Skip to content

Commit e079fdf

Browse files
felickzfelickz
committed
Java: cover R2DBC fluent execution paths
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fb2a5047-e061-44ba-b6df-198390190733
1 parent 2e4a174 commit e079fdf

4 files changed

Lines changed: 70 additions & 0 deletions

File tree

‎java/ql/lib/ext/org.springframework.r2dbc.core.model.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,23 @@ extensions:
55
data:
66
- ["org.springframework.r2dbc.core", "DatabaseClient", True, "sql", "(String)", "", "Argument[0]", "sql-injection", "manual"]
77
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "fetch", "", "", "Argument[this]", "sql-injection", "manual"]
8+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "then", "", "", "Argument[this]", "sql-injection", "manual"]
9+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "map", "(java.util.function.Function)", "", "Argument[this]", "sql-injection", "manual"]
10+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "map", "(java.util.function.BiFunction)", "", "Argument[this]", "sql-injection", "manual"]
11+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "mapValue", "(Class)", "", "Argument[this]", "sql-injection", "manual"]
12+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "mapProperties", "(Class)", "", "Argument[this]", "sql-injection", "manual"]
13+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "flatMap", "(java.util.function.Function)", "", "Argument[this]", "sql-injection", "manual"]
814
- addsTo:
915
pack: codeql/java-all
1016
extensible: summaryModel
1117
data:
1218
- ["org.springframework.r2dbc.core", "DatabaseClient", True, "sql", "(java.util.function.Supplier)", "", "Argument[0].ReturnValue", "ReturnValue", "taint", "manual"]
19+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bind", "(int,Object)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
20+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bind", "(String,Object)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
21+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindNull", "(int,Class)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
22+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindNull", "(String,Class)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
23+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindValues", "(List)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
24+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindValues", "(Map)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
25+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindProperties", "(Object)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
26+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "filter", "(java.util.function.Function)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
27+
- ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "filter", "(org.springframework.r2dbc.core.StatementFilterFunction)", "", "Argument[this]", "ReturnValue", "taint", "manual"]

‎java/ql/test/query-tests/security/CWE-089/semmle/examples/SpringJdbc.java‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,23 @@ public static void test(JdbcTemplate template, NamedParameterJdbcOperations name
8787
public static void testR2dbc(DatabaseClient client, Connection connection, Batch batch) {
8888
client.sql(source()); // $ sqlInjection
8989
client.sql((Supplier<String>) SpringJdbc::source).fetch(); // $ sqlInjection
90+
client.sql((Supplier<String>) SpringJdbc::source).then(); // $ sqlInjection
91+
client.sql((Supplier<String>) SpringJdbc::source).map(row -> row); // $ sqlInjection
92+
client.sql((Supplier<String>) SpringJdbc::source).map((row, metadata) -> row); // $ sqlInjection
93+
client.sql((Supplier<String>) SpringJdbc::source).flatMap(row -> row); // $ sqlInjection
94+
client.sql((Supplier<String>) SpringJdbc::source).mapValue(String.class); // $ sqlInjection
95+
client.sql((Supplier<String>) SpringJdbc::source).mapProperties(String.class); // $ sqlInjection
96+
client.sql((Supplier<String>) SpringJdbc::source)
97+
.bind(0, "value")
98+
.bind("name", "value")
99+
.bindNull(0, String.class)
100+
.bindNull("name", String.class)
101+
.bindValues(java.util.List.of("value"))
102+
.bindValues(java.util.Map.of("name", "value"))
103+
.bindProperties(new Object())
104+
.filter(statement -> statement)
105+
.filter((org.springframework.r2dbc.core.StatementFilterFunction) null) // $ sqlInjection
106+
.fetch();
90107
connection.createStatement(source()); // $ sqlInjection
91108
batch.add(source()); // $ sqlInjection
92109
}

‎java/ql/test/query-tests/security/CWE-089/semmle/examples/org/springframework/r2dbc/core/DatabaseClient.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
package org.springframework.r2dbc.core;
22

3+
import java.util.List;
4+
import java.util.Map;
5+
import java.util.function.BiFunction;
6+
import java.util.function.Function;
37
import java.util.function.Supplier;
48

59
public interface DatabaseClient {
@@ -8,6 +12,36 @@ public interface DatabaseClient {
812
GenericExecuteSpec sql(Supplier<String> sqlSupplier);
913

1014
interface GenericExecuteSpec {
15+
GenericExecuteSpec bind(int index, Object value);
16+
17+
GenericExecuteSpec bind(String name, Object value);
18+
19+
GenericExecuteSpec bindNull(int index, Class<?> type);
20+
21+
GenericExecuteSpec bindNull(String name, Class<?> type);
22+
23+
GenericExecuteSpec bindValues(List<Object> values);
24+
25+
GenericExecuteSpec bindValues(Map<String, Object> values);
26+
27+
GenericExecuteSpec bindProperties(Object source);
28+
29+
GenericExecuteSpec filter(Function<Object, Object> filterFunction);
30+
31+
GenericExecuteSpec filter(StatementFilterFunction filterFunction);
32+
1133
Object fetch();
34+
35+
Object then();
36+
37+
Object map(Function<Object, Object> mappingFunction);
38+
39+
Object map(BiFunction<Object, Object, Object> mappingFunction);
40+
41+
Object mapValue(Class<?> mappedClass);
42+
43+
Object mapProperties(Class<?> mappedClass);
44+
45+
Object flatMap(Function<Object, Object> mappingFunction);
1246
}
1347
}

‎java/ql/test/query-tests/security/CWE-089/semmle/examples/org/springframework/r2dbc/core/StatementFilterFunction.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
package org.springframework.r2dbc.core;
2+
3+
public interface StatementFilterFunction {
4+
}

0 commit comments

Comments
 (0)