Add jOOQ methods as SQL Injection Sinks

java/ql/src/Security/CWE/CWE-089/SqlInjectionLib.qll

@@ -7,6 +7,7 @@ import semmle.code.java.frameworks.javaee.Persistence
 import semmle.code.java.frameworks.SpringJdbc
 import semmle.code.java.frameworks.MyBatis
 import semmle.code.java.frameworks.Hibernate
+import semmle.code.java.frameworks.jOOQ
 
 /** A sink for database query language injection vulnerabilities. */
 abstract class QueryInjectionSink extends DataFlow::ExprNode { }
@@ -29,6 +30,8 @@ class SqlInjectionSink extends QueryInjectionSink {
       index = 0 and mybatisSqlMethod(m)
       or
       index = 0 and hibernateSqlMethod(m)
+      or
+      index = 0 and jOOQSqlMethod(m)
     )
   }
 }

java/ql/src/semmle/code/java/frameworks/jOOQ.qll

@@ -0,0 +1,25 @@
+/**
+ * Provides classes and predicates for working with the jOOQ framework.
+ */
+
+import java
+
+/**
+ * Methods annotated with this allow for generation of "plain SQL"
+ * and is prone to SQL injection.
+ * https://www.jooq.org/doc/current/manual/sql-building/plain-sql/
+ */
+private class PlainSQLType extends Annotation {
+  PlainSQLType() {
+    this.getType().hasQualifiedName("org.jooq", "PlainSQL")
+  }
+}
+
+/**
+ * Holds if `m` is a jOOQ SQL method taking an SQL string as its
+ * first argument.
+ */
+predicate jOOQSqlMethod(Method m) {
+  m.getAnAnnotation() instanceof PlainSQLType and
+  m.getParameterType(0) instanceof TypeString
+}