CodeQL WebGoat SQL注入

import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.dataflow.TaintTracking
class MyTaintTrackingConfiguration extends TaintTracking::Configuration {
    MyTaintTrackingConfiguration() {
        this = "MyTaintTrackingConfiguration"
    }
    override predicate isSource(DataFlow::Node source) {
        exists(source.asParameter())
    }
    override predicate isSink(DataFlow::Node sink) {
        exists(Call call |
            sink.asExpr() = call.getArgument(0) and
            call.getCallee().hasQualifiedName("java.sql", "Statement", "executeQuery")
        )
    }
}
from DataFlow::Node source, DataFlow::Node sink, TaintTracking::Configuration config
where config.hasFlow(source, sink)
select source, sink

优化RemoteFlowSource，增加对RequestParam标注的支持

class MySource extends DataFlow::Node {
    MySource() {
      exists(Annotation ann,AnnotationType anntp|
        this instanceof RemoteFlowSource or (
            anntp.hasQualifiedName("org.springframework.web.bind.annotation", "RequestParam") and
            ann.getType() = anntp and
            this.asParameter().getAnAnnotation() = ann
            )
      )
    }
}
class MyTaintTrackingConfiguration extends TaintTracking::Configuration {
    MyTaintTrackingConfiguration() {
        this = "MyTaintTrackingConfiguration"
    }
    override predicate isSource(DataFlow::Node source) {
        source instanceof MySource
    }
    override predicate isSink(DataFlow::Node sink) {
        exists(Call call |
            sink.asExpr() = call.getArgument(0) and
            call.getCallee().hasQualifiedName("java.sql", "Statement", "executeQuery")
        )
    }
}