33 lines
1 KiB
YAML
33 lines
1 KiB
YAML
rules:
|
|
- id: yams.cpp.dynamic-sql-execute
|
|
languages: [cpp]
|
|
severity: WARNING
|
|
message: >-
|
|
Dynamic SQL passed to Database::execute-style API. Prefer prepareStatement() with bound
|
|
parameters for external data; allow only fixed PRAGMA/schema statements with documented bounds.
|
|
metadata:
|
|
category: security
|
|
cwe: "CWE-89"
|
|
confidence: medium
|
|
precision: medium
|
|
yams_triage: sql-boundary
|
|
references:
|
|
- https://semgrep.dev/docs/writing-rules/data-flow/taint-mode/overview
|
|
pattern-either:
|
|
- pattern: $DB.execute($A + $B)
|
|
- pattern: $DB.execute($A + $B + ...)
|
|
- pattern: $DB.execute(fmt::format(...))
|
|
- pattern: $DB.execute(yamsfmt::format(...))
|
|
- pattern: $DB.execute(std::format(...))
|
|
paths:
|
|
include:
|
|
- /src/**/*.cpp
|
|
- /include/**/*.h
|
|
- /tools/opengrep/tests/**/*.cpp
|
|
- tools/opengrep/tests/**/*.cpp
|
|
exclude:
|
|
- /tests/**
|
|
- /third_party/**
|
|
- /external/**
|
|
- /build/**
|
|
- /build*/**
|