The sqlite3 module wraps the SQLite C library. cursor.execute() and executemany() accept raw SQL strings and are injection sinks when the SQL is built from user input. Use the ? placeholder form for safe parameter binding.
.execute().executemany().executescript().execute()SinkCursor.execute(sql: str, parameters: Sequence = ()) -> Cursor
Executes SQL. Sink for injection when sql is built from user input without placeholders.
0.executemany()SinkCursor.executemany(sql: str, parameters: Iterable) -> Cursor
Executes SQL repeatedly. Same injection risk as execute().
0.executescript()SinkCursor.executescript(sql_script: str) -> Cursor
Runs a multi-statement SQL script. No parameter binding available — always injection-sensitive.
0.connect()Neutralsqlite3.connect(database: str, ...) -> Connection
Opens a database connection. Neutral; the Cursor is where injection happens.
| FQN | Field | |
|---|---|---|
| sqlite3 | fqns[0] | |
| sqlite3.Cursor | fqns[1] | |
| sqlite3.Connection | fqns[2] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PySqlite3