codeql/java/ql/lib/ext/java.sql.model.yml

extensions:
  - addsTo:
      pack: codeql/java-all
      extensible: sinkModel
    data:
      - ["java.sql", "Connection", True, "prepareCall", "", "", "Argument[0]", "sql-injection", "manual"]
      - ["java.sql", "Connection", True, "prepareStatement", "", "", "Argument[0]", "sql-injection", "manual"]
      - ["java.sql", "DatabaseMetaData", True, "getColumns", "(String,String,String,String)", "", "Argument[2]", "sql-injection", "ai-manual"]
      - ["java.sql", "DatabaseMetaData", True, "getPrimaryKeys", "(String,String,String)", "", "Argument[2]", "sql-injection", "ai-manual"]
      - ["java.sql", "Driver", False, "connect", "(String,Properties)", "", "Argument[0]", "request-forgery", "manual"]
      - ["java.sql", "DriverManager", False, "getConnection", "(String)", "", "Argument[0]", "request-forgery", "manual"]
      - ["java.sql", "DriverManager", False, "getConnection", "(String,Properties)", "", "Argument[0]", "request-forgery", "manual"]
      - ["java.sql", "DriverManager", False, "getConnection", "(String,String,String)", "", "Argument[0]", "request-forgery", "manual"]
      - ["java.sql", "DriverManager", False, "getConnection", "(String,String,String)", "", "Argument[2]", "credentials-password", "hq-generated"]
      - ["java.sql", "Statement", True, "addBatch", "", "", "Argument[0]", "sql-injection", "manual"]
      - ["java.sql", "Statement", True, "execute", "", "", "Argument[0]", "sql-injection", "manual"]
      - ["java.sql", "Statement", True, "executeLargeUpdate", "", "", "Argument[0]", "sql-injection", "manual"]
      - ["java.sql", "Statement", True, "executeQuery", "", "", "Argument[0]", "sql-injection", "manual"]
      - ["java.sql", "Statement", True, "executeUpdate", "", "", "Argument[0]", "sql-injection", "manual"]
      - ["java.sql", "DriverManager", False, "getConnection", "(String,String,String)", "", "Argument[1]", "credentials-username", "hq-generated"]
  - addsTo:
      pack: codeql/java-all
      extensible: summaryModel
    data:
      - ["java.sql", "Connection", True, "nativeSQL", "(String)", "", "Argument[0]", "ReturnValue", "taint", "hq-manual"]
      - ["java.sql", "ResultSet", True, "getString", "(String)", "", "Argument[this]", "ReturnValue", "taint", "manual"]

  - addsTo:
      pack: codeql/java-all
      extensible: neutralModel
    data:
      - ["java.sql", "Connection", "createStatement", "()", "summary", "manual"]
      - ["java.sql", "PreparedStatement", "executeUpdate", "()", "summary", "manual"]
      - ["java.sql", "PreparedStatement", "executeQuery", "()", "summary", "manual"]
      - ["java.sql", "PreparedStatement", "setInt", "(int,int)", "summary", "manual"]
      - ["java.sql", "PreparedStatement", "setLong", "(int,long)", "summary", "manual"]
      - ["java.sql", "PreparedStatement", "setString", "(int,String)", "summary", "manual"]
      - ["java.sql", "ResultSet", "next", "()", "summary", "manual"]
      - ["java.sql", "Statement", "close", "()", "summary", "manual"]

      # The below APIs have numeric flow and are currently being stored as neutral models.
      # These may be changed to summary models with kinds "value-numeric" and "taint-numeric" (or similar) in the future.
      - ["java.sql", "ResultSet", "getInt", "(int)", "summary", "manual"]               # taint-numeric
      - ["java.sql", "ResultSet", "getInt", "(String)", "summary", "manual"]            # taint-numeric
      - ["java.sql", "ResultSet", "getLong", "(String)", "summary", "manual"]           # taint-numeric
      - ["java.sql", "ResultSet", "getString", "(int)", "summary", "manual"]            # taint-numeric, potentially interesting for second order SQL injection
      - ["java.sql", "ResultSet", "getTimestamp", "(String)", "summary", "manual"]      # taint-numeric
      - ["java.sql", "Timestamp", "Timestamp", "(long)", "summary", "manual"]           # taint-numeric
      - ["java.sql", "Timestamp", "getTime", "()", "summary", "manual"]                 # taint-numeric
  - addsTo:
      pack: codeql/java-all
      extensible: sourceModel
    data:
      - ["java.sql", "ResultSet", True, "getString", "", "", "ReturnValue", "database", "manual"]