Java - Adding support for com.microsoft.sqlserver.jdbc.SQLServerDataSource to CWE-798

[felickz]

Adds a missing sinks for the java/hardcoded-credential-api-call query for the SQLServerDataSource class

• Group: com.microsoft.sqlserver
• Artifact: mssql-jdbc

Maps ApiCallableCredentialParam's for User and Password

• setUser
• setPassword
• getConnection

Local testing - All 4 tests passed (none expected)

>codeql test run "java/ql/test/query-tests/security/CWE-798/semmle/tests/"
Executing 4 tests in 1 directories.
Extracting test database in /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests.
Compiling queries in /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests.
Compiled /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedPasswordField.ql (512ms).
Compiled /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCredentialsSourceCall.ql (17.2s).
Compiled /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCredentialsComparison.ql (3.9s).
Compiled /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCredentialsApiCall.ql (286ms).
Executing tests in /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests.
[1/4 comp 512ms eval 854ms] PASSED /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedPasswordField.ql
[2/4 comp 17.2s eval 3.3s] PASSED /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCredentialsSourceCall.ql
[3/4 comp 3.9s eval 31ms] PASSED /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCredentialsComparison.ql
[4/4 comp 286ms eval 482ms] PASSED /Users/felickz/Repos/vscode-codeql-starter/ql/java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCredentialsApiCall.ql
All 4 tests passed.

Tasks

• Update SensitiveApi.qll to add additional sinks
• Generate stubs via python3 ./java/ql/src/utils/stub-generator/makeStubs.py "java/ql/test/query-tests/security/CWE-798/semmle/tests/" "java/ql/test/stubs" "...pom.xml" and organize under java/ql/test/stubs/mssql-jdbc-12.2.0
• add mssql-jdbc-12.2.0 test stubs to dir java/ql/test/query-tests/security/CWE-798/semmle/tests/options
• Add Changenotes
• Reviewed tests via @atorralba

[atorralba]

Thanks for the contribution! I added a small suggestion regarding a test case, but otherwise this looks reasonable to me.

Also we'll need a change note. You can follow these guidelines, but this most probably categorizes as minorAnalysis. Remember to add the note under lib, not src.