rules:
  - id: python-sqli-string-concat
    languages: [python]
    severity: ERROR
    message: >-
      Possible SQL injection (OWASP A05:2025 / CWE-89): SQL built by string
      formatting, concatenation, or f-string interpolation. Use parameterised
      queries instead.
    metadata:
      owasp: A05:2025-Injection
      cwe: CWE-89
      references:
        - https://cwe.mitre.org/data/definitions/89.html
    patterns:
      - pattern-either:
          - pattern: $CUR.execute("..." % ...)
          - pattern: $CUR.execute("..." + ...)
          - pattern: $CUR.execute(f"...")