Add Semgrep rule for CWE-89 SQL injection

packages/cortexward-scanners/src/cortexward/scanners/semgrep_rules/sql_injection.yml

@@ -0,0 +1,13 @@
+rules:
+  - id: cortexward-sql-injection-format-string
+    languages: [python]
+    severity: ERROR
+    message: >-
+      Possible SQL injection: user-controlled input is directly formatted
+      into a SQL query. Use parameterized queries instead.
+    metadata:
+      cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)"
+    patterns:
+      - pattern-either:
+          - pattern: $CURSOR.execute(f"...{$INPUT}...")
+          - pattern: $CURSOR.execute("..." + $INPUT)

packages/cortexward-scanners/tests/unit/scanners/test_semgrep_scanner.py

@@ -268,12 +268,13 @@
         rules_dir = _rules_dir()
         assert rules_dir.is_dir()
         names = {p.name for p in rules_dir.iterdir()}
-        assert names == {
-            "ssrf.yml",
-            "template_injection.yml",
-            "hardcoded_credentials.yml",
-            "jwt_signature_bypass.yml",
-        }
+       assert names == {
+    "ssrf.yml",
+    "template_injection.yml",
+    "hardcoded_credentials.yml",
+    "jwt_signature_bypass.yml",
+    "sql_injection.yml",
+}
 
     def test_rule_id_strips_the_directory_path_prefix(self) -> None:
         assert (
@@ -297,3 +298,3 @@
     def test_cwe_from_metadata_returns_none_for_a_malformed_cwe_field(self) -> None:
         assert _cwe_from_metadata({"cwe": "not-a-cwe-string"}) is None
         assert _cwe_from_metadata({"cwe": 798}) is None