NoStringConcatInQueries [check] v0.1.0

Label

Static analysis detects no string-built SQL

Assertion

A SAST tool, lint rule, or grep step in CI flags any path where a runtime value is concatenated, interpolated, or formatted into a SQL string. Findings are addressed (or whitelisted with a comment explaining the allow-listed-identifier case) before merge.

Evidence

• CodeQL / Semgrep rule for SQL injection enabled in CI; build fails on new findings.
• Lint rule for the project's ORM (e.g. eslint-plugin-security/detect-non-literal-regexp analogue, bandit B608, Checkstyle SQL rules) is on by default.
• Allowlist comments include a ticket reference and an allow-list-of-identifiers justification, not 'TODO fix later'.

Failure Mode

An injection slips through code review because the concatenation is hidden inside buildWhereClause(filter) two files away from the controller.

NoStringConcatInQueries [check] v0.1.0

Label

Static analysis detects no string-built SQL

Assertion

A SAST tool, lint rule, or grep step in CI flags any path where a runtime value is concatenated, interpolated, or formatted into a SQL string. Findings are addressed (or whitelisted with a comment explaining the allow-listed-identifier case) before merge.

Evidence

• CodeQL / Semgrep rule for SQL injection enabled in CI; build fails on new findings.
• Lint rule for the project's ORM (e.g. eslint-plugin-security/detect-non-literal-regexp analogue, bandit B608, Checkstyle SQL rules) is on by default.
• Allowlist comments include a ticket reference and an allow-list-of-identifiers justification, not 'TODO fix later'.

Failure Mode

An injection slips through code review because the concatenation is hidden inside buildWhereClause(filter) two files away from the controller.

Rationale

Reviewers miss SQL injection during code review — especially when the unsafe concatenation is wrapped in a helper or a multi-line query. Mechanical detection at PR time is the first reliable line of defence.

Label

Static analysis detects no string-built SQL

Assertion

A SAST tool, lint rule, or grep step in CI flags any path where a runtime value is concatenated, interpolated, or formatted into a SQL string. Findings are addressed (or whitelisted with a comment explaining the allow-listed-identifier case) before merge.

Evidence

• CodeQL / Semgrep rule for SQL injection enabled in CI; build fails on new findings.
• Lint rule for the project's ORM (e.g. eslint-plugin-security/detect-non-literal-regexp analogue, bandit B608, Checkstyle SQL rules) is on by default.
• Allowlist comments include a ticket reference and an allow-list-of-identifiers justification, not 'TODO fix later'.

Failure Mode

An injection slips through code review because the concatenation is hidden inside buildWhereClause(filter) two files away from the controller.