java.lang.security.audit.sqli.turbine-sqli.turbine-sqli

rules:
  - id: turbine-sqli
    pattern-either:
      - patterns:
          - pattern-either:
              - patterns:
                  - pattern-either:
                      - pattern-inside: |
                          String $SQL = $X + $Y;
                          ...
                      - pattern-inside: |
                          String $SQL = String.format(...);
                          ...
                      - pattern-inside: |
                          $VAL $FUNC(...,String $SQL,...) {
                            ...
                          }
                  - pattern-not-inside: |
                      String $SQL = "..." + "...";
                      ...
                  - pattern: $PEER.executeQuery($SQL,...)
              - pattern: |
                  $PEER.executeQuery(String.format(...),...)
              - pattern: |
                  $PEER.executeQuery($X + $Y,...)
          - pattern-not: |
              $PEER.executeQuery("..." + "...",...)
          - metavariable-regex:
              metavariable: $PEER
              regex: (BasePeer|GroupPeer)
      - patterns:
          - pattern-either:
              - patterns:
                  - pattern-either:
                      - pattern-inside: |
                          String $SQL = $X + $Y;
                          ...
                      - pattern-inside: |
                          String $SQL = String.format(...);
                          ...
                      - pattern-inside: |
                          $VAL $FUNC(...,String $SQL,...) {
                            ...
                          }
                  - pattern-not-inside: |
                      String $SQL = "..." + "...";
                      ...
                  - pattern: $P.executeQuery($SQL,...)
              - pattern: |
                  $P.executeQuery(String.format(...),...)
              - pattern: |
                  $P.executeQuery($X + $Y,...)
          - pattern-either:
              - pattern-inside: |
                  BasePeer $P = ...;
                  ...
              - pattern-inside: |
                  GroupPeer $P = ...;
                  ...
              - pattern-inside: |
                  $VAL $FUNC(...,GroupPeer $P,...) {
                    ...
                  }
              - pattern-inside: |
                  $VAL $FUNC(...,BasePeer $P,...) {
                    ...
                  }
          - pattern-not: |
              $P.executeQuery("..." + "...",...)
    message: Detected a formatted string in a SQL statement. This could lead to SQL
      injection if variables in the SQL statement are not properly sanitized.
      Use a prepared statements (java.sql.PreparedStatement) instead. You can
      obtain a PreparedStatement using 'connection.prepareStatement'.
    languages:
      - java
    severity: WARNING
    metadata:
      cwe:
        - "CWE-89: Improper Neutralization of Special Elements used in an SQL
          Command ('SQL Injection')"
      category: security
      technology:
        - turbine
      owasp:
        - A01:2017 - Injection
        - A03:2021 - Injection
      references:
        - https://owasp.org/Top10/A03_2021-Injection
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: HIGH
      confidence: LOW
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]