Java: SqlConcatenated

Author: d10c

java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll

@@ -25,16 +25,22 @@ module UncontrolledStringBuilderSourceFlowConfig implements DataFlow::ConfigSig
 
   predicate isBarrier(DataFlow::Node node) { node instanceof SimpleTypeSanitizer }
 
-  predicate observeDiffInformedIncrementalMode() {
-    any() // TODO: Make sure that the location overrides match the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 27 (/Users/d10c/src/semmle-code/ql/java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql@31:8:31:12), Column 3 does not select a source or sink originating from the flow call on line 27 (/Users/d10c/src/semmle-code/ql/java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql@31:80:31:91)
-  }
+  predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSourceLocation(DataFlow::Node source) {
-    none() // TODO: Make sure that this source location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 27 (/Users/d10c/src/semmle-code/ql/java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql@31:8:31:12), Column 3 does not select a source or sink originating from the flow call on line 27 (/Users/d10c/src/semmle-code/ql/java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql@31:80:31:91)
+    exists(Expr uncontrolled, StringBuilderVar sbv | result = uncontrolled.getLocation() |
+      uncontrolledStringBuilderQuery(sbv, uncontrolled) and
+      source = DataFlow::exprNode(sbv.getToStringCall())
+    )
   }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    none() // TODO: Make sure that this sink location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 27 (/Users/d10c/src/semmle-code/ql/java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql@31:8:31:12), Column 3 does not select a source or sink originating from the flow call on line 27 (/Users/d10c/src/semmle-code/ql/java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql@31:80:31:91)
+    exists(QueryInjectionSink query, Expr uncontrolled |
+      result = [query.getLocation(), uncontrolled.getLocation()] and
+      builtFromUncontrolledConcat(query.asExpr(), uncontrolled)
+    )
+    or
+    result = sink.getLocation()
   }
 }