Add models for org.springframework.jdbc.object

java/change-notes/2021-07-14-spring-jdbc.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* SQL-injection vulnerabilities relating to the `org.springframework.jdbc.object` are now recognised.

java/ql/src/semmle/code/java/frameworks/SpringJdbc.qll

@@ -24,7 +24,16 @@ private class SqlSinkCsv extends SinkModelCsv {
         "org.springframework.jdbc.core;JdbcTemplate;false;queryForMap;;;Argument[0];sql",
         "org.springframework.jdbc.core;JdbcTemplate;false;queryForObject;;;Argument[0];sql",
         "org.springframework.jdbc.core;JdbcTemplate;false;queryForRowSet;;;Argument[0];sql",
-        "org.springframework.jdbc.core;JdbcTemplate;false;queryForStream;;;Argument[0];sql"
+        "org.springframework.jdbc.core;JdbcTemplate;false;queryForStream;;;Argument[0];sql",
+        "org.springframework.jdbc.object;BatchSqlUpdate;false;BatchSqlUpdate;;;Argument[1];sql",
+        "org.springframework.jdbc.object;MappingSqlQuery;false;BatchSqlUpdate;;;Argument[1];sql",
+        "org.springframework.jdbc.object;MappingSqlQueryWithParameters;false;BatchSqlUpdate;;;Argument[1];sql",
+        "org.springframework.jdbc.object;RdbmsOperation;true;setSql;;;Argument[0];sql",
+        "org.springframework.jdbc.object;SqlCall;false;SqlCall;;;Argument[1];sql",
+        "org.springframework.jdbc.object;SqlFunction;false;SqlFunction;;;Argument[1];sql",
+        "org.springframework.jdbc.object;SqlQuery;false;SqlQuery;;;Argument[1];sql",
+        "org.springframework.jdbc.object;SqlUpdate;false;SqlUpdate;;;Argument[1];sql",
+        "org.springframework.jdbc.object;UpdatableSqlQuery;false;UpdatableSqlQuery;;;Argument[1];sql"
       ]
   }
 }

java/ql/test/query-tests/security/CWE-089/semmle/examples/SpringJdbc.java

@@ -0,0 +1,44 @@
+import java.sql.ResultSet;
+import java.util.Map;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.RowMapper;
+import org.springframework.jdbc.object.BatchSqlUpdate;
+import org.springframework.jdbc.object.MappingSqlQueryWithParameters;
+import org.springframework.jdbc.object.SqlFunction;
+import org.springframework.jdbc.object.SqlUpdate;
+import org.springframework.jdbc.object.UpdatableSqlQuery;
+
+public class SpringJdbc {
+
+  public static String source() { return null; }
+
+  private static class MyUpdatableSqlQuery extends UpdatableSqlQuery<String> {
+    public MyUpdatableSqlQuery() {
+      super(null, source()); // $ sqlInjection
+    }
+
+    protected String updateRow(ResultSet rs, int rowNum, Map<?,?> context) {
+      return null;
+    }
+  }
+
+  public static void test(JdbcTemplate template) {
+    new BatchSqlUpdate(null, source()); // $ sqlInjection
+    new SqlFunction(null, source()); // $ sqlInjection
+    new SqlUpdate(null, source()); // $ sqlInjection
+
+    (new BatchSqlUpdate()).setSql(source()); // $ sqlInjection
+
+    template.batchUpdate(source()); // $ sqlInjection
+    template.batchUpdate(source(), null, 0, null); // $ sqlInjection
+    template.execute(source()); // $ sqlInjection
+    template.update(source()); // $ sqlInjection
+    template.query(source(), (RowMapper)null); // $ sqlInjection
+    template.queryForList(source()); // $ sqlInjection
+    template.queryForMap(source()); // $ sqlInjection
+    template.queryForObject(source(), (Class)null); // $ sqlInjection
+    template.queryForRowSet(source()); // $ sqlInjection
+    template.queryForStream(source(), (RowMapper)null); // $ sqlInjection
+  }
+
+}

java/ql/test/query-tests/security/CWE-089/semmle/examples/options

@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/mongodbClient
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/mongodbClient:${testdir}/../../../../../stubs/springframework-5.3.8

java/ql/test/query-tests/security/CWE-089/semmle/examples/springjdbc.ql

@@ -0,0 +1,41 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.security.QueryInjection
+import TestUtilities.InlineExpectationsTest
+
+private class QueryInjectionFlowConfig extends TaintTracking::Configuration {
+  QueryInjectionFlowConfig() { this = "SqlInjectionLib::QueryInjectionFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) {
+    src.asExpr() = any(MethodAccess ma | ma.getMethod().hasName("source"))
+  }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof QueryInjectionSink }
+
+  override predicate isSanitizer(DataFlow::Node node) {
+    node.getType() instanceof PrimitiveType or
+    node.getType() instanceof BoxedType or
+    node.getType() instanceof NumberType
+  }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
+    any(AdditionalQueryInjectionTaintStep s).step(node1, node2)
+  }
+}
+
+class HasFlowTest extends InlineExpectationsTest {
+  HasFlowTest() { this = "HasFlowTest" }
+
+  override string getARelevantTag() { result = "sqlInjection" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "sqlInjection" and
+    exists(DataFlow::Node src, DataFlow::Node sink, QueryInjectionFlowConfig conf |
+      conf.hasFlow(src, sink)
+    |
+      sink.getLocation() = location and
+      element = sink.toString() and
+      value = ""
+    )
+  }
+}

java/ql/test/stubs/springframework-5.3.8/org/springframework/core/NestedRuntimeException.java

