thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/rules/sql-injection.json

@@ -1,619 +1,619 @@
-[
-  {
-    "id": "SQL001",
-    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE).*(?:['\"`]\\s*\\+|\\+\\s*['\"`]|fmt\\.Sprintf|%\\s*\\w+)",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL002",
-    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE).*'%s'|'%s'.*(?:SELECT|WHERE)",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL003",
-    "pattern": "SELECT.*\\$\\{|INSERT.*\\$\\{|UPDATE.*\\$\\{|DELETE.*\\$\\{",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL004",
-    "pattern": "query\\s*=\\s*['\"`][^'\"`]*['\"`]\\s*\\+|f['\"].*(?:SELECT|WHERE)",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL005",
-    "pattern": "\\$[\"'](?:[^\"']*(?:SELECT|INSERT|UPDATE|DELETE|WHERE|FROM)[^\"']*)[\"']",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: C# string interpolation ($\"...\") in SQL",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL006",
-    "pattern": "(?:rawQuery|rawSql|raw_query|execute|db\\.query)\\s*\\(\\s*['\"`].*\\$[{a-zA-Z]",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: rawQuery / rawSQL / execute with string interpolation",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL007",
-    "pattern": "(?:rawQuery|execSQL|executeQuery|execute)\\s*\\(\\s*['\"`][^'\"`,]*['\"`]\\s*\\.format\\s*\\(",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: rawQuery / rawSQL / execute with string interpolation",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL008",
-    "pattern": "rawQuery\\s*\\(\\s*[\"'].*\\$[a-zA-Z{]",
-    "flags": "",
-    "category": "sql_injection",
-    "description": "SQL injection: Kotlin rawQuery with string interpolation ($variable)",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL009",
-    "pattern": "(?:connection|ActiveRecord::Base\\.connection)\\.execute\\s*\\([^)]*#\\{",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: Ruby connection.execute with string interpolation",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL010",
-    "pattern": "cursor\\.execute\\s*\\([^)]*\\.format\\s*\\(|cursor\\.execute\\s*\\([^)]*%s",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: Django/Python cursor.execute with .format()",
-    "language": [
-      "python"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL011",
-    "pattern": "(?:mysqli_query|pg_query|mysql_query)\\s*\\([^,]+,\\s*['\"][^'\"]*['\"]?\\s*\\.\\s*\\$",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: PHP mysqli_query / pg_query with variable concatenation",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL012",
-    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE)\\s[^'\"]*\\.\\s*\\$[a-zA-Z_]",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: PHP mysqli_query / pg_query with variable concatenation",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL013",
-    "pattern": "ORDER\\s+BY\\s+\\$\\{|ORDER\\s+BY.*['\"`]\\s*\\+\\s*\\w|GROUP\\s+BY\\s+\\$\\{",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: dynamic ORDER BY / column name from user variable",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL014",
-    "pattern": "`[^`]*(?:FROM|WHERE|ORDER BY|GROUP BY|SET)[^`]*\\$\\{",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: template literal with SQL keywords and column/table variable",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL015",
-    "pattern": "[\"'][^\"']*(?:SELECT|WHERE|FROM|DELETE|UPDATE)[^\"']*[\"']\\s*\\.\\s*\\$[a-zA-Z_]",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: PHP dot-concat with SQL string (\"SELECT...\" . $var)",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL016",
-    "pattern": "[\"']SELECT[^\"']*\\$[a-zA-Z_]|[\"']DELETE[^\"']*\\$[a-zA-Z_]|[\"']UPDATE[^\"']*\\$[a-zA-Z_]",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: PHP variable in double-quoted SQL string (\"SELECT * FROM $table WHERE $where\")",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL017",
-    "pattern": "mysqli_query\\s*\\(\\s*\\$[a-zA-Z_]+\\s*,\\s*\\$[a-zA-Z_]|pg_query\\s*\\(\\s*\\$[a-zA-Z_]+\\s*,\\s*\\$[a-zA-Z_]",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: mysqli_query / pg_query called with variable built by concat",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL018",
-    "pattern": "\\.where\\s*\\(\\s*[\"'][^\"']*#\\{|\\.find_by_sql\\s*\\(\\s*[\"'][^\"']*#\\{",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: Ruby .where() or .find_by_sql() with string interpolation",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL019",
-    "pattern": "[\"'](?:SELECT|DELETE|UPDATE|INSERT)[^\"']*#\\{[a-zA-Z_]",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: Ruby string with SQL keywords and #{} interpolation",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL020",
-    "pattern": "string\\.Format\\s*\\(\\s*[\"'][^\"']*(?:SELECT|WHERE|FROM|DELETE)[^\"']*[\"']",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: C# string.Format with SQL",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL021",
-    "pattern": "(?:String\\s+\\w+|var\\s+\\w+)\\s*=\\s*[\"']SELECT[^\"']*[\"']\\s*\\+\\s*\\w",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: Java/C# string variable assigned SQL with concat",
-    "language": [
-      "csharp",
