Flag more code patterns in asyncpg-sqli ruleset

semgrep · Aug 3, 2023 · 41661c6 · 41661c6
1 parent 259b56b
commit 41661c6
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/python/lang/security/audit/sqli/asyncpg-sqli.py b/python/lang/security/audit/sqli/asyncpg-sqli.py
@@ -64,6 +64,11 @@ def bad10(conn: asyncpg.Connection):
         # ruleid: asyncpg-sqli
         cur = await conn.cursor(sql_query)
 
+def bad11(conn: asyncpg.Connection):
+    import common
+    # ruleid: asyncpg-sqli
+    cur = conn.fetch(common.bad_query_1.format(user_input))
+
 def ok1(user_input):
     con = await asyncpg.connect(user='postgres')
     # ok: asyncpg-sqli

diff --git a/python/lang/security/audit/sqli/asyncpg-sqli.yaml b/python/lang/security/audit/sqli/asyncpg-sqli.yaml
@@ -63,6 +63,7 @@ rules:
           $QUERY = '...' % ()
           ...
     - pattern: $CONN.$METHOD(..., $X + $Y, ...)
+    - pattern: $CONN.$METHOD(..., $Y.format(...), ...)
     - pattern: $CONN.$METHOD(..., '...'.format(...), ...)
     - pattern: $CONN.$METHOD(..., '...' % (...), ...)
     - pattern: $CONN.$METHOD(..., f'...{$USERINPUT}...', ...)