[SizzleUnrlsd]

Summary

What DjangoGoat (branch broken) showed: its views are plain functions listed in urls.py, so none was an entry point, and its login builds a query for User.objects.raw, a sink the models only knew under Manager.raw.

• Tests first (test: define URL-registered views and ORM suffix sinks), implementation follows.
• RouteRegistrar model: a call that registers a handler elsewhere, with the argument (or keyword) that references it. taint/routes.py scans the module-level calls of a module, resolves the registrar through the symbol table and the handler to a project symbol, as_view() and routers included, and the engine merges every module's registrations into the taint.routes input before analysing, so a registered function, or the methods of a registered class, receive attacker-controlled parameters wherever they are defined. Routes reach the worker processes and are part of the cache key, so editing urls.py re-analyses the views. Shipped for Django (path, re_path, url, REST framework routers), Flask (add_url_rule) and FastAPI (add_api_route).
• SuffixSink model: a sink matched by the tail of a call's symbol; objects.raw and objects.extra are SQL sinks for any model class, statement argument only.

On DjangoGoat this reports the login injection the branch introduces, through User.objects.raw, and the notes views become entry points. Across the sixteen repositories nothing else changes.