From 56647d5336b63f2289e7eee0bf66c131bc37b371 Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Mon, 22 Jun 2026 17:10:44 -0400 Subject: [PATCH 1/7] Add java data extensions for sql injection sinks, sources, and a taint flow summary --- .../2026-06-22-various-mad-additions.md | 6 ++++ .../ext/com.google.cloud.bigquery.model.yml | 7 ++++ java/ql/lib/ext/io.javalin.http.model.yml | 25 ++++++++++++++ .../ext/org.apache.commons.dbutils.model.yml | 33 +++++++++++++++++++ java/ql/lib/ext/spark.model.yml | 27 +++++++++++++++ 5 files changed, 98 insertions(+) create mode 100644 java/ql/lib/change-notes/2026-06-22-various-mad-additions.md create mode 100644 java/ql/lib/ext/com.google.cloud.bigquery.model.yml create mode 100644 java/ql/lib/ext/io.javalin.http.model.yml create mode 100644 java/ql/lib/ext/org.apache.commons.dbutils.model.yml create mode 100644 java/ql/lib/ext/spark.model.yml diff --git a/java/ql/lib/change-notes/2026-06-22-various-mad-additions.md b/java/ql/lib/change-notes/2026-06-22-various-mad-additions.md new file mode 100644 index 000000000000..726102dc66f7 --- /dev/null +++ b/java/ql/lib/change-notes/2026-06-22-various-mad-additions.md @@ -0,0 +1,6 @@ +--- +category: majorAnalysis +--- +* Added sink model for `sql-injection` for: `com.google.cloud.bigquery` and `org.apache.commons.dbutils`. +* Added a source model for: `spark` and `io.javalin.http`. +* Added a taint summary model for: `spark`. \ No newline at end of file diff --git a/java/ql/lib/ext/com.google.cloud.bigquery.model.yml b/java/ql/lib/ext/com.google.cloud.bigquery.model.yml new file mode 100644 index 000000000000..276a59e176f3 --- /dev/null +++ b/java/ql/lib/ext/com.google.cloud.bigquery.model.yml @@ -0,0 +1,7 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["com.google.cloud.bigquery", "QueryJobConfiguration", true, "newBuilder", "", "", "Argument[0]", "sql-injection", "manual"] + diff --git a/java/ql/lib/ext/io.javalin.http.model.yml b/java/ql/lib/ext/io.javalin.http.model.yml new file mode 100644 index 000000000000..1b5d5495201d --- /dev/null +++ b/java/ql/lib/ext/io.javalin.http.model.yml @@ -0,0 +1,25 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["io.javalin.http", "Context", true, "basicAuthCredentials", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "body", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "bodyAsClass", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "cookie", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "header", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "formParam", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "formParams", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "formParamMap", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "formParamAsClass", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "formParamsAsClass", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "pathParam", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "pathParamAsClass", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "pathParamMap", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "queryParam", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "queryParams", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "queryParamAsClass", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "queryParamsAsClass", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "queryParamMap", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "queryString", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "sessionAttribute", "", "", "ReturnValue", "remote", "manual"] diff --git a/java/ql/lib/ext/org.apache.commons.dbutils.model.yml b/java/ql/lib/ext/org.apache.commons.dbutils.model.yml new file mode 100644 index 000000000000..4b95bda7d8c0 --- /dev/null +++ b/java/ql/lib/ext/org.apache.commons.dbutils.model.yml @@ -0,0 +1,33 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "insert", "(Connection,String,ResultSetHandler)", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "insert", "(Connection,String,ResultSetHandler,Object[])", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "insert", "(String,ResultSetHandler)", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "insert", "(String,ResultSetHandler,Object[])", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "query", "(Connection,String,ResultSetHandler)", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "query", "(Connection,String,ResultSetHandler,Object[])", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "query", "(String,ResultSetHandler)", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "query", "(String,ResultSetHandler,Object[])", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "update", "(Connection,String)", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "update", "(Connection,String,Object[])", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "update", "(Connection,String,Object)", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "update", "(String)", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "update", "(String,Object[])", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "AsyncQueryRunner", true, "update", "(String,Object)", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "insert", "(Connection,String,ResultSetHandler)", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "insert", "(Connection,String,ResultSetHandler,Object[])", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "insert", "(String,ResultSetHandler)", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "insert", "(String,ResultSetHandler,Object[])", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "query", "(Connection,String,ResultSetHandler)", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "query