mirror of
https://github.com/astral-sh/ruff.git
synced 2025-10-03 07:04:53 +00:00
![]() This is an attempt to implement `bandit` rule `B608` (renamed here `S608`).
- https://bandit.readthedocs.io/en/latest/plugins/b608_hardcoded_sql_expressions.html
The rule inspects strings constructed via `+`, `%`, `.format`, and `f""`.
- `+` and `%` via `BinOp`
- `.format` via `Call`
- `f""` via `JoinedString`
Any SQL-ish strings that use Python string formatting are flagged.
The expressions and targeted expression types for the rule come from here:
-
|
||
---|---|---|
.. | ||
flake8_to_ruff | ||
ruff | ||
ruff_cli | ||
ruff_dev | ||
ruff_macros | ||
ruff_python |