Skip to content

Commit 80124df

Browse files
aschackmullaschackmull
authored
Merge pull request github#5487 from joefarebrother/sql-sinks
Java: Convert SQL sinks to CSV format
2 parents 61ee193 + 1e82c60 commit 80124df

File tree

14 files changed

+428
-726
lines changed

14 files changed

+428
-726
lines changed

‎java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,12 @@ private module Frameworks {
9595
private import semmle.code.java.security.LdapInjection
9696
private import semmle.code.java.security.XPath
9797
private import semmle.code.java.security.JexlInjection
98+
private import semmle.code.java.frameworks.android.SQLite
99+
private import semmle.code.java.frameworks.Jdbc
100+
private import semmle.code.java.frameworks.SpringJdbc
101+
private import semmle.code.java.frameworks.MyBatis
102+
private import semmle.code.java.frameworks.Hibernate
103+
private import semmle.code.java.frameworks.jOOQ
98104
}
99105

100106
private predicate sourceModelCsv(string row) {

‎java/ql/src/semmle/code/java/frameworks/Hibernate.qll

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
*/
44

55
import java
6+
import semmle.code.java.dataflow.ExternalFlow
67

78
/** The interface `org.hibernate.query.QueryProducer`. */
89
class HibernateQueryProducer extends RefType {
@@ -21,19 +22,18 @@ class HibernateSession extends RefType {
2122
HibernateSession() { this.hasQualifiedName("org.hibernate", "Session") }
2223
}
2324

24-
/**
25-
* Holds if `m` is a method on `HibernateQueryProducer`, or `HibernateSharedSessionContract`
26-
* or `HibernateSession`, or a subclass, taking an SQL string as its first argument.
27-
*/
28-
predicate hibernateSqlMethod(Method m) {
29-
exists(RefType t |
30-
t = m.getDeclaringType().getASourceSupertype*() and
31-
(
32-
t instanceof HibernateQueryProducer or
33-
t instanceof HibernateSharedSessionContract or
34-
t instanceof HibernateSession
35-
)
36-
) and
37-
m.getParameterType(0) instanceof TypeString and
38-
m.hasName(["createQuery", "createNativeQuery", "createSQLQuery"])
25+
private class SqlSinkCsv extends SinkModelCsv {
26+
override predicate row(string row) {
27+
row =
28+
[
29+
//"package;type;overrides;name;signature;ext;spec;kind"
30+
"org.hibernate;QueryProducer;true;createQuery;;;Argument[0];sql",
31+
"org.hibernate;QueryProducer;true;createNativeQuery;;;Argument[0];sql",
32+
"org.hibernate;QueryProducer;true;createSQLQuery;;;Argument[0];sql",
33+
"org.hibernate;SharedSessionContract;true;createQuery;;;Argument[0];sql",
34+
"org.hibernate;SharedSessionContract;true;createSQLQuery;;;Argument[0];sql",
35+
"org.hibernate;Session;true;createQuery;;;Argument[0];sql",
36+
"org.hibernate;Session;true;createSQLQuery;;;Argument[0];sql"
37+
]
38+
}
3939
}

‎java/ql/src/semmle/code/java/frameworks/Jdbc.qll

Lines changed: 14 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
*/
44

55
import semmle.code.java.Type
6+
import semmle.code.java.dataflow.ExternalFlow
67

78
/*--- Types ---*/
89
/** The interface `java.sql.Connection`. */
@@ -26,62 +27,6 @@ class TypeStatement extends Interface {
2627
}
2728

