Add docs

README.md

@@ -934,7 +934,7 @@ For more, see [flake8-bandit](https://pypi.org/project/flake8-bandit/) on PyPI.
 | S506 | unsafe-yaml-load | Probable use of unsafe loader `{name}` with `yaml.load`. Allows instantiation of arbitrary objects. Consider `yaml.safe_load`. |  |
 | S508 | snmp-insecure-version | The use of SNMPv1 and SNMPv2 is insecure. Use SNMPv3 if able. |  |
 | S509 | snmp-weak-cryptography | You should not use SNMPv3 without encryption. `noAuthNoPriv` & `authNoPriv` is insecure. |  |
-| S608 | hardcoded-sql-expression | Possible SQL injection vector through string-based query construction: "{}" |  |
+| S608 | [hardcoded-sql-expression](https://github.com/charliermarsh/ruff/blob/main/docs/rules/hardcoded-sql-expression.md) | Possible SQL injection vector through string-based query construction: "{}" |  |
 | S612 | logging-config-insecure-listen | Use of insecure `logging.config.listen` detected |  |
 | S701 | jinja2-autoescape-false | Using jinja2 templates with `autoescape=False` is dangerous and can lead to XSS. Ensure `autoescape=True` or use the `select_autoescape` function. |  |
 

crates/ruff/src/rules/flake8_bandit/rules/hardcoded_sql_expression.rs

@@ -16,6 +16,19 @@ static SQL_REGEX: Lazy<Regex> = Lazy::new(|| {
 });
 
 define_violation!(
+    /// ### What it does
+    /// Checks for strings that resemble SQL statements involved in some form
+    /// string building operation.
+    ///
+    /// ### Why is this bad?
+    /// SQL injection is a common attack vector for web applications. Unless care
+    /// is taken to sanitize and control the input data when building such
+    /// SQL statement strings, an injection attack becomes possible.
+    ///
+    /// ### Example
+    /// ```python
+    /// query = "DELETE FROM foo WHERE id = '%s'" % identifier
+    /// ```
     pub struct HardcodedSQLExpression {
         pub string: String,
     }

docs/rules/hardcoded-sql-expression.md

@@ -0,0 +1,17 @@
+# hardcoded-sql-expression (S608)
+
+Derived from the **flake8-bandit** linter.
+
+### What it does
+Checks for strings that resemble SQL statements involved in some form
+string building operation.
+
+### Why is this bad?
+SQL injection is a common attack vector for web applications. Unless care
+is taken to sanitize and control the input data when building such
+SQL statement strings, an injection attack becomes possible.
+
+### Example
+```python
+query = "DELETE FROM foo WHERE id = '%s'" % identifier
+```