Java: model R2DBC SQL injection sinks

java/ql/lib/change-notes/2026-08-04-spring-r2dbc-sql-injection.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added SQL injection sink models for Spring R2DBC `DatabaseClient` and the R2DBC SPI.

java/ql/lib/ext/io.r2dbc.spi.model.yml

@@ -0,0 +1,11 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["io.r2dbc.spi", "Connection", True, "createStatement", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Batch", True, "add", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Connection", True, "createSavepoint", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Connection", True, "releaseSavepoint", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Connection", True, "rollbackTransactionToSavepoint", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Statement", True, "returnGeneratedValues", "(String[])", "", "Argument[0]", "sql-injection", "manual"]

java/ql/lib/ext/org.springframework.r2dbc.core.model.yml

@@ -0,0 +1,27 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["org.springframework.r2dbc.core", "DatabaseClient", True, "sql", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "fetch", "", "", "Argument[this]", "sql-injection", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "then", "", "", "Argument[this]", "sql-injection", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "map", "(java.util.function.Function)", "", "Argument[this]", "sql-injection", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "map", "(java.util.function.BiFunction)", "", "Argument[this]", "sql-injection", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "mapValue", "(Class)", "", "Argument[this]", "sql-injection", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "mapProperties", "(Class)", "", "Argument[this]", "sql-injection", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "flatMap", "(java.util.function.Function)", "", "Argument[this]", "sql-injection", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["org.springframework.r2dbc.core", "DatabaseClient", True, "sql", "(java.util.function.Supplier)", "", "Argument[0].ReturnValue", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bind", "(int,Object)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bind", "(String,Object)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindNull", "(int,Class)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindNull", "(String,Class)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindValues", "(List)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindValues", "(Map)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "bindProperties", "(Object)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "filter", "(java.util.function.Function)", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "filter", "(org.springframework.r2dbc.core.StatementFilterFunction)", "", "Argument[this]", "ReturnValue", "taint", "manual"]

java/ql/test/query-tests/security/CWE-089/semmle/examples/SpringJdbc.java

@@ -1,5 +1,8 @@
 import java.sql.ResultSet;
 import java.util.Map;
+import java.util.function.Supplier;
+import io.r2dbc.spi.Batch;
+import io.r2dbc.spi.Connection;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.core.namedparam.NamedParameterJdbcOperations;
 import org.springframework.jdbc.core.namedparam.SqlParameterSource;
@@ -13,6 +16,7 @@
 import org.springframework.jdbc.object.SqlFunction;
 import org.springframework.jdbc.object.SqlUpdate;
 import org.springframework.jdbc.object.UpdatableSqlQuery;
+import org.springframework.r2dbc.core.DatabaseClient;
 
 public class SpringJdbc {
 
@@ -80,4 +84,33 @@ public static void test(JdbcTemplate template, NamedParameterJdbcOperations name
     namedParamTemplate.update(source(), null, null, null); // $ sqlInjection
   }
 
+  public static void testR2dbc(DatabaseClient client, Connection connection, Batch batch) {
+    client.sql(source()); // $ sqlInjection
+    client.sql((Supplier<String>) SpringJdbc::source).fetch(); // $ sqlInjection
+    client.sql((Supplier<String>) SpringJdbc::source).then(); // $ sqlInjection
+    client.sql((Supplier<String>) SpringJdbc::source).map(row -> row); // $ sqlInjection
+    client.sql((Supplier<String>) SpringJdbc::source).map((row, metadata) -> row); // $ sqlInjection
+    client.sql((Supplier<String>) SpringJdbc::source).flatMap(row -> row); // $ sqlInjection
+    client.sql((Supplier<String>) SpringJdbc::source).mapValue(String.class); // $ sqlInjection
+    client.sql((Supplier<String>) SpringJdbc::source).mapProperties(String.class); // $ sqlInjection
+    client.sql((Supplier<String>) SpringJdbc::source)
+        .bind(0, "value")
+        .bind("name", "value")
+        .bindNull(0, String.class)
+        .bindNull("name", String.class)
+        .bindValues(java.util.List.of("value"))
+        .bindValues(java.util.Map.of("name", "value"))
+        .bindProperties(new Object())
+        .filter(statement -> statement)
+        .filter((org.springframework.r2dbc.core.StatementFilterFunction) null) // $ sqlInjection
+        .fetch();
+    connection.createStatement(source()); // $ sqlInjection
+    batch.add(source()); // $ sqlInjection
+    connection.createSavepoint(source()); // $ sqlInjection
+    connection.releaseSavepoint(source()); // $ sqlInjection
+    connection.rollbackTransactionToSavepoint(source()); // $ sqlInjection
+    connection.createStatement("INSERT INTO test VALUES (1)")
+        .returnGeneratedValues(source()); // $ sqlInjection
+  }
+
 }

java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Batch.java

@@ -0,0 +1,5 @@
+package io.r2dbc.spi;
+
+public interface Batch {
+  Batch add(String sql);
+}

java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Connection.java

@@ -0,0 +1,11 @@
+package io.r2dbc.spi;
+
+public interface Connection {
+  Statement createStatement(String sql);
+
+  void createSavepoint(String name);
+
+  void releaseSavepoint(String name);
+
+  void rollbackTransactionToSavepoint(String name);
+}

java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Statement.java

@@ -0,0 +1,5 @@
+package io.r2dbc.spi;
+
+public interface Statement {
+  Statement returnGeneratedValues(String... columns);
+}

java/ql/test/query-tests/security/CWE-089/semmle/examples/org/springframework/r2dbc/core/DatabaseClient.java

@@ -0,0 +1,47 @@
+package org.springframework.r2dbc.core;
+
+import java.util.List;
+import java.util.Map;
+import java.util.function.BiFunction;
+import java.util.function.Function;
+import java.util.function.Supplier;
+
+public interface DatabaseClient {
+  GenericExecuteSpec sql(String sql);
+
+  GenericExecuteSpec sql(Supplier<String> sqlSupplier);
+
+  interface GenericExecuteSpec {
+    GenericExecuteSpec bind(int index, Object value);
+
+    GenericExecuteSpec bind(String name, Object value);
+
+    GenericExecuteSpec bindNull(int index, Class<?> type);
+
+    GenericExecuteSpec bindNull(String name, Class<?> type);
+
+    GenericExecuteSpec bindValues(List<Object> values);
+
+    GenericExecuteSpec bindValues(Map<String, Object> values);
+
+    GenericExecuteSpec bindProperties(Object source);
+
+    GenericExecuteSpec filter(Function<Object, Object> filterFunction);
+
+    GenericExecuteSpec filter(StatementFilterFunction filterFunction);
+
+    Object fetch();
+
+    Object then();
+
+    Object map(Function<Object, Object> mappingFunction);
+
+    Object map(BiFunction<Object, Object, Object> mappingFunction);
+
+    Object mapValue(Class<?> mappedClass);
+
+    Object mapProperties(Class<?> mappedClass);
+
+    Object flatMap(Function<Object, Object> mappingFunction);
+  }
+}

java/ql/test/query-tests/security/CWE-089/semmle/examples/org/springframework/r2dbc/core/StatementFilterFunction.java

@@ -0,0 +1,4 @@
+package org.springframework.r2dbc.core;
+
+public interface StatementFilterFunction {
+}