2829
/*--- Methods ---*/
29-
/** A method with the name `prepareStatement` declared in `java.sql.Connection`. */
30-
class ConnectionPrepareStatement extends Method {
31-
ConnectionPrepareStatement() {
32-
getDeclaringType() instanceof TypeConnection and
33-
hasName("prepareStatement")
34-
}
35-
}
36-
37-
/** A method with the name `prepareCall` declared in `java.sql.Connection`. */
38-
class ConnectionPrepareCall extends Method {
39-
ConnectionPrepareCall() {
40-
getDeclaringType() instanceof TypeConnection and
41-
hasName("prepareCall")
42-
}
43-
}
44-
45-
/** A method with the name `executeQuery` declared in `java.sql.Statement`. */
46-
class StatementExecuteQuery extends Method {
47-
StatementExecuteQuery() {
48-
getDeclaringType() instanceof TypeStatement and
49-
hasName("executeQuery")
50-
}
51-
}
52-
53-
/** A method with the name `execute` declared in `java.sql.Statement`. */
54-
class MethodStatementExecute extends Method {
55-
MethodStatementExecute() {
56-
getDeclaringType() instanceof TypeStatement and
57-
hasName("execute")
58-
}
59-
}
60-
61-
/** A method with the name `executeUpdate` declared in `java.sql.Statement`. */
62-
class MethodStatementExecuteUpdate extends Method {
63-
MethodStatementExecuteUpdate() {
64-
getDeclaringType() instanceof TypeStatement and
65-
hasName("executeUpdate")
66-
}
67-
}
68-
69-
/** A method with the name `executeLargeUpdate` declared in `java.sql.Statement`. */
70-
class MethodStatementExecuteLargeUpdate extends Method {
71-
MethodStatementExecuteLargeUpdate() {
72-
getDeclaringType() instanceof TypeStatement and
73-
hasName("executeLargeUpdate")
74-
}
75-
}
76-
77-
/** A method with the name `addBatch` declared in `java.sql.Statement`. */
78-
class MethodStatementAddBatch extends Method {
79-
MethodStatementAddBatch() {
80-
getDeclaringType() instanceof TypeStatement and
81-
hasName("addBatch")
82-
}
83-
}
84-
8530
/** A method with the name `getString` declared in `java.sql.ResultSet`. */
8631
class ResultSetGetStringMethod extends Method {
8732
ResultSetGetStringMethod() {
@@ -92,24 +37,18 @@ class ResultSetGetStringMethod extends Method {
9237
}
9338

9439
/*--- Other definitions ---*/
95-
/**
96-
* An expression representing SQL code that occurs as an argument of
97-
* a method in `java.sql.Connection` or `java.sql.Statement`.
98-
*/
99-
class SqlExpr extends Expr {
100-
SqlExpr() {
101-
exists(MethodAccess call, Method method |
102-
call.getArgument(0) = this and
103-
method = call.getMethod() and
104-
(
105-
method instanceof ConnectionPrepareStatement or
106-
method instanceof ConnectionPrepareCall or
107-
method instanceof StatementExecuteQuery or
108-
method instanceof MethodStatementExecute or
109-
method instanceof MethodStatementExecuteUpdate or
110-
method instanceof MethodStatementExecuteLargeUpdate or
111-
method instanceof MethodStatementAddBatch
112-
)
113-
)
40+
private class SqlSinkCsv extends SinkModelCsv {
41+
override predicate row(string row) {
42+
row =
43+
[
44+
//"package;type;overrides;name;signature;ext;spec;kind"
45+
"java.sql;Connection;true;prepareStatement;;;Argument[0];sql",
46+
"java.sql;Connection;true;prepareCall;;;Argument[0];sql",
47+
"java.sql;Statement;true;execute;;;Argument[0];sql",
48+
"java.sql;Statement;true;executeQuery;;;Argument[0];sql",
49+
"java.sql;Statement;true;executeUpdate;;;Argument[0];sql",
50+
"java.sql;Statement;true;executeLargeUpdate;;;Argument[0];sql",
51+
"java.sql;Statement;true;addBatch;;;Argument[0];sql"
52+
]
11453
}
11554
}

‎java/ql/src/semmle/code/java/frameworks/MyBatis.qll

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,24 @@
33
*/
44

55
import java
6+
import semmle.code.java.dataflow.ExternalFlow
67

78
/** The class `org.apache.ibatis.jdbc.SqlRunner`. */
89
class MyBatisSqlRunner extends RefType {
910
MyBatisSqlRunner() { this.hasQualifiedName("org.apache.ibatis.jdbc", "SqlRunner") }
1011
}
1112

