wip: set up codeql-sqlite/ sample

codeql-jedis/README.org

@@ -252,7 +252,6 @@
     | 14 | "return {}"                      | code-injection |
 
 * Identify usage of injection-related models in existing queries
-
   To verify whether existing CodeQL queries make use of the injection-related
   models, we can search for files in the =ql/java= and =ql/cpp= directories that
   contain the string =-injection=. This string often appears in taint-tracking
@@ -290,7 +289,6 @@
    These files include both top-level queries (under =src/Security/...=) and reusable model libraries (under =lib/semmle/...=). Experimental and framework-specific queries are also included.
 
 ** C++ Queries
-
    Likewise, to check for C++ queries that reference =-injection=, use:
 
    #+BEGIN_SRC sh
@@ -309,6 +307,7 @@
    These files indicate active use of injection-related taint tracking in the C++ suite as well.
 
 * TODO for java, the sqltainted query will find the sink, not the source yet.
+  [[../ql/java/ql/src/Security/CWE/CWE-089/SqlTainted.ql]]
 * TODO vulnerable sample, jedis
   Running the model editor a jedis db models jedis dependencies; we need jedis
   /as/ dependency to model it.