From dafa726c00fd80c31c340dcbbecc9e71b0d3937a Mon Sep 17 00:00:00 2001
From: kamran-nizamani <kamrannizamani35@gmail.com>
Date: Thu, 23 Jul 2026 02:18:57 +0500
Subject: [PATCH] Add Semgrep rule for CWE-89 SQL injection

---
 .../scanners/semgrep_rules/sql_injection.yml        | 13 +++++++++++++
 .../tests/unit/scanners/test_semgrep_scanner.py     | 13 +++++++------
 2 files changed, 20 insertions(+), 6 deletions(-)
 create mode 100644 packages/cortexward-scanners/src/cortexward/scanners/semgrep_rules/sql_injection.yml

diff --git a/packages/cortexward-scanners/src/cortexward/scanners/semgrep_rules/sql_injection.yml b/packages/cortexward-scanners/src/cortexward/scanners/semgrep_rules/sql_injection.yml
new file mode 100644
index 0000000..739f65d
--- /dev/null
+++ b/packages/cortexward-scanners/src/cortexward/scanners/semgrep_rules/sql_injection.yml
@@ -0,0 +1,13 @@
+rules:
+  - id: cortexward-sql-injection-format-string
+    languages: [python]
+    severity: ERROR
+    message: >-
+      Possible SQL injection: user-controlled input is directly formatted
+      into a SQL query. Use parameterized queries instead.
+    metadata:
+      cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)"
+    patterns:
+      - pattern-either:
+          - pattern: $CURSOR.execute(f"...{$INPUT}...")
+          - pattern: $CURSOR.execute("..." + $INPUT)
\ No newline at end of file
diff --git a/packages/cortexward-scanners/tests/unit/scanners/test_semgrep_scanner.py b/packages/cortexward-scanners/tests/unit/scanners/test_semgrep_scanner.py
index bd7b6d0..43de6af 100644
--- a/packages/cortexward-scanners/tests/unit/scanners/test_semgrep_scanner.py
+++ b/packages/cortexward-scanners/tests/unit/scanners/test_semgrep_scanner.py
@@ -268,12 +268,13 @@ def test_rules_dir_exists_and_contains_the_bundled_rule_files(self) -> None:
         rules_dir = _rules_dir()
         assert rules_dir.is_dir()
         names = {p.name for p in rules_dir.iterdir()}
-        assert names == {
-            "ssrf.yml",
-            "template_injection.yml",
-            "hardcoded_credentials.yml",
-            "jwt_signature_bypass.yml",
-        }
+       assert names == {
+    "ssrf.yml",
+    "template_injection.yml",
+    "hardcoded_credentials.yml",
+    "jwt_signature_bypass.yml",
+    "sql_injection.yml",
+}
 
     def test_rule_id_strips_the_directory_path_prefix(self) -> None:
         assert (