12-
/**
13-
* Holds if `m` is a method on `MyBatisSqlRunner` taking an SQL string as its
14-
* first argument.
15-
*/
16-
predicate mybatisSqlMethod(Method m) {
17-
m.getDeclaringType() instanceof MyBatisSqlRunner and
18-
m.getParameterType(0) instanceof TypeString and
19-
(
20-
m.hasName("delete") or
21-
m.hasName("insert") or
22-
m.hasName("run") or
23-
m.hasName("selectAll") or
24-
m.hasName("selectOne") or
25-
m.hasName("update")
26-
)
13+
private class SqlSinkCsv extends SinkModelCsv {
14+
override predicate row(string row) {
15+
row =
16+
[
17+
//"package;type;overrides;name;signature;ext;spec;kind"
18+
"org.apache.ibatis.jdbc;SqlRunner;false;delete;(String,Object[]);;Argument[0];sql",
19+
"org.apache.ibatis.jdbc;SqlRunner;false;insert;(String,Object[]);;Argument[0];sql",
20+
"org.apache.ibatis.jdbc;SqlRunner;false;run;(String);;Argument[0];sql",
21+
"org.apache.ibatis.jdbc;SqlRunner;false;selectAll;(String,Object[]);;Argument[0];sql",
22+
"org.apache.ibatis.jdbc;SqlRunner;false;selectOne;(String,Object[]);;Argument[0];sql",
23+
"org.apache.ibatis.jdbc;SqlRunner;false;update;(String,Object[]);;Argument[0];sql"
24+
]
25+
}
2726
}

‎java/ql/src/semmle/code/java/frameworks/SpringJdbc.qll

Lines changed: 17 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,28 @@
33
*/
44

55
import java
6+
import semmle.code.java.dataflow.ExternalFlow
67

78
/** The class `org.springframework.jdbc.core.JdbcTemplate`. */
89
class JdbcTemplate extends RefType {
910
JdbcTemplate() { this.hasQualifiedName("org.springframework.jdbc.core", "JdbcTemplate") }
1011
}
1112

12-
/**
13-
* Holds if `m` is a method on `JdbcTemplate` taking an SQL string as its first
14-
* argument.
15-
*/
16-
predicate jdbcSqlMethod(Method m) {
17-
m.getDeclaringType() instanceof JdbcTemplate and
18-
m.getParameterType(0) instanceof TypeString and
19-
(
20-
m.hasName("batchUpdate") or
21-
m.hasName("execute") or
22-
m.getName().matches("query%") or
23-
m.hasName("update")
24-
)
25-
}
26-
27-
/** The method `JdbcTemplate.batchUpdate(String... sql)` */
28-
class BatchUpdateVarargsMethod extends Method {
29-
BatchUpdateVarargsMethod() {
30-
this.getDeclaringType() instanceof JdbcTemplate and
31-
this.hasName("batchUpdate") and
32-
this.getParameterType(0).(Array).getComponentType() instanceof TypeString and
33-
this.getParameter(0).isVarargs()
13+
private class SqlSinkCsv extends SinkModelCsv {
14+
override predicate row(string row) {
15+
row =
16+
[
17+
//"package;type;overrides;name;signature;ext;spec;kind"
18+
"org.springframework.jdbc.core;JdbcTemplate;false;batchUpdate;(String[]);;Argument[0];sql",
19+
"org.springframework.jdbc.core;JdbcTemplate;false;batchUpdate;;;Argument[0];sql",
20+
"org.springframework.jdbc.core;JdbcTemplate;false;execute;;;Argument[0];sql",
21+
"org.springframework.jdbc.core;JdbcTemplate;false;update;;;Argument[0];sql",
22+
"org.springframework.jdbc.core;JdbcTemplate;false;query;;;Argument[0];sql",
23+
"org.springframework.jdbc.core;JdbcTemplate;false;queryForList;;;Argument[0];sql",
24+
"org.springframework.jdbc.core;JdbcTemplate;false;queryForMap;;;Argument[0];sql",
25+
"org.springframework.jdbc.core;JdbcTemplate;false;queryForObject;;;Argument[0];sql",
26+
"org.springframework.jdbc.core;JdbcTemplate;false;queryForRowSet;;;Argument[0];sql",
27+
"org.springframework.jdbc.core;JdbcTemplate;false;queryForStream;;;Argument[0];sql"
28+
]
3429
}
3530
}

0 commit comments

Comments
 (0)