Rule sql_injection_fstring
    → regex mode: searches for ".execute(f""
    → Match? → Finding (confidence 80, fixed)
    → No match? → Nothing

                    ┌─────────────────┐
                    │  Source file     │
                    └────────┬────────┘
                             │
              ┌──────────────┼──────────────┐
              │              │              │
              ▼              ▼              ▼
     ┌────────────┐  ┌────────────┐  ┌────────────┐
     │  Layer 1    │  │  Layer 2    │  │  Layer 3    │
     │  Pattern    │  │  Taint      │  │  Context    │
     │  matching   │  │  analysis   │  │  analysis   │
     └──────┬─────┘  └──────┬─────┘  └──────┬─────┘
            │               │               │
            ▼               ▼               ▼
     ┌─────────────────────────────────────────┐
     │           Evidence merger                │
     │                                         │
     │  Cross-references results from 3 layers.│
     │  Computes the actual confidence.        │
     │  Builds the chain of evidence.          │
     └────────────────┬────────────────────────┘
                      │
                      ▼
              ┌───────────────┐
              │   Finding     │
              │  + evidence   │
              │  + confidence │
              └───────────────┘

{
  "layer": "pattern",
  "rule_key": "sql_injection_fstring",
  "file": "src/db.py",
  "line": 42,
  "code": "cursor.execute(f\"SELECT * FROM users WHERE id = {user_id}\")",
  "evidence": "Pattern '.execute(f\"' matched at line 42"
}

{
  "layer": "taint",
  "rule_key": "taint_sqli",
  "file": "src/db.py",
  "flow": {
    "source": {
      "line": 12,
      "code": "user_id = request.args.get('id')",
      "kind": "http"
    },
    "propagation": [
      {"line": 15, "code": "user_id = int(user_id) if safe else user_id"},
      {"line": 38, "code": "query = f\"SELECT * FROM users WHERE id = {user_id}\""}
    ],
    "sink": {
      "line": 42,
      "code": "cursor.execute(query)",
      "type": "sql_execute"
    },
    "sanitizers_found": false
  },
  "evidence": "HTTP data (request.args) propagated without sanitization to cursor.execute()"
}

{
  "layer": "context",
  "file": "src/db.py",
  "signals": {
    "is_test_file": false,
    "has_orm": false,
    "has_raw_sql": true,
    "has_http_handler": true,
    "has_input_validation": false,
    "has_sanitizer": false,
    "framework": "flask"
  },
  "evidence": "Flask file with raw SQL, no ORM, no input validation"
}

def analyze_context(filepath, content):
    signals = {}

    # Test/mock/fixture detection
    signals["is_test_file"] = any(x in filepath.lower()
        for x in ["test_", "_test.", "mock", "fixture", "spec."])

    # ORM present?
    signals["has_orm"] = bool(re.search(
        r"(?:from sqlalchemy|from django\.db|from tortoise|"
        r"from peewee|from prisma|\.objects\.|\.filter\(|\.query\.)",
        content))

    # Raw SQL?
    signals["has_raw_sql"] = bool(re.search(
        r"(?:SELECT|INSERT|UPDATE|DELETE)\s+", content))

    # HTTP handler?
    signals["has_http_handler"] = bool(re.search(
        r"(?:@app\.route|@router\.|def\s+\w+\(request|"
        r"async\s+def\s+\w+\(request)", content))

    # Input validation?
    signals["has_input_validation"] = bool(re.search(
        r"(?:pydantic|marshmallow|cerberus|voluptuous|"
        r"wtforms|django\.forms|Schema\(|validate\()", content))

    # Sanitizer present?
    signals["has_sanitizer"] = bool(re.search(
        r"(?:bleach|escape|sanitize|parameterize|"
        r"quote\(|html\.escape|markupsafe)", content))

    return signals

Confidence = base + taint_bonus + context_bonus - penalties

Concrete cases:

  Pattern alone, no context:
    65% (weak signal, may be a false positive)

  Pattern + confirming context (raw SQL, no ORM, HTTP handler):
    65% + 15% = 80%

  Pattern + taint flow (source → sink confirmed):
    65% + 25% = 90%

  Pattern + taint + context (triple confirmation):
    65% + 25% + 10% = 95% (near certainty)

  Pattern + REFUTING context (ORM present, test file):
    65% - 30% = 35% (likely false positive → removed from report)

1. If the context layer detects a test file → REMOVE the finding
    (test files intentionally contain vulnerable code)

2. If the taint layer confirms the flow → INCREASE the confidence
    and ADD the chain of evidence to the finding

3. If the context layer refutes (ORM present, sanitizer found) →
    DECREASE the confidence. If < 40% → REMOVE the finding

4. If two different rules detect the same vulnerability at the same place →
    MERGE into a single finding with the highest confidence

5. If the taint flow crosses several files → ADD the "cross-file"
    label and INCREASE the confidence by 5%

[HIGH] SQL Injection (f-string) — src/db.py:42
  Risk: An attacker can inject malicious SQL...
  Solution: Use parameterized queries.

[HIGH] SQL Injection (f-string) — src/db.py:42
  Confidence: 95% (pattern + taint + context)

  Evidence:

  1. Source (line 12):
     user_id = request.args.get('id')
     → Untrusted HTTP data (kind: http)

  2. Propagation (line 38):
     query = f"SELECT * FROM users WHERE id = {user_id}"
     → Variable injected into a SQL query via f-string

  3. Sink (line 42):
     cursor.execute(query)
     → Query execution without parameterization

  4. Context:
     - Flask file with HTTP handler (@app.route)
     - Raw SQL (no ORM)
     - No input validation detected
     - No sanitizer detected

  Solution: Use parameterized queries.
  Playbook: 3 steps (diagnosis → fix → verification)
  References: CWE-89, OWASP A03:2021, ISO A.8.28