{
"id": "py-sql-string-build",
"language": "python",
"group": "security",
"listingTitle": "Py sql string build",
"title": "Review sql string build",
"mvvm": false,
"defaultSeverity": "info",
"legacyGroup": "security",
"why": "Dynamically constructed SQL can mix untrusted values into executable query text.",
"suggestion": "Bind data values as parameters; use an explicit noqa S608 review when trusted identifiers must be interpolated.",
"version": 4,
"semanticMaturity": "text",
"securityKind": "hotspot",
"taxonomy": [
"security"
],
"requirements": [
"sourceText"
],
"packs": [
"python",
"fastapi"
],
"implementation": "src/languages/python/rules.rs",
"languages": [
"python"
],
"frameworks": [],
"languageVersions": [],
"limitations": [
"Only string literals that begin with a SQL statement are considered; natural-language messages are ignored, including prompts that begin with `Select from` but have no projection.",
"An S608 noqa directive suppresses the complete continued SQL expression containing it."
]
}