-      "java"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL022",
-    "pattern": "cursor\\.execute\\s*\\(\\s*[\"'][^\"']*[\"']\\s*%\\s*\\(",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: Python cursor.execute with % operator format",
-    "language": [
-      "python"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL023",
-    "pattern": "\\.extra\\s*\\(\\s*where\\s*=\\[[\"'][^\"']*%s",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: Django .extra() with user-controlled where arg",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL024",
-    "pattern": "(?:repository|connection|dataSource|sequelize|db)\\.query\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+\\s*\\w",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: TypeORM/Sequelize .query() with string concat",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL025",
-    "pattern": "val\\s+\\w*[Ss]election\\w*\\s*=\\s*[\"'][^\"']*\\$[a-zA-Z_]",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "SQL injection: Kotlin rawQuery where selection string contains interpolated var",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL026",
-    "pattern": "new SqlCommand\\s*\\(\\s*(?:\"[^\"]*\"\\s*\\+|string\\.Format|\\$[\"'])",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL027",
-    "pattern": "\\.CommandText\\s*=\\s*(?:\"[^\"]*\"\\s*\\+|\\$[\"'])",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL028",
-    "pattern": "string\\.Format\\s*\\(\\s*[\"'][^\"']*(SELECT|INSERT|UPDATE|DELETE|WHERE)",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL029",
-    "pattern": "new SqlCommand\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL030",
-    "pattern": "\\.where\\s*\\(\\s*[\"'][^\"']*#\\{",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL031",
-    "pattern": "find_by_sql\\s*\\(\\s*[\"'][^\"']*#\\{",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL032",
-    "pattern": "ActiveRecord::Base\\.connection\\.execute\\s*\\(\\s*[\"'][^\"']*#\\{",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL033",
-    "pattern": "\\.order\\s*\\(\\s*[\"'][^\"']*#\\{",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL034",
-    "pattern": "mysqli_query\\s*\\(\\s*\\$\\w+\\s*,\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL035",
-    "pattern": "mysql_query\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL036",
-    "pattern": "\\$pdo->query\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL037",
-    "pattern": "\\$(?:query|sql)\\s*=\\s*[\"'][^\"']*(?:SELECT|INSERT|UPDATE|DELETE)[^\"']*[\"']?\\s*\\.\\s*\\$",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL038",
-    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE)[^\"'\\n]*\\$(?:_GET|_POST|_REQUEST|_COOKIE)\\[",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL039",
-    "pattern": "db\\.(?:Query|QueryRow|Exec)\\s*\\(\\s*fmt\\.Sprintf\\s*\\(",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "Go SQL injection: db.Query/QueryRow/Exec with fmt.Sprintf",
-    "language": [
-      "go"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL040",
-    "pattern": "r\\.DB\\.(?:Query|QueryRow|Exec|ExecContext)\\s*\\(\\s*fmt\\.Sprintf\\s*\\(",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "Go SQL injection: db.Query/QueryRow/Exec with fmt.Sprintf",
-    "language": [
-      "go"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL041",
-    "pattern": "h\\.DB\\.(?:Query|QueryRow|Exec)\\s*\\(\\s*fmt\\.Sprintf\\s*\\(",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "Go SQL injection: db.Query/QueryRow/Exec with fmt.Sprintf",
-    "language": [
-      "go"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL042",
-    "pattern": "[\"']\\s*EXEC\\s+\\w+\\s*['\"\"]\\s*\\+|EXEC\\s+sp_\\w+\\s*['\"\"]\\s*\\+",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "C# SQL injection: EXEC stored procedure via string concat",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL043",
-    "pattern": "\"EXEC\\s+sp_\\w+[^\"]*\"\\s*\\+|string sql\\s*=\\s*\"EXEC",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "C# SQL injection: EXEC stored procedure via string concat",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL044",
-    "pattern": "\"[^\"]*(?:SELECT|INSERT|UPDATE|DELETE)[^\"]*\\$[a-zA-Z_]\\w*[^\"]*\"",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "Kotlin: SQL injection via string template with embedded interpolation",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL045",
-    "pattern": "\"\"\"\\.format\\s*\\(|'''\\.format\\s*\\(",
-    "flags": "",
-    "category": "sql_injection",
-    "description": "Python: SQL injection via .format() on multi-line raw SQL string",
-    "language": [
-      "python"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL046",
-    "pattern": "\\$(?:query|sql|qry)\\s*\\.=\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE|[a-zA-Z_]\\w*)",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "PHP SQL injection: appending user variable to existing query with .= operator",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "SQL047",
-    "pattern": "\"SELECT[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"UPDATE[^\"]*SET[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"DELETE[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]",
