Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Collection of useful checks for Django Checks Frameworks
attrs
setting specified.attrs
setting specified.UniqueConstraint
with the constraints
option instead.FileField
/ ImageField
must have non empty upload_to
argument.verbose_name
must use gettext.help_text
must use gettext.null=True
.null=False
to model fields (this is django default).db_index
explicitly (to apply only to fields in indexes: when: indexes
).related_name
explicitly.null=True
), then
default=None
argument is redundant and should be removed.
WARNING Be aware that setting is database dependent,
eg. Oracle interprets empty strings as nulls as a result
django uses empty string instead of null as default.attrs
, use case.Install with pip install django-extra-checks
Add extra_checks
to INSTALLED_APPS
in your Django settings:
INSTALLED_APPS = [
...,
"django.contrib.admin", # make sure this comes before 'extra_checks' if you plan to use the `model-admin` check
"extra_checks",
...
]
To enable some check define EXTRA_CHECKS
setting with a dict of checks and its settings:
EXTRA_CHECKS = {
"checks": [
# require non empty `upload_to` argument.
"field-file-upload-to",
# use dict form if check need configuration
# eg. all models must have fk to Site model
{"id": "model-attribute", "attrs": ["site"]},
# require `db_table` for all models, increase level to CRITICAL
{"id": "model-meta-attribute", "attrs": ["db_table"], "level": "CRITICAL"},
]
}
By default only your project apps are checked but you can use
include_apps
option to specify apps to check (including third party apps):
EXTRA_CHECKS = {
# use same names as in INSTALLED_APPS
"include_apps": ["django.contrib.sites", "my_app"],
...
}
Use extra-checks-disable-next-line
comment to disable checks:
# disable specific checks on model
# extra-checks-disable-next-line model-attribute, model-admin
class MyModel(models.Model):
# disable all checks on image field
# extra-checks-disable-next-line
image = models.ImageField()
# separate comments and check's codes are also supported
# extra-checks-disable-next-line X014
# extra-checks-disable-next-line no-unique-together
class Meta:
...
Another way is to provide function that accepts field, model or
serializer class as its first argument and returns True
if it must be skipped.
Be aware that the more computation expensive your skipif functions the
slower django check will run.
skipif
example:
def skipif_streamfield(field, *args, **kwargs):
return isinstance(field, wagtail.core.fields.StreamField)
def skipif_non_core_app(model_cls, *args, **kwargs):
return model_cls._meta.app_label != "my_core_app"
EXTRA_CHECKS = {
"checks": [
{
"id": "field-verbose-name-gettext",
# make this check skip wagtail's StreamField
"skipif": skipif_streamfield
},
{
"id": "model-admin",
# models from non core app shouldn't be registered in admin
"skipif": skipif_non_core_app,
},
]
}
Install dev deps in virtualenv pip install -e .[dev,test]
.
The project was built using ideas and code snippets from:
FAQs
Collection of useful checks for Django Checks Framework
We found that django-extra-checks demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.