", "(Connection,String,ResultSetHandler,Object[])", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "query", "(String,ResultSetHandler)", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "query", "(String,ResultSetHandler,Object[])", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "update", "(Connection,String)", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "update", "(Connection,String,Object[])", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "update", "(Connection,String,Object)", "", "Argument[1]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "update", "(String)", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "update", "(String,Object[])", "", "Argument[0]", "sql-injection", "manual"] + - ["org.apache.commons.dbutils", "QueryRunner", true, "update", "(String,Object)", "", "Argument[0]", "sql-injection", "manual"] \ No newline at end of file diff --git a/java/ql/lib/ext/spark.model.yml b/java/ql/lib/ext/spark.model.yml new file mode 100644 index 000000000000..d015162e256b --- /dev/null +++ b/java/ql/lib/ext/spark.model.yml @@ -0,0 +1,27 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["spark", "Request", true, "body", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "bodyAsBytes", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "cookie", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "cookies", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "headers", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "params", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "queryMap", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "queryParams", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "queryParamsSafe", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "queryParamOrDefault", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "queryParamsValues", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "queryString", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "uri", "", "", "ReturnValue", "remote", "manual"] + - ["spark", "Request", true, "url", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["spark", "QueryParamsMap", True, "get", "", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["spark", "QueryParamsMap", True, "toMap", "", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["spark", "QueryParamsMap", True, "value", "", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["spark", "QueryParamsMap", True, "values", "", "", "Argument[0]", "Argument[this]", "taint", "manual"] \ No newline at end of file From 55ede0a1d51c7bf799998f0e774be030334fe7bc Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Tue, 23 Jun 2026 10:18:34 -0400 Subject: [PATCH 2/7] Fix spark taint preserve model --- java/ql/lib/ext/spark.model.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/java/ql/lib/ext/spark.model.yml b/java/ql/lib/ext/spark.model.yml index d015162e256b..602f0c8e2197 100644 --- a/java/ql/lib/ext/spark.model.yml +++ b/java/ql/lib/ext/spark.model.yml @@ -21,7 +21,7 @@ extensions: pack: codeql/java-all extensible: summaryModel data: - - ["spark", "QueryParamsMap", True, "get", "", "", "Argument[0]", "Argument[this]", "taint", "manual"] - - ["spark", "QueryParamsMap", True, "toMap", "", "", "Argument[0]", "Argument[this]", "taint", "manual"] - - ["spark", "QueryParamsMap", True, "value", "", "", "Argument[0]", "Argument[this]", "taint", "manual"] - - ["spark", "QueryParamsMap", True, "values", "", "", "Argument[0]", "Argument[this]", "taint", "manual"] \ No newline at end of file + - ["spark", "QueryParamsMap", True, "get", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["spark", "QueryParamsMap", True, "toMap", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["spark", "QueryParamsMap", True, "value", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["spark", "QueryParamsMap", True, "values", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] \ No newline at end of file From 90054f99da9242d0c30b74a9d487338ff3421057 Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Tue, 30 Jun 2026 11:22:18 -0400 Subject: [PATCH 3/7] Update java/ql/lib/ext/com.google.cloud.bigquery.model.yml Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com> --- java/ql/lib/ext/com.google.cloud.bigquery.model.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/java/ql/lib/ext/com.google.cloud.bigquery.model.yml b/java/ql/lib/ext/com.google.cloud.bigquery.model.yml index 276a59e176f3..f14efa17fa37 100644 --- a/java/ql/lib/ext/com.google.cloud.bigquery.model.yml +++ b/java/ql/lib/ext/com.google.cloud.bigquery.model.yml @@ -4,4 +4,6 @@ extensions: extensible: sinkModel data: - ["com.google.cloud.bigquery", "QueryJobConfiguration", true, "newBuilder", "", "", "Argument[0]", "sql-injection", "manual"] + - ["com.google.cloud.bigquery", "QueryJobConfiguration", true, "of", "", "", "Argument[0]", "sql-injection", "manual"] + - ["com.google.cloud.bigquery", "QueryJobConfiguration$Builder", true, "setQuery", "", "", "Argument[0]", "sql-injection", "manual"] From 5ef164fd6997fa0f5a6e1ad5f98504e9fb3bf4ce Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Fri, 28 Aug 2026 09:51:31 -0400 Subject: [PATCH 4/7] Update java/ql/lib/ext/io.javalin.http.model.yml Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com> --- java/ql/lib/ext/io.javalin.http.model.