fix: resolve false negative in asyncpg-sqli rule by migrating to taint mode

[anannayamustcode]

Summary

Fixes #3027 - the asyncpg-sqli rule missed SQL injection when the tainted query was reassigned to another variable before reaching the sink.

Root Cause

The rule used AST pattern-inside matching, which requires the exact tainted variable name to appear in the sink call. When an intermediate assignment like sql_query_copy = sql_query was introduced, the rule lost track.

Fix

Migrated the rule to mode: taint, which enables Semgrep's built-in data-flow analysis to automatically track taint through variable assignments.

• Sources: String concatenation (+), +=, .format(), % formatting, f-strings
• Sinks: asyncpg methods (fetch, execute, cursor, etc.) on connection objects
• All false-positive exclusions preserved (literal-only concatenation, empty .format(), empty %)

Changes

• python/lang/security/audit/sqli/asyncpg-sqli.yaml - migrated to taint mode
• python/lang/security/audit/sqli/asyncpg-sqli.py - added bad12 test case from A false negative (miss) in asyncpg-sqli ruleset #3027

Testing

All existing tests pass (semgrep --test). The new bad12 case is now correctly detected.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

anannayamustcode seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}