Django Security

Step 0 — Detect

rg -n "^[Dd]jango" -g 'requirements*.txt' -g 'pyproject.toml' -g 'Pipfile*' -g 'poetry.lock'
ls manage.py **/settings.py 2>/dev/null || rg --files -g 'settings.py' | head -3

Record Django version, auth setup (django.contrib.auth vs custom), and deployment target hints.

Step 1 — Settings

rg -n "DEBUG|ALLOWED_HOSTS|SECRET_KEY|CSRF_COOKIE|SESSION_COOKIE|SECURE_" -g 'settings*.py' -g 'settings/*.py'

Step 2 — SQL injection

rg -n "\.raw\(|\.extra\(|cursor\.execute" --type py

• Model.objects.raw(f"...{request...}") / .raw("... %s" % var) → Critical
• .extra(where=[f"...{...}"]) → Critical
• ORM field lookups (filter(name__icontains=q)) → safe, note as positive

Step 3 — XSS / template injection

rg -n "mark_safe\s*\(" --type py
rg -n "\|safe\b" -g '*.html' -g '*.htm'
rg -n "Template\(|Engine\(\)\.from_string" --type py

Census, don't sample: count and disposition EVERY hit. (Do not combine these into one command — --type py and a -g '*.html' glob in the same invocation silently drop the .py hits, i.e. every mark_safe in views.) Severity by privilege direction per ../injection-flaws/SKILL.md (XSS table): unprivileged author → privileged viewer = Critical.

• mark_safe(user_data) → reflected High; stored unprivileged→staff (moderation/support/grading) Critical
• {{ var|safe }} in templates on user-derived vars → same triage
• autoescape=False in Template()/loader options → High
• Template(user_string) (string built from input) → SSTI, Critical

Step 4 — Mass assignment

rg -n "fields = '__all__'|exclude = .*ModelForm|modelform_factory" --type py

• ModelForm with fields = '__all__' on models with role/flag columns (is_superuser, is_staff, role, balance) → High/Critical
• Model(**request.POST.dict()) / manual form = X(request.POST) without restricting → same
• Fix: explicit field allowlists; request.POST is user-controlled wholesale.

Step 5 — Authorization

rg -n "login_required|LoginRequiredMixin|permission_required|@user_passes_test" --type py
rg -n "def (view|detail|edit|delete)" --type py | head -20

• Object views without ownership check (Model.objects.get(pk=request.GET['id']) returned directly) → IDOR, High
• Class-based views missing LoginRequiredMixin on data mutation → High
• @staff_member_required on endpoints exposing PII → verify minimum role

Step 6 — Files & misc

rg -n "request\.FILES|FileField|MEDIA" --type py
rg -n "pickle|eval\(|exec\(" --type py | head

• Uploads with original filenames served from MEDIA (executable content + Apache/nginx PHP exec) → Medium/High
• pickle in custom session/queue serialization → Critical
• django-debug-toolbar in non-dev requirements → Medium
• File responses built from request paths → traversal, High

Reporting

Severity table above; fixes are one-liners mostly (field allowlists, decorators, settings flags). Note ORM usage as a positive control. Dependency CVEs via ../dependency-vulns/SKILL.md.