ShiftQL Rule

Write your security rule

metadata:
  id: "SQL_INJECTION_TEST"
  name: "SQL Injection Test"
  description: "Detects SQL injection vulnerabilities"
  language: ["java"]
  severity: "critical"
  type: "taint"
  category: "security"
query:
  rule-sources:
    pattern: request.getParameter($SOURCE)
  
  rule-sinks:
    pattern: $$$.executeQuery($SINK)
actions:
  - report:
      message: Potential SQL injection detected 

Code Analysis

0 findings detected

public class UserController {
    private Connection conn;
    public void processUser(HttpServletRequest request) {
        String userId = request.getParameter("id"); // Source
        String query = "SELECT * FROM users WHERE id = " + userId; // Flow
        Statement stmt = conn.createStatement();
        ResultSet rs = stmt.executeQuery(query); // Sink
    }
}

Analysis Results

0 findings detected

CodeThreat ShiftQL Playground

Static analyzer with taint flow analysis