Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added check for debug true in Django #142

Open
wants to merge 14 commits into
base: master
Choose a base branch
from

Conversation

pkalyankumar1010
Copy link

@pkalyankumar1010 pkalyankumar1010 commented Feb 27, 2025

DEBUG = True cannot be used in production in django framework.
When DEBUG = True is enabled in Django, the framework provides detailed error messages, stack traces, and sensitive information about your application. While useful for development, this setting is dangerous in production because:

❌ Risks of DEBUG = True in Production

  • Sensitive Data Exposure

    • Django displays full error traces and environment variables, which might include database credentials, API keys, or secret tokens.
  • Security Vulnerabilities

    • Debug mode allows detailed error pages that could help attackers find weaknesses in your application.
    • It can expose internal file paths and configuration details.
  • Performance Issues

    • Debug mode can slow down your app by enabling extra logging and debugging tools that aren't needed in production.

Copy link

vercel bot commented Feb 27, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment
Name Status Preview Comments Updated (UTC)
globstar ⬜️ Ignored (Inspect) Visit Preview Feb 27, 2025 1:27pm

)
)
) @avoid_django_debug_true
inculde: ["**/settings.py"]
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo in include field name

)
)
) @avoid_django_debug_true
include: ["**/settings.py"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will not work on the analysis runtime given the way the test runner is implemented. Since we look for an individual file rule-name.test.extension, settings.py will never match the pattern. Here is the related issue: #159.

# <expect-error>
DEBUG = True
# <no-error>
DEBUG = False
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even the first DEBUG, in line no. 2, should not raise an issue, since it is overwritten in line no. 4. You'd have to implement the checker in Go in order to check for the last DEBUG. You might also want to look for DEBUG statements inside conditional blocks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants