> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="pyramid-sqlalchemy-sql-injection">
    Distinct, Having, Group\_by, Order\_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group\_by, order\_by or filter clauses and injects user-input into the raw SQL with any function besides "bindparams". Use bindParams to securely bind user-input to SQL statements.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="pyramid-direct-use-of-response">
    Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="pyramid-csrf-check-disabled-globally">
    Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected. Use 'pyramid.config.Configurator.set\_default\_csrf\_options(require\_csrf=True)' to turn the automatic check for all unsafe methods (per RFC2616).<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-352: Cross-Site Request Forgery (CSRF)
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>
</AccordionGroup>