some SQL injections not detected

Describe the bug

None of the lines get reported, although each of the foo functions contains an SQL injection

from django.db import transaction, connections, connection


def foo(booking_id: str):
    with transaction.atomic():
        connections['default'].cursor().execute(f'SELECT pg_advisory_xact_lock({booking_id})')


def foo2(booking_id: str):
    with transaction.atomic():
        connection.cursor().execute(f'SELECT pg_advisory_xact_lock({booking_id})')


def foo3(booking_id: str):
    with connection.cursor() as cursor:
        cursor.execute(f'SELECT pg_advisory_xact_lock({booking_id})')


def foo4(booking_id: str):
    with connection.cursor() as cursor:
        cursor.execute(f'SELECT pg_advisory_xact_lock({booking_id}) FROM table')


def foo5(col: str):
    with connection.cursor() as cursor:
        cursor.execute(f'select {col} from table')


def foo6(col: str):
    q = f'select {col} from table'


def foo7(col, booking_id):
    q = f'select {col} from table where id = {booking_id}'

Bandit output:

bandit -r ./injection.py
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.9.14
Run started:2022-12-16 08:57:06.964396

Test results:
	No issues identified.

Code scanned:
	Total lines of code: 20
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0
	Total issues (by confidence):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0
Files skipped (0):

Bandit version: bandit==1.7.4

Reproduction steps

1. bandit -r ./injection.py

Expected behavior

Expected to detect SQL injection in each of the foo* functions

Bandit version

1.7.4 (Default)

Python version

3.9

Additional context

No response

Start with injection.py and Bandit’s SQL-injection scan, reproducing the no-issues output for the cursor.execute f-strings and assigned queries. Trace the relevant checker entry point and add regression coverage so the foo* examples are reported as SQL injections while the existing scan remains passing.