# Semgrep Configuration for NoDupeLabs
#
# EXCLUSION RATIONALE:
# The SQL queries in nodupe/tools/databases/*.py files use the _validate_identifier()
# function to sanitize all table and column names before constructing SQL queries.
# This function validates that identifiers match the pattern ^[a-zA-Z_][a-zA-Z0-9_]*$,
# which effectively prevents SQL injection attacks by only allowing alphanumeric
# characters and underscores, with the requirement that identifiers start with a letter.
#
# Semgrep's sqlalchemy-execute-raw-query and formatted-sql-query rules flag these
# as potential vulnerabilities because they cannot track data flow through custom
# validation functions. These are false positives because the _validate_identifier()
# function provides equivalent or stronger protection than parameterized queries
# for identifier sanitization.
#
# Reference: nodupe/tools/databases/security.py and nodupe/tools/databases/wrapper.py
#
# USAGE:
# Run semgrep with: semgrep --config .semgrep.yml --config auto <path>
# This configuration will suppress the specified false positive findings.
#
# Note: The .semgrepignore file also excludes these files from scanning entirely.
# This config provides rule-specific exclusions as an alternative approach.

rules:
  # Suppress sqlalchemy-execute-raw-query for database files that use _validate_identifier()
  - id: sqlalchemy-execute-raw-query
    message: |
      SQL query execution detected. This is a false positive for files using
      _validate_identifier() which sanitizes all SQL identifiers.
    languages:
      - python
    severity: INFO
    patterns:
      - pattern: |
          $EXEC($QUERY, ...)
      - metavariable-pattern:
          metavariable: $EXEC
          pattern: |
            execute
      - metavariable-pattern:
          metavariable: $QUERY
          pattern: |
            f"..."
    paths:
      exclude:
        - '**/nodupe/tools/databases/*'

  # Suppress formatted-sql-query for database files that use _validate_identifier()
  - id: formatted-sql-query
    message: |
      Formatted SQL query detected. This is a false positive for files using
      _validate_identifier() which sanitizes all SQL identifiers.
    languages:
      - python
    severity: INFO
    patterns:
      - pattern: |
          f"..."
      - metavariable-regex:
          metavariable: $STRING
          regex: ".*(?i)(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC).*"
    paths:
      exclude:
        - '**/nodupe/tools/databases/*'