mcp-server-semgrep/semgrep-rules/java/lang/security/audit/sqli/jdo-sqli.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: jdo-sqli
  pattern-either:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern-inside: |
              String $SQL = $X + $Y;
              ...
          - pattern-inside: |
              String $SQL = String.format(...);
              ...
          - pattern-inside: |
              $TYPE $FUNC(...,String $SQL,...) {
                ...
              }
        - pattern-not-inside: |
            String $SQL = "..." + "...";
            ...
        - pattern: $Q.$METHOD($SQL,...)
      - pattern: |
          $Q.$METHOD(String.format(...),...);
      - pattern: |
          $Q.$METHOD($X + $Y,...);
    - pattern-either:
      - pattern-inside: |
          javax.jdo.Query $Q = ...;
          ...
      - pattern-inside: |
          $TYPE $FUNC(...,javax.jdo.Query $Q,...) {
            ...
          }
    - pattern-not: |
        $Q.$METHOD("..." + "...",...);
    - metavariable-regex:
        metavariable: $METHOD
        regex: ^(setFilter|setGrouping)$
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern-inside: |
              String $SQL = $X + $Y;
              ...
          - pattern-inside: |
              String $SQL = String.format(...);
              ...
          - pattern-inside: |
              $VAL $FUNC(...,String $SQL,...) {
                ...
              }
        - pattern-not-inside: |
            String $SQL = "..." + "...";
            ...
        - pattern: $PM.newQuery(...,$SQL,...)
      - pattern: |
          $PM.newQuery(...,String.format(...),...);
      - pattern: |
          $PM.newQuery(...,$X + $Y,...);
    - pattern-either:
      - pattern-inside: |
          javax.jdo.PersistenceManager $PM = ...;
          ...
      - pattern-inside: |
          $TYPE $FUNC(...,javax.jdo.PersistenceManager $PM,...) {
            ...
          }
    - pattern-not: |
        $PM.newQuery(...,"..." + "...",...);
  message: >-
    Detected a formatted string in a SQL statement. This could lead to SQL
    injection if variables in the SQL statement are not properly sanitized.
    Use a prepared statements (java.sql.PreparedStatement) instead. You
    can obtain a PreparedStatement using 'connection.prepareStatement'.
  languages: [java]
  severity: WARNING
  metadata:
    cwe:
    - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
    category: security
    technology:
    - java
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW