mcp-server-semgrep/semgrep-rules/java/lang/security/audit/sqli/turbine-sqli.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: turbine-sqli
  pattern-either:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern-inside: |
              String $SQL = $X + $Y;
              ...
          - pattern-inside: |
              String $SQL = String.format(...);
              ...
          - pattern-inside: |
              $VAL $FUNC(...,String $SQL,...) {
                ...
              }
        - pattern-not-inside: |
            String $SQL = "..." + "...";
            ...
        - pattern: $PEER.executeQuery($SQL,...)
      - pattern: |
          $PEER.executeQuery(String.format(...),...)
      - pattern: |
          $PEER.executeQuery($X + $Y,...)
    - pattern-not: |
        $PEER.executeQuery("..." + "...",...)
    - metavariable-regex:
        metavariable: $PEER
        regex: (BasePeer|GroupPeer)
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern-inside: |
              String $SQL = $X + $Y;
              ...
          - pattern-inside: |
              String $SQL = String.format(...);
              ...
          - pattern-inside: |
              $VAL $FUNC(...,String $SQL,...) {
                ...
              }
        - pattern-not-inside: |
            String $SQL = "..." + "...";
            ...
        - pattern: $P.executeQuery($SQL,...)
      - pattern: |
          $P.executeQuery(String.format(...),...)
      - pattern: |
          $P.executeQuery($X + $Y,...)
    - pattern-either:
      - pattern-inside: |
          BasePeer $P = ...;
          ...
      - pattern-inside: |
          GroupPeer $P = ...;
          ...
      - pattern-inside: |
          $VAL $FUNC(...,GroupPeer $P,...) {
            ...
          }
      - pattern-inside: |
          $VAL $FUNC(...,BasePeer $P,...) {
            ...
          }
    - pattern-not: |
        $P.executeQuery("..." + "...",...)
  message: >-
    Detected a formatted string in a SQL statement. This could lead to SQL
    injection if variables in the SQL statement are not properly sanitized.
    Use a prepared statements (java.sql.PreparedStatement) instead. You
    can obtain a PreparedStatement using 'connection.prepareStatement'.
  languages: [java]
  severity: WARNING
  metadata:
    cwe:
    - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
    category: security
    technology:
    - turbine
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW