Add Java CWE-089 SQL injection audit query (partial flow, any source)

[Copilot]

Java lacked an audit query for CWE-089 SQL injection, unlike the existing Python SqlInjectionAudit.ql. The goal is to surface any data flowing into a recognized SQL injection sink, including from sources not modeled as user input.

Query

• Added java/src/audit/CWE-089/SqlInjectionAudit.ql: a partial (backwards) taint-tracking exploration from QueryInjectionSink (covers Statement.executeQuery, Connection.prepareStatement, etc.), with isSource matching any node via TaintTracking::Global + FlowExplorationRev.
• Tagged audit / kind path-problem, so it's automatically picked up by java-audit.qls and excluded from the default java.qls, consistent with other audit queries.

Statement statement = connection.createStatement();
// Reported even though `username` may not be recognized as a RemoteFlowSource
statement.executeQuery("SELECT * FROM users WHERE username = '" + username + "'");

Docs

• Added java/src/audit/CWE-089/SqlInjectionAudit.md describing the query's purpose and low-precision, audit-only nature.

Tests

• Added java/test/audit/CWE-089/ with SqlInjectionAuditTest.java (tainted concatenation + hardcoded literal cases), .qlref, and accepted .expected output.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Review details

Suppressed comments (2)

java/src/audit/CWE-089/SqlInjectionAudit.ql:43

• The result message/label says “user-provided value”, but the configuration treats any node as a source (including string literals, as shown by the included expected output). This wording is inaccurate and can confuse audit triage; consider a neutral label (for example, “value”) and a message that doesn’t imply user control. Note: changing this will require updating the .expected test output accordingly.

select sink.getNode(), source, sink, "This SQL query depends on a $@.", source.getNode(),
  "user-provided value"

java/src/audit/CWE-089/SqlInjectionAudit.ql:6

• The query considers every node a potential source (isSource { any() }), but the @name/@description currently describe only “user-controlled sources”. This is misleading for an audit query intended to surface any influencing value (including literals and internal data). Update the metadata to match the query’s actual scope.

This issue also appears on line 42 of the same file.

 * @name SQL query built from user-controlled sources
 * @description Building a SQL query from user-controlled sources is vulnerable to insertion of
 *              malicious SQL code by the user. This audit query reports partial flows (any
 *              source, not just recognized remote/user input) into a known SQL injection sink,
 *              which is useful for surfacing sources that are not yet modeled.

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite

[felickz]

👍