fix: use parameterized SQL queries in report_digest.py

Replace f-string interpolation with parameterized queries using ? placeholders
to prevent potential SQL injection from malformed report JSONL data.

Addresses CWE-89.

Author: gn00295120

garak/analyze/report_digest.py

@@ -129,7 +129,8 @@ def _init_populate_result_db(evals, taxonomy=None):
         # add a row for each group
         for group in groups:
             cursor.execute(
-                f"insert into results values ('{pm}', '{group}', '{pc}', '{detector}', '{score}', '{instances}', '{passes}')"
+                "insert into results values (?, ?, ?, ?, ?, ?, ?)",
+                (pm, group, pc, detector, score, instances, passes),
             )
 
     return conn, cursor
@@ -156,7 +157,8 @@ def _get_group_aggregate_score(
     unknown_function = False
     group_score = None  # range 0.0--1.0
     res = cursor.execute(
-        f"select score as s from results where probe_group = '{probe_group}';"
+        "select score as s from results where probe_group = ?;",
+        (probe_group,),
     )
     probe_scores = [i[0] for i in res.fetchall()]
 
@@ -232,7 +234,8 @@ def _get_group_info(probe_group, group_score, taxonomy, config=_config) -> dict:
 
 def _get_probe_result_summaries(cursor, probe_group) -> List[tuple]:
     res = cursor.execute(
-        f"select probe_module, probe_class, min(score) as s from results where probe_group='{probe_group}' group by probe_class order by s asc, probe_class asc;"
+        "select probe_module, probe_class, min(score) as s from results where probe_group=? group by probe_class order by s asc, probe_class asc;",
+        (probe_group,),
     )
     return res.fetchall()
 
@@ -257,7 +260,8 @@ def _get_probe_info(probe_module, probe_class, absolute_score) -> dict:
 
 def _get_detectors_info(cursor, probe_group, probe_class) -> List[tuple]:
     res = cursor.execute(
-        f"select detector, score from results where probe_group='{probe_group}' and probe_class='{probe_class}' order by score asc, detector asc;"
+        "select detector, score from results where probe_group=? and probe_class=? order by score asc, detector asc;",
+        (probe_group, probe_class),
     )
     return res.fetchall()