From c9d441590387312331dd462f0fe8c8808578c662 Mon Sep 17 00:00:00 2001
From: Daniel A Martinez Julio <dan.martinezjulio@gmail.com>
Date: Fri, 19 Jun 2026 09:38:27 -0700
Subject: [PATCH] stamp: map semgrep eval (detect-eval) to code-injection class

---
 .github/scripts/sigilix_sarif_contract.py | 1 +
 .github/scripts/sigilix_sarif_test.py     | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/.github/scripts/sigilix_sarif_contract.py b/.github/scripts/sigilix_sarif_contract.py
index 0ab7dfb..83205c7 100644
--- a/.github/scripts/sigilix_sarif_contract.py
+++ b/.github/scripts/sigilix_sarif_contract.py
@@ -268,6 +268,7 @@ def _sanitize_run_results(run):
 _RULE_CLASS_PATTERNS = {
     "semgrep": [
         (re.compile(r"dangerous-exec|command[-_.]?inj|os[-_.]?command|dangerous-subprocess|spawn.*shell"), "command-injection"),
+        (re.compile(r"detect-eval|eval-with-expression|(?<![a-z])eval"), "code-injection"),
         (re.compile(r"nosql[-_.]?inj"), "nosql-injection"),
         (re.compile(r"(?<![a-z])sql[-_.]?inj"), "sql-injection"),
         (re.compile(r"path[-_.]?travers|directory[-_.]?travers|zip[-_.]?slip"), "path-traversal"),
diff --git a/.github/scripts/sigilix_sarif_test.py b/.github/scripts/sigilix_sarif_test.py
index b7dbdb9..752da8e 100644
--- a/.github/scripts/sigilix_sarif_test.py
+++ b/.github/scripts/sigilix_sarif_test.py
@@ -977,6 +977,9 @@ def test_collision_safe_unset_when_two_classes_match(self):
         # A contrived ruleId hitting two patterns → exactly-one guard leaves it unset.
         self.assertIsNone(self._run("sql-injection-and-ssrf-combo"))
 
+    def test_stamps_eval_code_injection(self):
+        self.assertEqual(self._run("javascript.lang.security.detect-eval-with-expression"), "code-injection")
+
     def test_secret_scanners_map_to_hardcoded_secret(self):
         for tool in ("gitleaks", "trufflehog"):
             run = {"tool": {"driver": {}}, "results": [{"ruleId": "aws-access-token", "properties": {}}]}