stamp: semgrep eval → code-injection

.github/scripts/sigilix_sarif_contract.py

@@ -268,6 +268,7 @@ def _sanitize_run_results(run):
 _RULE_CLASS_PATTERNS = {
     "semgrep": [
         (re.compile(r"dangerous-exec|command[-_.]?inj|os[-_.]?command|dangerous-subprocess|spawn.*shell"), "command-injection"),
+        (re.compile(r"detect-eval|eval-with-expression|(?<![a-z])eval"), "code-injection"),
         (re.compile(r"nosql[-_.]?inj"), "nosql-injection"),
         (re.compile(r"(?<![a-z])sql[-_.]?inj"), "sql-injection"),
         (re.compile(r"path[-_.]?travers|directory[-_.]?travers|zip[-_.]?slip"), "path-traversal"),

.github/scripts/sigilix_sarif_test.py

@@ -977,6 +977,9 @@ def test_collision_safe_unset_when_two_classes_match(self):
         # A contrived ruleId hitting two patterns → exactly-one guard leaves it unset.
         self.assertIsNone(self._run("sql-injection-and-ssrf-combo"))
 
+    def test_stamps_eval_code_injection(self):
+        self.assertEqual(self._run("javascript.lang.security.detect-eval-with-expression"), "code-injection")
+
     def test_secret_scanners_map_to_hardcoded_secret(self):
         for tool in ("gitleaks", "trufflehog"):
             run = {"tool": {"driver": {}}, "results": [{"ruleId": "aws-access-token", "properties": {}}]}