Write a custom Semgrep rule to track a real taint path

Generic rule packs miss framework-specific sources and sinks. Write a small taint rule that models the app’s own request wrapper flowing into its own query helper.

rules:
- id: app-sqli
  mode: taint
  pattern-sources: [ { pattern: "ctx.input(...)" } ]
  pattern-sinks:   [ { pattern: "db.raw($Q)" } ]
  message: user input reaches raw SQL
  severity: ERROR
  languages: [python]

Run it across the tree and triage the hits.

semgrep --config app-sqli.yml --sarif -o sqli.sarif .

Pro note: add pattern-sanitizers for the app’s real escaping function so the rule only flags unsanitized paths. This turns a vague hunt into a precise, repeatable check you can hand to the dev team and wire into CI.