mcp-server-semgrep/semgrep-rules/java/lang/security/audit/sqli/jpa-sqli.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: jpa-sqli
  message: >-
    Detected a formatted string in a SQL statement. This could lead to SQL
    injection if variables in the SQL statement are not properly sanitized.
    Use a prepared statements (java.sql.PreparedStatement) instead. You
    can obtain a PreparedStatement using 'connection.prepareStatement'.
  languages: [java]
  severity: WARNING
  patterns:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern-inside: |
            String $SQL = $X + $Y;
            ...
        - pattern-inside: |
            String $SQL = String.format(...);
            ...
        - pattern-inside: |
            $TYPE $FUNC(...,String $SQL,...) {
              ...
            }
      - pattern-not-inside: |
          String $SQL = "..." + "...";
          ...
      - pattern: $EM.$METHOD($SQL,...)
    - pattern: |
        $EM.$METHOD(String.format(...),...);
    - pattern: |
        $EM.$METHOD($X + $Y,...);
  - pattern-either:
    - pattern-inside: |
        EntityManager $EM = ...;
        ...
    - pattern-inside: |
        $TYPE $FUNC(...,EntityManager $EM,...) {
          ...
        }
  - pattern-not: |
      $EM.$METHOD("..." + "...",...);
  - metavariable-regex:
      metavariable: $METHOD
      regex: ^(createQuery|createNativeQuery)$
  metadata:
    cwe:
    - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
    category: security
    technology:
    - jpa
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW