Hey folks, I've been deep in the SAST weeds this week and I'm hitting a wall with our Checkmarx CxSAST setup. We're running it against a pretty standard Django REST Framework app, and I'm seeing it consistently miss what I'd consider obvious SQL injection vectors. I'm starting to wonder if our configuration is off, or if there's something about Django's ORM that's throwing the engine for a loop.
Here's a super simplified example of the kind of code pattern it's not flagging:
```python
# views.py
from django.db import connection
from rest_framework.views import APIView
class RiskyView(APIView):
def get(self, request):
user_input = request.GET.get('order')
# This is a raw SQL execution with string concatenation!
with connection.cursor() as cursor:
cursor.execute("SELECT * FROM orders WHERE status = '%s'" % user_input)
# ... fetch results
```
I've run scans with the default security policies (including OWASP Top 10) and made sure the Python/Django pack is enabled. The engine finds other issues like XSS or path traversal just fine, but it's silent on these raw SQL calls.
Has anyone else run into this with Django or similar ORM frameworks? I'm trying to figure out if this is a:
- **Query understanding issue**: Maybe CxSAST doesn't fully model `django.db.connection`?
- **Sink definition gap**: Could the sink list in the Python queries need updating for Django's specific cursor patterns?
- **Taint flow problem**: Perhaps the data flow analysis isn't tracking the request parameter through our middleware correctly?
I've already tried:
- Updating to the latest engine and query pack versions.
- Playing with the "Data Flow Analysis" and "Taint Tracking" settings, tuning timeouts and depths.
- Writing some custom, simpler test files with blatant SQLi to rule out project structure complexity.
The silence from the tool on these issues is concerning, especially when I throw a basic Bandit scan at the same code and it lights up like a Christmas tree. I love the idea of a comprehensive SAST tool, but if it's missing the classic vulnerabilities, it's hard to trust it for the sneaky ones.
What's your experience? Are there specific custom query rules you've written to catch Django ORM misuse, or is there a known best-practice configuration for Python web frameworks I'm missing? Would love to compare notes and configs.