@@ -0,0 +1,15 @@
+// Generated automatically from org.springframework.core.NestedRuntimeException for testing purposes
+
+package org.springframework.core;
+
+
+abstract public class NestedRuntimeException extends RuntimeException
+{
+    protected NestedRuntimeException() {}
+    public NestedRuntimeException(String p0){}
+    public NestedRuntimeException(String p0, Throwable p1){}
+    public String getMessage(){ return null; }
+    public Throwable getMostSpecificCause(){ return null; }
+    public Throwable getRootCause(){ return null; }
+    public boolean contains(Class<? extends Object> p0){ return false; }
+}

java/ql/test/stubs/springframework-5.3.8/org/springframework/dao/DataAccessException.java

@@ -0,0 +1,12 @@
+// Generated automatically from org.springframework.dao.DataAccessException for testing purposes
+
+package org.springframework.dao;
+
+import org.springframework.core.NestedRuntimeException;
+
+abstract public class DataAccessException extends NestedRuntimeException
+{
+    protected DataAccessException() {}
+    public DataAccessException(String p0){}
+    public DataAccessException(String p0, Throwable p1){}
+}

java/ql/test/stubs/springframework-5.3.8/org/springframework/jdbc/core/BatchPreparedStatementSetter.java

@@ -0,0 +1,11 @@
+// Generated automatically from org.springframework.jdbc.core.BatchPreparedStatementSetter for testing purposes
+
+package org.springframework.jdbc.core;
+
+import java.sql.PreparedStatement;
+
+public interface BatchPreparedStatementSetter
+{
+    int getBatchSize();
+    void setValues(PreparedStatement p0, int p1);
+}

java/ql/test/stubs/springframework-5.3.8/org/springframework/jdbc/core/CallableStatementCallback.java

@@ -0,0 +1,10 @@
+// Generated automatically from org.springframework.jdbc.core.CallableStatementCallback for testing purposes
+
+package org.springframework.jdbc.core;
+
+import java.sql.CallableStatement;
+
+public interface CallableStatementCallback<T>
+{
+    T doInCallableStatement(CallableStatement p0);
+}

java/ql/test/stubs/springframework-5.3.8/org/springframework/jdbc/core/CallableStatementCreator.java

@@ -0,0 +1,11 @@
+// Generated automatically from org.springframework.jdbc.core.CallableStatementCreator for testing purposes
+
+package org.springframework.jdbc.core;
+
+import java.sql.CallableStatement;
+import java.sql.Connection;
+
+public interface CallableStatementCreator
+{
+    CallableStatement createCallableStatement(Connection p0);
+}

java/ql/test/stubs/springframework-5.3.8/org/springframework/jdbc/core/ConnectionCallback.java

@@ -0,0 +1,10 @@
+// Generated automatically from org.springframework.jdbc.core.ConnectionCallback for testing purposes
+
+package org.springframework.jdbc.core;
+
+import java.sql.Connection;
+
+public interface ConnectionCallback<T>
+{
+    T doInConnection(Connection p0);
+}

java/ql/test/stubs/springframework-5.3.8/org/springframework/jdbc/core/JdbcOperations.java