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/java/ql/lib/ext/io.javalin.http.model.yml b/java/ql/lib/ext/io.javalin.http.model.yml index 1b5d5495201d..5e328602534f 100644 --- a/java/ql/lib/ext/io.javalin.http.model.yml +++ b/java/ql/lib/ext/io.javalin.http.model.yml @@ -22,4 +22,3 @@ extensions: - ["io.javalin.http", "Context", true, "queryParamsAsClass", "", "", "ReturnValue", "remote", "manual"] - ["io.javalin.http", "Context", true, "queryParamMap", "", "", "ReturnValue", "remote", "manual"] - ["io.javalin.http", "Context", true, "queryString", "", "", "ReturnValue", "remote", "manual"] - - ["io.javalin.http", "Context", true, "sessionAttribute", "", "", "ReturnValue", "remote", "manual"] From d72fa0aa10c75b25732c629ab967a22eac3ede7b Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Fri, 28 Aug 2026 12:06:39 -0400 Subject: [PATCH 5/7] Address review comments - add extra io.javalin.http sources --- java/ql/lib/ext/io.javalin.http.model.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/java/ql/lib/ext/io.javalin.http.model.yml b/java/ql/lib/ext/io.javalin.http.model.yml index 5e328602534f..2cd0acd19489 100644 --- a/java/ql/lib/ext/io.javalin.http.model.yml +++ b/java/ql/lib/ext/io.javalin.http.model.yml @@ -5,9 +5,14 @@ extensions: data: - ["io.javalin.http", "Context", true, "basicAuthCredentials", "", "", "ReturnValue", "remote", "manual"] - ["io.javalin.http", "Context", true, "body", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "bodyAsBytes", "", "", "ReturnValue", "remote", "manual"] - ["io.javalin.http", "Context", true, "bodyAsClass", "", "", "ReturnValue", "remote", "manual"] - - ["io.javalin.http", "Context", true, "cookie", "", "", "ReturnValue", "remote", "manual"] - - ["io.javalin.http", "Context", true, "header", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "bodyInputStream", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "bodyStreamAsClass", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "cookie", "(String)", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "cookieMap", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "header", "(String)", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "headerMap", "", "", "ReturnValue", "remote", "manual"] - ["io.javalin.http", "Context", true, "formParam", "", "", "ReturnValue", "remote", "manual"] - ["io.javalin.http", "Context", true, "formParams", "", "", "ReturnValue", "remote", "manual"] - ["io.javalin.http", "Context", true, "formParamMap", "", "", "ReturnValue", "remote", "manual"] From d6f1e3395d9b9ddc0321b2a51c24c85360bf74b7 Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Fri, 28 Aug 2026 12:15:55 -0400 Subject: [PATCH 6/7] Add summary models in io.javalin.security and io.javalin.validation --- java/ql/lib/ext/io.javalin.security.model.yml | 7 +++++++ java/ql/lib/ext/io.javalin.validation.model.yml | 9 +++++++++ 2 files changed, 16 insertions(+) create mode 100644 java/ql/lib/ext/io.javalin.security.model.yml create mode 100644 java/ql/lib/ext/io.javalin.validation.model.yml diff --git a/java/ql/lib/ext/io.javalin.security.model.yml b/java/ql/lib/ext/io.javalin.security.model.yml new file mode 100644 index 000000000000..b5145814ae20 --- /dev/null +++ b/java/ql/lib/ext/io.javalin.security.model.yml @@ -0,0 +1,7 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["io.javalin.security", "BasicAuthCredentials", True, "getPassword", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.javalin.security", "BasicAuthCredentials", True, "getUsername", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] \ No newline at end of file diff --git a/java/ql/lib/ext/io.javalin.validation.model.yml b/java/ql/lib/ext/io.javalin.validation.model.yml new file mode 100644 index 000000000000..120b3573c364 --- /dev/null +++ b/java/ql/lib/ext/io.javalin.validation.model.yml @@ -0,0 +1,9 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["io.javalin.validation", "Validator", True, "get", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.javalin.validation", "Validator", True, "getOrDefault", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.javalin.validation", "Validator", True, "getOrNull", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.javalin.validation", "Validator", True, "getOrThrow", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] \ No newline at end of file From 7d7b95d19718ce8fcf6a7265fe693a2d01fda130 Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Fri, 28 Aug 2026 15:04:48 -0400 Subject: [PATCH 7/7] Add extra models suggested to io.javalin.http.model.yml --- java/ql/lib/ext/io.javalin.http.model.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/java/ql/lib/ext/io.javalin.http.model.yml b/java/ql/lib/ext/io.javalin.http.model.yml index 2cd0acd19489..2d827072010f 100644 --- a/java/ql/lib/ext/io.javalin.http.model.yml +++ b/java/ql/lib/ext/io.javalin.http.model.yml @@ -27,3 +27,18 @@ extensions: - ["io.javalin.http", "Context", true, "queryParamsAsClass", "", "", "ReturnValue", "remote", "manual"] - ["io.javalin.http", "Context", true, "queryParamMap", "", "", "ReturnValue", "remote", "manual"] - ["io.javalin.http", "Context", true, "queryString", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "uploadedFile", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "uploadedFiles", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "uploadedFileMap", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "url", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "fullUrl", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "contentType", "", "", "ReturnValue", "remote", "manual"] + - ["io.javalin.http", "Context", true, "userAgent", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["io.javalin.http", "UploadedFile", True, "content", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.javalin.http", "UploadedFile", True, "contentType", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.javalin.http", "UploadedFile", True, "extension", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.javalin.http", "UploadedFile", True, "filename", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] \ No newline at end of file