-    "flags": "i",
-    "category": "sql_injection",
-    "description": "PHP SQL injection: SQL WHERE/SET clause with dot-concatenated variable",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  }
-]
+[
+  {
+    "id": "SQL001",
+    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE).*(?:['\"`]\\s*\\+|\\+\\s*['\"`]|fmt\\.Sprintf|%\\s*\\w+)",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL002",
+    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE).*'%s'|'%s'.*(?:SELECT|WHERE)",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL003",
+    "pattern": "SELECT.*\\$\\{|INSERT.*\\$\\{|UPDATE.*\\$\\{|DELETE.*\\$\\{",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL004",
+    "pattern": "query\\s*=\\s*['\"`][^'\"`]*['\"`]\\s*\\+|f['\"].*(?:SELECT|WHERE)",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL005",
+    "pattern": "\\$[\"'](?:[^\"']*(?:SELECT|INSERT|UPDATE|DELETE|WHERE|FROM)[^\"']*)[\"']",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: C# string interpolation ($\"...\") in SQL",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL006",
+    "pattern": "(?:rawQuery|rawSql|raw_query|execute|db\\.query)\\s*\\(\\s*['\"`].*\\$[{a-zA-Z]",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: rawQuery / rawSQL / execute with string interpolation",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL007",
+    "pattern": "(?:rawQuery|execSQL|executeQuery|execute)\\s*\\(\\s*['\"`][^'\"`,]*['\"`]\\s*\\.format\\s*\\(",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: rawQuery / rawSQL / execute with string interpolation",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL008",
+    "pattern": "rawQuery\\s*\\(\\s*[\"'].*\\$[a-zA-Z{]",
+    "flags": "",
+    "category": "sql_injection",
+    "description": "SQL injection: Kotlin rawQuery with string interpolation ($variable)",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL009",
+    "pattern": "(?:connection|ActiveRecord::Base\\.connection)\\.execute\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: Ruby connection.execute with string interpolation",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL010",
+    "pattern": "cursor\\.execute\\s*\\([^)]*\\.format\\s*\\(|cursor\\.execute\\s*\\([^)]*%s",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: Django/Python cursor.execute with .format()",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL011",
+    "pattern": "(?:mysqli_query|pg_query|mysql_query)\\s*\\([^,]+,\\s*['\"][^'\"]*['\"]?\\s*\\.\\s*\\$",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: PHP mysqli_query / pg_query with variable concatenation",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL012",
+    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE)\\s[^'\"]*\\.\\s*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: PHP mysqli_query / pg_query with variable concatenation",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL013",
+    "pattern": "ORDER\\s+BY\\s+\\$\\{|ORDER\\s+BY.*['\"`]\\s*\\+\\s*\\w|GROUP\\s+BY\\s+\\$\\{",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: dynamic ORDER BY / column name from user variable",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL014",
+    "pattern": "`[^`]*(?:FROM|WHERE|ORDER BY|GROUP BY|SET)[^`]*\\$\\{",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: template literal with SQL keywords and column/table variable",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL015",
+    "pattern": "[\"'][^\"']*(?:SELECT|WHERE|FROM|DELETE|UPDATE)[^\"']*[\"']\\s*\\.\\s*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: PHP dot-concat with SQL string (\"SELECT...\" . $var)",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL016",
+    "pattern": "[\"']SELECT[^\"']*\\$[a-zA-Z_]|[\"']DELETE[^\"']*\\$[a-zA-Z_]|[\"']UPDATE[^\"']*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: PHP variable in double-quoted SQL string (\"SELECT * FROM $table WHERE $where\")",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL017",
+    "pattern": "mysqli_query\\s*\\(\\s*\\$[a-zA-Z_]+\\s*,\\s*\\$[a-zA-Z_]|pg_query\\s*\\(\\s*\\$[a-zA-Z_]+\\s*,\\s*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: mysqli_query / pg_query called with variable built by concat",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL018",
+    "pattern": "\\.where\\s*\\(\\s*[\"'][^\"']*#\\{|\\.find_by_sql\\s*\\(\\s*[\"'][^\"']*#\\{",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: Ruby .where() or .find_by_sql() with string interpolation",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL019",
+    "pattern": "[\"'](?:SELECT|DELETE|UPDATE|INSERT)[^\"']*#\\{[a-zA-Z_]",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: Ruby string with SQL keywords and #{} interpolation",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL020",
+    "pattern": "string\\.Format\\s*\\(\\s*[\"'][^\"']*(?:SELECT|WHERE|FROM|DELETE)[^\"']*[\"']",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: C# string.Format with SQL",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL021",
+    "pattern": "(?:String\\s+\\w+|var\\s+\\w+)\\s*=\\s*[\"']SELECT[^\"']*[\"']\\s*\\+\\s*\\w",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: Java/C# string variable assigned SQL with concat",
+    "language": [
