Description

Detects when Django's @csrf_exempt decorator is used to disable CSRF protection on views. This creates a security risk by removing Django's built-in Cross-Site Request Forgery (CSRF) protections, potentially allowing attackers to perform unauthorized actions by tricking authenticated users into submitting malicious requests.

Detection Strategy

• Check if the Django CSRF module or Django itself is imported in the code

• Look for function definitions or class methods that are decorated with @csrf_exempt

• Report a vulnerability for each view function that has CSRF protection explicitly disabled through the decorator

Vulnerable code example

from django.http import HttpResponse
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt  # Vulnerable: Disables CSRF protection, allowing cross-site request forgery
def user_profile(request):
    return HttpResponse('Profile updated')

✅ Secure code example

from django.http import HttpResponse
from django.views.decorators.csrf import csrf_protect

@csrf_protect  # Secure: Enforces CSRF protection against cross-site request forgery
def user_profile(request):
    return HttpResponse('Profile updated')