Create 1.ql

.github/workflows/1.ql

@@ -0,0 +1,22 @@
+/**
+ * @name Untrusted data passed to external API
+ * @description Data provided remotely is used in this external API without sanitization, which could be a security risk.
+ * @id java/untrusted-data-to-external-api
+ * @kind path-problem
+ * @precision low
+ * @problem.severity error
+ * @security-severity 7.8
+ * @tags security external/cwe/cwe-20
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.security.ExternalAPIs
+import UntrustedDataToExternalApiFlow::PathGraph
+
+from UntrustedDataToExternalApiFlow::PathNode source, UntrustedDataToExternalApiFlow::PathNode sink
+where UntrustedDataToExternalApiFlow::flowPath(source, sink)
+select sink, source, sink,
+  "Call to " + sink.getNode().(ExternalApiDataNode).getMethodDescription() +
+    " with untrusted data from $@.", source, source.toString()