Java: Add mybatis mapper.xml sql tainted detection

[Sharyie]

Description:
I wrote ql to support sql injection dection in mybatis mapper.xml.

problem to resolve:

1. mapper.xml sqlStatement could include other XMLElement,like this:

<sql id="BaseColumnList">
    id, username, age
</sql>
<sql id="Condition">
    where username = ${username}
</sql>

<select id="getUserByUsername" parameterType="java.lang.String" resultMap="BaseResultMap">
    select
    <include refid="BaseColumnList"></include>
    from userentity
    where username = ${username}
</select>

<select id="getUserByUsernameInclude" parameterType="java.lang.String" resultMap="BaseResultMap">
    select
    <include refid="BaseColumnList"></include>
    from userentity
    <include refid="Condition">
        <property name="username" value="'tom'"/>
    </include>
</select>

this ql committed didn't check sql query string in included element, I will fix it later.

2. My sink is function in mapper class, so 2 codeflows will been found evey sql injection param. I have no idea and hope someone make it please.

[smowton]

Are you intending to apply to the bounty program for this submission?

[Sharyie]

Are you intending to apply to the bounty program for this submission?

Yes, thanks for invitation.

[smowton]

OK, in that case review will start with the security lab once you've applied for the programme.

[smowton]

To do this you should follow the instructions at https://securitylab.github.com/bounties/ (section "All for one, one for all"). Note in particular the condition:

To be considered, your query must find at least one CVE that was not previously found by an existing query, in a released version (older releases are also permitted) of an open source project that is actually used (no demo, training, vulnerable on purpose).

[Sharyie]

To do this you should follow the instructions at https://securitylab.github.com/bounties/ (section "All for one, one for all"). Note in particular the condition:

To be considered, your query must find at least one CVE that was not previously found by an existing query, in a released version (older releases are also permitted) of an open source project that is actually used (no demo, training, vulnerable on purpose).

Thanks, I'm trying.

[greatyy]

Hello, how could I include my mapper.xml to database? when I run codeql database create -l java <database>, xml file will not be included in database folder

[greatyy]

Hello, how could I include my mapper.xml to database? when I run codeql database create -l java <database>, xml file will not be included in database folder

problem solved here. #3887