fix: keep concrete sql security findings

Author: 777genius

__tests__/unit/analysis/finding-filter.test.ts

@@ -828,6 +828,37 @@ describe('FindingFilter', () => {
       expect(filtered[0].line).toBe(1);
     });
 
+    test('keeps SQL interpolation regressions even when phrased cautiously', () => {
+      const diff = `diff --git a/src/users.js b/src/users.js
+@@ -7,7 +7,7 @@ export function normalizeEmail(email) {
+ }
+
+ export async function findUserByEmail(db, email) {
+-  const rows = await db.query('SELECT * FROM users WHERE email = ? LIMIT 1', [email]);
++  const rows = await db.query(\`SELECT * FROM users WHERE email = '\${email}' LIMIT 1\`);
+   return rows[0] || null;
+ }`;
+
+      const findings: Finding[] = [
+        {
+          file: 'src/users.js',
+          line: 10,
+          severity: 'major',
+          title: 'Email is interpolated into SQL',
+          message:
+            'The user-controlled email is directly interpolated into the SQL query, so a crafted value can alter the WHERE clause. Keep using a parameterized query.',
+          suggestion: "const rows = await db.query('SELECT * FROM users WHERE email = ? LIMIT 1', [email]);",
+        },
+      ];
+
+      const { findings: filtered, stats } = filter.filter(findings, diff);
+
+      expect(filtered).toHaveLength(1);
+      expect(filtered[0].title).toBe('Email is interpolated into SQL');
+      expect(stats.kept).toBe(1);
+      expect(stats.filtered).toBe(0);
+    });
+
     test('filters generic findings with line:1 that mention "entire file" or "class lacks"', () => {
       const findings: Finding[] = [
         {

dist/index.js

@@ -23033,7 +23033,10 @@ var FindingFilter = class {
   }
   isTrueSecurityIssue(finding) {
     const text = (finding.title + " " + finding.message).toLowerCase();
-    return text.includes("sql injection") || text.includes("xss") || text.includes("cross-site scripting") || text.includes("command injection") || text.includes("path traversal") || text.includes("remote code execution") || text.includes("arbitrary code") || text.includes("prototype pollution") || text.includes("wrong throttle") || text.includes("wrong throttling") || text.includes("rate limit bypass") || text.includes("password reset") && (text.includes("rate limit") || text.includes("throttl") || text.includes("lockout")) || (text.includes("authorization") || text.includes("permission") || text.includes("privilege") || text.includes("access control")) && (text.includes("bypass") || text.includes("unauthorized") || text.includes("allows"));
+    const mentionsSqlSink = /\b(sql|query|database)\b/.test(text) || text.includes("db.query");
+    const mentionsUntrustedInput = /\b(user input|untrusted|attacker|crafted|request|email|parameter|input)\b/.test(text);
+    const mentionsUnsafeSqlConstruction = text.includes("interpolat") || text.includes("concatenat") || text.includes("template literal") || text.includes("raw sql") || text.includes("unescaped") || text.includes("unsanitized") || text.includes("directly") || text.includes("not parameterized") || text.includes("parameterized query") || text.includes("${");
+    return text.includes("sql injection") || mentionsSqlSink && text.includes("injection") || mentionsSqlSink && mentionsUntrustedInput && mentionsUnsafeSqlConstruction || text.includes("xss") || text.includes("cross-site scripting") || text.includes("command injection") || text.includes("path traversal") || text.includes("remote code execution") || text.includes("arbitrary code") || text.includes("prototype pollution") || text.includes("wrong throttle") || text.includes("wrong throttling") || text.includes("rate limit bypass") || text.includes("password reset") && (text.includes("rate limit") || text.includes("throttl") || text.includes("lockout")) || (text.includes("authorization") || text.includes("permission") || text.includes("privilege") || text.includes("access control")) && (text.includes("bypass") || text.includes("unauthorized") || text.includes("allows"));
   }
   isTestCodeQualityIssue(finding) {
     const text = (finding.title + " " + finding.message).toLowerCase();

dist/index.js.map

@@ -326,8 +326,25 @@ export class FindingFilter {
 
   private isTrueSecurityIssue(finding: Finding): boolean {
     const text = (finding.title + ' ' + finding.message).toLowerCase();
+    const mentionsSqlSink = /\b(sql|query|database)\b/.test(text) || text.includes('db.query');
+    const mentionsUntrustedInput =
+      /\b(user input|untrusted|attacker|crafted|request|email|parameter|input)\b/.test(text);
+    const mentionsUnsafeSqlConstruction =
+      text.includes('interpolat') ||
+      text.includes('concatenat') ||
+      text.includes('template literal') ||
+      text.includes('raw sql') ||
+      text.includes('unescaped') ||
+      text.includes('unsanitized') ||
+      text.includes('directly') ||
+      text.includes('not parameterized') ||
+      text.includes('parameterized query') ||
+      text.includes('${');
+
     return (
       text.includes('sql injection') ||
+      (mentionsSqlSink && text.includes('injection')) ||
+      (mentionsSqlSink && mentionsUntrustedInput && mentionsUnsafeSqlConstruction) ||
       text.includes('xss') ||
       text.includes('cross-site scripting') ||
       text.includes('command injection') ||