From f0fb06544644e53fd26f6497c7df1568fc113577 Mon Sep 17 00:00:00 2001 From: Michael Nebel Date: Wed, 4 Oct 2023 10:51:07 +0200 Subject: [PATCH] Java: Opt-in the SQL injection query to use threat model flow sources. --- java/ql/lib/semmle/code/java/security/SqlInjectionQuery.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/ql/lib/semmle/code/java/security/SqlInjectionQuery.qll b/java/ql/lib/semmle/code/java/security/SqlInjectionQuery.qll index 18f3c01571e..091240763ec 100644 --- a/java/ql/lib/semmle/code/java/security/SqlInjectionQuery.qll +++ b/java/ql/lib/semmle/code/java/security/SqlInjectionQuery.qll @@ -37,7 +37,7 @@ deprecated class QueryInjectionFlowConfig extends TaintTracking::Configuration { * A taint-tracking configuration for unvalidated user input that is used in SQL queries. */ module QueryInjectionFlowConfig implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource } + predicate isSource(DataFlow::Node src) { src instanceof ThreatModelFlowSource } predicate isSink(DataFlow::Node sink) { sink instanceof QueryInjectionSink }