odoo-security

/odoo-security

Unified security audit for Odoo modules. Scans model access rules, HTTP route authentication, sudo() privilege escalation, SQL injection risks, and record rule coverage — all in one command.

Argument Parsing

Parse $ARGUMENTS for:

Token	Type	Default	Description
First positional	path/name	(required)	Module path or name
--severity=	enum	low	Minimum severity to report: critical, high, medium, low
--layer=	enum	all	Which audit layer to run: access, routes, sudo, sql, all
--fix	flag	off	Generate and apply safe remediations after review
--json	flag	off	Output as machine-readable JSON

Examples of valid invocations:

/odoo-security my_module
/odoo-security /path/to/module --severity=high
/odoo-security my_module --layer=sudo
/odoo-security my_module --layer=access --fix
/odoo-security my_module --severity=critical --layer=routes

---

Help (No Module Provided)

If $ARGUMENTS is empty or --help, display:

Odoo Security — Comprehensive Module Security Audit

USAGE
  /odoo-security <module> [options]

LAYERS (--layer=)
  all       Run every audit layer (default)
  access    Model access rules — ir.model.access.csv completeness
  routes    HTTP route auth, CSRF, data exposure
  sudo      .sudo() usage — privilege escalation, loops, unscoped
  sql       SQL injection — unsafe cr.execute(), string formatting in queries

SEVERITY LEVELS (--severity=)
  critical  Immediate vulnerability — fix before deployment
  high      Significant risk, likely exploitable — fix within sprint
  medium    Security weakness — fix in next release
  low       Minor improvement — fix when convenient (default threshold)

EXAMPLES
  /odoo-security my_module                        Full audit, all layers
  /odoo-security my_module --severity=high        Only HIGH+ issues
  /odoo-security my_module --layer=access --fix   Check access rules, apply fixes
  /odoo-security my_module --layer=sudo           Find risky sudo() calls
  /odoo-security my_module --layer=routes         Audit HTTP route security
  /odoo-security my_module --layer=sql            Scan for SQL injection risks

LAYER EQUIVALENTS (conceptual mappings)
  Full audit        -> /odoo-security (default, all layers)
  Access rules only -> /odoo-security --layer=access
  Route security    -> /odoo-security --layer=routes
  Sudo analysis     -> /odoo-security --layer=sudo
  SQL injection     -> /odoo-security --layer=sql