+      "csharp",
+      "java"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL022",
+    "pattern": "cursor\\.execute\\s*\\(\\s*[\"'][^\"']*[\"']\\s*%\\s*\\(",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: Python cursor.execute with % operator format",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL023",
+    "pattern": "\\.extra\\s*\\(\\s*where\\s*=\\[[\"'][^\"']*%s",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: Django .extra() with user-controlled where arg",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL024",
+    "pattern": "(?:repository|connection|dataSource|sequelize|db)\\.query\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+\\s*\\w",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: TypeORM/Sequelize .query() with string concat",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL025",
+    "pattern": "val\\s+\\w*[Ss]election\\w*\\s*=\\s*[\"'][^\"']*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "SQL injection: Kotlin rawQuery where selection string contains interpolated var",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL026",
+    "pattern": "new SqlCommand\\s*\\(\\s*(?:\"[^\"]*\"\\s*\\+|string\\.Format|\\$[\"'])",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL027",
+    "pattern": "\\.CommandText\\s*=\\s*(?:\"[^\"]*\"\\s*\\+|\\$[\"'])",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL028",
+    "pattern": "string\\.Format\\s*\\(\\s*[\"'][^\"']*(SELECT|INSERT|UPDATE|DELETE|WHERE)",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL029",
+    "pattern": "new SqlCommand\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL030",
+    "pattern": "\\.where\\s*\\(\\s*[\"'][^\"']*#\\{",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL031",
+    "pattern": "find_by_sql\\s*\\(\\s*[\"'][^\"']*#\\{",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL032",
+    "pattern": "ActiveRecord::Base\\.connection\\.execute\\s*\\(\\s*[\"'][^\"']*#\\{",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL033",
+    "pattern": "\\.order\\s*\\(\\s*[\"'][^\"']*#\\{",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL034",
+    "pattern": "mysqli_query\\s*\\(\\s*\\$\\w+\\s*,\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL035",
+    "pattern": "mysql_query\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL036",
+    "pattern": "\\$pdo->query\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL037",
+    "pattern": "\\$(?:query|sql)\\s*=\\s*[\"'][^\"']*(?:SELECT|INSERT|UPDATE|DELETE)[^\"']*[\"']?\\s*\\.\\s*\\$",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL038",
+    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE)[^\"'\\n]*\\$(?:_GET|_POST|_REQUEST|_COOKIE)\\[",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL039",
+    "pattern": "db\\.(?:Query|QueryRow|Exec)\\s*\\(\\s*fmt\\.Sprintf\\s*\\(",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "Go SQL injection: db.Query/QueryRow/Exec with fmt.Sprintf",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL040",
+    "pattern": "r\\.DB\\.(?:Query|QueryRow|Exec|ExecContext)\\s*\\(\\s*fmt\\.Sprintf\\s*\\(",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "Go SQL injection: db.Query/QueryRow/Exec with fmt.Sprintf",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL041",
+    "pattern": "h\\.DB\\.(?:Query|QueryRow|Exec)\\s*\\(\\s*fmt\\.Sprintf\\s*\\(",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "Go SQL injection: db.Query/QueryRow/Exec with fmt.Sprintf",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL042",
+    "pattern": "[\"']\\s*EXEC\\s+\\w+\\s*['\"\"]\\s*\\+|EXEC\\s+sp_\\w+\\s*['\"\"]\\s*\\+",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "C# SQL injection: EXEC stored procedure via string concat",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL043",
+    "pattern": "\"EXEC\\s+sp_\\w+[^\"]*\"\\s*\\+|string sql\\s*=\\s*\"EXEC",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "C# SQL injection: EXEC stored procedure via string concat",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL044",
+    "pattern": "\"[^\"]*(?:SELECT|INSERT|UPDATE|DELETE)[^\"]*\\$[a-zA-Z_]\\w*[^\"]*\"",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "Kotlin: SQL injection via string template with embedded interpolation",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL045",
+    "pattern": "\"\"\"\\.format\\s*\\(|'''\\.format\\s*\\(",
+    "flags": "",
+    "category": "sql_injection",
+    "description": "Python: SQL injection via .format() on multi-line raw SQL string",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL046",
+    "pattern": "\\$(?:query|sql|qry)\\s*\\.=\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE|[a-zA-Z_]\\w*)",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "PHP SQL injection: appending user variable to existing query with .= operator",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SQL047",
+    "pattern": "\"SELECT[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"UPDATE[^\"]*SET[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"DELETE[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "sql_injection",
+    "description": "PHP SQL injection: SQL WHERE/SET clause with dot-concatenated variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  }
+]