Java: sql-injection sink in org.apache.ibatis.mapping::BoundSql

2026-05-18 21:27:08 +02:00 · 2024-01-24 13:49:05 +01:00
1 changed files with 5 additions and 0 deletions
--- a/java/ql/lib/ext/org.apache.ibatis.mapping.model.yml
+++ b/java/ql/lib/ext/org.apache.ibatis.mapping.model.yml
@@ -1,4 +1,9 @@
 extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["org.apache.ibatis.mapping", "BoundSql", True, "BoundSql", "(Configuration,String,List,Object)", "", "Argument[1]", "sql-injection", "ai-manual"]
  - addsTo:
      pack: codeql/java-all
      extensible: summaryModel