rules:
  - id: yams.cpp.dynamic-sql-execute
    languages: [cpp]
    severity: WARNING
    message: >-
      Dynamic SQL passed to Database::execute-style API. Prefer prepareStatement() with bound
      parameters for external data; allow only fixed PRAGMA/schema statements with documented bounds.
    metadata:
      category: security
      cwe: "CWE-89"
      confidence: medium
      precision: medium
      yams_triage: sql-boundary
      references:
        - https://semgrep.dev/docs/writing-rules/data-flow/taint-mode/overview
    pattern-either:
      - pattern: $DB.execute($A + $B)
      - pattern: $DB.execute($A + $B + ...)
      - pattern: $DB.execute(fmt::format(...))
      - pattern: $DB.execute(yamsfmt::format(...))
      - pattern: $DB.execute(std::format(...))
    paths:
      include:
        - /src/**/*.cpp
        - /include/**/*.h
        - /tools/opengrep/tests/**/*.cpp
        - tools/opengrep/tests/**/*.cpp
      exclude:
        - /tests/**
        - /third_party/**
        - /external/**
        - /build/**
        - /build*/**