[tvharini9]

Summary

Fixes a duplicate query ID in the Python SQL injection audit queries.

Both SqlInjectionAudit.ql and SqlInjectionHeuristic.ql previously used:

githubsecuritylab/audit/sql-injection

The heuristic query now uses the unique ID:

githubsecuritylab/audit/sql-injection-heuristic

Background

The duplicate IDs were introduced in commit 9edecfb (Rename query IDs), which assigned the same replacement ID to both queries.

Changes

• Updated the @id metadata in SqlInjectionHeuristic.ql.
• Left query logic, severity, precision and tags unchanged.

Validation

• Heuristic query compilation: passed.
• Existing CWE-089 SQL injection audit test: passed (1/1).
• Python query ID scan: no duplicate IDs found.
• git diff --check: passed.

Only one query metadata line was changed.

[tvharini9]

hi! This PR is ready for review. I've validated the heuristic query compilation and the existing CWE-089 audit test locally (1/1 passed).

I noticed the required CI checks are still waiting for status reports. Could a maintainer please check whether the workflow run needs approval and review the PR when convenient?

thank you

[felickz]

Thank you for your contribution!

[felickz]

👍

[Copilot]

🟢 Approval recommended

The duplicate CodeQL query ID has been replaced with a unique identifier, with the query logic and metadata otherwise preserved and no active review issues remaining.

No open issues 🎉

What changed in this PR

This pull request fixes a duplicate CodeQL query ID in the Python SQL injection audit queries by assigning the heuristic query a unique identifier.

Changes:

• Changed the heuristic query ID to githubsecuritylab/audit/sql-injection-heuristic.
• Preserved the query logic, severity, precision, and tags.
• Confirmed the Python audit queries no longer contain duplicate IDs.

File	Description
python/​src/​audit/​CWE-089/​SqlInjectionHeuristic.ql	Updates the heuristic query’s @id metadata to a unique value.

_{Review effort: Lite (auto)}