@@ -0,0 +1,89 @@
+// Generated automatically from org.springframework.jdbc.core.JdbcOperations for testing purposes
+
+package org.springframework.jdbc.core;
+
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Stream;
+import org.springframework.jdbc.core.BatchPreparedStatementSetter;
+import org.springframework.jdbc.core.CallableStatementCallback;
+import org.springframework.jdbc.core.CallableStatementCreator;
+import org.springframework.jdbc.core.ConnectionCallback;
+import org.springframework.jdbc.core.ParameterizedPreparedStatementSetter;
+import org.springframework.jdbc.core.PreparedStatementCallback;
+import org.springframework.jdbc.core.PreparedStatementCreator;
+import org.springframework.jdbc.core.PreparedStatementSetter;
+import org.springframework.jdbc.core.ResultSetExtractor;
+import org.springframework.jdbc.core.RowCallbackHandler;
+import org.springframework.jdbc.core.RowMapper;
+import org.springframework.jdbc.core.SqlParameter;
+import org.springframework.jdbc.core.StatementCallback;
+import org.springframework.jdbc.support.KeyHolder;
+import org.springframework.jdbc.support.rowset.SqlRowSet;
+
+public interface JdbcOperations
+{
+    <T> List<T> query(PreparedStatementCreator p0, RowMapper<T> p1);
+    <T> List<T> query(String p0, Object[] p1, RowMapper<T> p2);
+    <T> List<T> query(String p0, Object[] p1, int[] p2, RowMapper<T> p3);
+    <T> List<T> query(String p0, PreparedStatementSetter p1, RowMapper<T> p2);
+    <T> List<T> query(String p0, RowMapper<T> p1);
+    <T> List<T> query(String p0, RowMapper<T> p1, Object... p2);
+    <T> List<T> queryForList(String p0, Class<T> p1);
+    <T> List<T> queryForList(String p0, Class<T> p1, Object... p2);
+    <T> List<T> queryForList(String p0, Object[] p1, Class<T> p2);
+    <T> List<T> queryForList(String p0, Object[] p1, int[] p2, Class<T> p3);
+    <T> Stream<T> queryForStream(PreparedStatementCreator p0, RowMapper<T> p1);
+    <T> Stream<T> queryForStream(String p0, PreparedStatementSetter p1, RowMapper<T> p2);
+    <T> Stream<T> queryForStream(String p0, RowMapper<T> p1);
+    <T> Stream<T> queryForStream(String p0, RowMapper<T> p1, Object... p2);
+    <T> T execute(CallableStatementCreator p0, CallableStatementCallback<T> p1);
+    <T> T execute(ConnectionCallback<T> p0);
+    <T> T execute(PreparedStatementCreator p0, PreparedStatementCallback<T> p1);
+    <T> T execute(StatementCallback<T> p0);
+    <T> T execute(String p0, CallableStatementCallback<T> p1);
+    <T> T execute(String p0, PreparedStatementCallback<T> p1);
+    <T> T query(PreparedStatementCreator p0, ResultSetExtractor<T> p1);
+    <T> T query(String p0, Object[] p1, ResultSetExtractor<T> p2);
+    <T> T query(String p0, Object[] p1, int[] p2, ResultSetExtractor<T> p3);
+    <T> T query(String p0, PreparedStatementSetter p1, ResultSetExtractor<T> p2);
+    <T> T query(String p0, ResultSetExtractor<T> p1);
+    <T> T query(String p0, ResultSetExtractor<T> p1, Object... p2);
+    <T> T queryForObject(String p0, Class<T> p1);
+    <T> T queryForObject(String p0, Class<T> p1, Object... p2);
+    <T> T queryForObject(String p0, Object[] p1, Class<T> p2);
+    <T> T queryForObject(String p0, Object[] p1, RowMapper<T> p2);
+    <T> T queryForObject(String p0, Object[] p1, int[] p2, Class<T> p3);
+    <T> T queryForObject(String p0, Object[] p1, int[] p2, RowMapper<T> p3);
+    <T> T queryForObject(String p0, RowMapper<T> p1);
+    <T> T queryForObject(String p0, RowMapper<T> p1, Object... p2);
+    <T> int[] batchUpdate(String p0, Collection<T> p1, int p2, ParameterizedPreparedStatementSetter<T> p3);
+    List<Map<String, Object>> queryForList(String p0);
+    List<Map<String, Object>> queryForList(String p0, Object... p1);
+    List<Map<String, Object>> queryForList(String p0, Object[] p1, int[] p2);
+    Map<String, Object> call(CallableStatementCreator p0, List<SqlParameter> p1);
+    Map<String, Object> queryForMap(String p0);
+    Map<String, Object> queryForMap(String p0, Object... p1);
+    Map<String, Object> queryForMap(String p0, Object[] p1, int[] p2);
+    SqlRowSet queryForRowSet(String p0);
+    SqlRowSet queryForRowSet(String p0, Object... p1);
+    SqlRowSet queryForRowSet(String p0, Object[] p1, int[] p2);
+    int update(PreparedStatementCreator p0);
+    int update(PreparedStatementCreator p0, KeyHolder p1);
+    int update(String p0);
+    int update(String p0, Object... p1);
+    int update(String p0, Object[] p1, int[] p2);
+    int update(String p0, PreparedStatementSetter p1);
+    int[] batchUpdate(String p0, BatchPreparedStatementSetter p1);
+    int[] batchUpdate(String p0, List<Object[]> p1);
+    int[] batchUpdate(String p0, List<Object[]> p1, int[] p2);
+    int[] batchUpdate(String... p0);
+    void execute(String p0);
+    void query(PreparedStatementCreator p0, RowCallbackHandler p1);
+    void query(String p0, Object[] p1, RowCallbackHandler p2);
+    void query(String p0, Object[] p1, int[] p2, RowCallbackHandler p3);
+    void query(String p0, PreparedStatementSetter p1, RowCallbackHandler p2);
+    void query(String p0, RowCallbackHandler p1);
+    void query(String p0, RowCallbackHandler p1, Object... p2);
+}