Java: Add SQLi sinks for Spring JDBC

Author: atorralba

java/ql/lib/change-notes/2023-05-12-spring-jdbc-sql-sinks.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added SQL injection sinks for Spring JDBC's `NamedParameterJdbcOperations`.

java/ql/lib/ext/org.springframework.jdbc.core.namedparam.model.yml

@@ -0,0 +1,15 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "batchUpdate", "", "", "Argument[0]", "sql", "manual"]
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "batchUpdate", "(String[])", "", "Argument[0]", "sql", "manual"]
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "execute", "", "", "Argument[0]", "sql", "manual"]
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "query", "", "", "Argument[0]", "sql", "manual"]
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "queryForList", "", "", "Argument[0]", "sql", "manual"]
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "queryForMap", "", "", "Argument[0]", "sql", "manual"]
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "queryForObject", "", "", "Argument[0]", "sql", "manual"]
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "queryForRowSet", "", "", "Argument[0]", "sql", "manual"]
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "queryForStream", "", "", "Argument[0]", "sql", "manual"]
+      - ["org.springframework.jdbc.core.namedparam", "NamedParameterJdbcOperations", True, "update", "", "", "Argument[0]", "sql", "manual"]

java/ql/test/query-tests/security/CWE-089/semmle/examples/SpringJdbc.java

@@ -1,7 +1,13 @@
 import java.sql.ResultSet;
 import java.util.Map;
 import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.namedparam.NamedParameterJdbcOperations;
+import org.springframework.jdbc.core.namedparam.SqlParameterSource;
+import org.springframework.jdbc.core.PreparedStatementCallback;
+import org.springframework.jdbc.core.ResultSetExtractor;
+import org.springframework.jdbc.core.RowCallbackHandler;
 import org.springframework.jdbc.core.RowMapper;
+import org.springframework.jdbc.core.SqlParameter;
 import org.springframework.jdbc.object.BatchSqlUpdate;
 import org.springframework.jdbc.object.MappingSqlQueryWithParameters;
 import org.springframework.jdbc.object.SqlFunction;
@@ -22,7 +28,7 @@ protected String updateRow(ResultSet rs, int rowNum, Map<?,?> context) {
     }
   }
 
-  public static void test(JdbcTemplate template) {
+  public static void test(JdbcTemplate template, NamedParameterJdbcOperations namedParamTemplate) {
     new BatchSqlUpdate(null, source()); // $ sqlInjection
     new SqlFunction(null, source()); // $ sqlInjection
     new SqlUpdate(null, source()); // $ sqlInjection
@@ -39,6 +45,37 @@ public static void test(JdbcTemplate template) {
     template.queryForObject(source(), (Class)null); // $ sqlInjection
     template.queryForRowSet(source()); // $ sqlInjection
     template.queryForStream(source(), (RowMapper)null); // $ sqlInjection
+
+    namedParamTemplate.batchUpdate(source(), (Map<String, ?>[]) null); // $ sqlInjection
+    namedParamTemplate.batchUpdate(source(), (SqlParameterSource[]) null); // $ sqlInjection
+    namedParamTemplate.execute(source(), (PreparedStatementCallback) null); // $ sqlInjection
+    namedParamTemplate.execute(source(), (Map<String, ?>) null, (PreparedStatementCallback) null); // $ sqlInjection
+    namedParamTemplate.execute(source(), (SqlParameterSource) null, (PreparedStatementCallback) null); // $ sqlInjection
+    namedParamTemplate.query(source(), (Map<String, ?>) null, (ResultSetExtractor) null); // $ sqlInjection
+    namedParamTemplate.query(source(), (Map<String, ?>) null, (RowMapper) null); // $ sqlInjection
+    namedParamTemplate.query(source(), (Map<String, ?>) null, (RowCallbackHandler) null); // $ sqlInjection
+    namedParamTemplate.query(source(), (SqlParameterSource) null, (ResultSetExtractor) null); // $ sqlInjection
+    namedParamTemplate.query(source(), (SqlParameterSource) null, (RowMapper) null); // $ sqlInjection
+    namedParamTemplate.query(source(), (SqlParameterSource) null, (RowCallbackHandler) null); // $ sqlInjection
+    namedParamTemplate.query(source(), (ResultSetExtractor) null); // $ sqlInjection
+    namedParamTemplate.query(source(), (RowMapper) null); // $ sqlInjection
+    namedParamTemplate.query(source(), (RowCallbackHandler) null); // $ sqlInjection
+    namedParamTemplate.queryForList(source(), (Map<String, ?>) null); // $ sqlInjection
+    namedParamTemplate.queryForList(source(), (Map<String, ?>) null, (Class) null); // $ sqlInjection
+    namedParamTemplate.queryForMap(source(), (Map<String, ?>) null); // $ sqlInjection
+    namedParamTemplate.queryForMap(source(), (SqlParameterSource) null); // $ sqlInjection
+    namedParamTemplate.queryForObject(source(), (Map<String, ?>) null, (Class) null); // $ sqlInjection
+    namedParamTemplate.queryForObject(source(), (Map<String, ?>) null, (RowMapper) null); // $ sqlInjection
+    namedParamTemplate.queryForObject(source(), (SqlParameterSource) null, (Class) null); // $ sqlInjection
+    namedParamTemplate.queryForObject(source(), (SqlParameterSource) null, (RowMapper) null); // $ sqlInjection
+    namedParamTemplate.queryForRowSet(source(), (Map<String, ?>) null); // $ sqlInjection
+    namedParamTemplate.queryForRowSet(source(), (SqlParameterSource) null); // $ sqlInjection
+    namedParamTemplate.queryForStream(source(), (Map<String, ?>) null, (RowMapper) null); // $ sqlInjection
+    namedParamTemplate.queryForStream(source(), (SqlParameterSource) null, (RowMapper) null); // $ sqlInjection
+    namedParamTemplate.update(source(), (Map<String, ?>) null); // $ sqlInjection
+    namedParamTemplate.update(source(), (SqlParameterSource) null); // $ sqlInjection
+    namedParamTemplate.update(source(), null, null); // $ sqlInjection
+    namedParamTemplate.update(source(), null, null, null); // $ sqlInjection
   }
 
 }