: 'A1: Injection'
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions
    - https://blog.r2c.dev/2020/preventing-sql-injection-a-django-authors-perspective/
    category: security
    technology:
    - django
  languages: [python]
  severity: ERROR
  patterns:
  - pattern-either:
    - pattern: $MODEL.objects.raw($QUERY, ...)
    - pattern: django.db.models.expressions.RawSQL(...)
  - pattern-not: $MODEL.objects.raw("...")
  - pattern-not: django.db.models.expressions.RawSQL("...")