hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 11:19:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add Hibernate SQL injection sink tests

Browse Source 
Agent-Logs-Url: https://github.com/github/codeql/sessions/2e7aecca-63ea-489f-8b87-4cc557655919

Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-04-23 10:04:52 +00:00
committed by GitHub
parent 7b897add22
commit 081ad03b4b
6 changed files with 57 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
java/ql/test/query-tests/security/CWE-089/semmle/examples/Hibernate.java Normal file
View File

@@ -0,0 +1,21 @@
import org.hibernate.Session;
import org.hibernate.SharedSessionContract;
import org.hibernate.query.QueryProducer;
public class Hibernate {
public static String source() { return null; }
public static void test(
Session session, SharedSessionContract sharedSessionContract, QueryProducer queryProducer) {
session.createQuery(source()); // $ sqlInjection
session.createSQLQuery(source()); // $ sqlInjection
sharedSessionContract.createQuery(source()); // $ sqlInjection
sharedSessionContract.createSQLQuery(source()); // $ sqlInjection
queryProducer.createNativeQuery(source()); // $ sqlInjection
queryProducer.createQuery(source()); // $ sqlInjection
queryProducer.createSQLQuery(source()); // $ sqlInjection
}
}

2
java/ql/test/query-tests/security/CWE-089/semmle/examples/options
View File

@@ -1 +1 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/mongodbClient:${testdir}/../../../../../stubs/couchbaseClient:${testdir}/../../../../../stubs/springframework-5.8.x:${testdir}/../../../../../stubs/apache-hive:${testdir}/../../../../../stubs/jakarta-persistence-api-3.2.0 --release 21
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/mongodbClient:${testdir}/../../../../../stubs/couchbaseClient:${testdir}/../../../../../stubs/springframework-5.8.x:${testdir}/../../../../../stubs/apache-hive:${testdir}/../../../../../stubs/jakarta-persistence-api-3.2.0:${testdir}/../../../../../stubs/hibernate-5.x --release 21

10
java/ql/test/stubs/hibernate-5.x/org/hibernate/Session.java generated Normal file
View File

@@ -0,0 +1,10 @@
package org.hibernate;
import org.hibernate.query.Query;
public interface Session extends SharedSessionContract {
Query createQuery(String queryString);
Query createSQLQuery(String queryString);
}

11
java/ql/test/stubs/hibernate-5.x/org/hibernate/SharedSessionContract.java generated Normal file
View File

@@ -0,0 +1,11 @@
package org.hibernate;
import org.hibernate.query.Query;
import org.hibernate.query.QueryProducer;
public interface SharedSessionContract extends QueryProducer {
Query createQuery(String queryString);
Query createSQLQuery(String queryString);
}

4
java/ql/test/stubs/hibernate-5.x/org/hibernate/query/Query.java generated Normal file
View File

@@ -0,0 +1,4 @@
package org.hibernate.query;
public interface Query {
}

10
java/ql/test/stubs/hibernate-5.x/org/hibernate/query/QueryProducer.java generated Normal file
View File

@@ -0,0 +1,10 @@
package org.hibernate.query;
public interface QueryProducer {
Query createNativeQuery(String sqlString);
Query createQuery(String queryString);
Query createSQLQuery(String queryString);
}