java-sql-injection-mining
Read-only mining codemod for SonarSource rule javasecurity:S3649 — Database queries should not be vulnerable to injection attacks.
It scans Java source and emits metrics only; it never modifies code (return null).
Findings are high-signal review candidates surfaced by AST pattern matching — they are
not proven vulnerabilities. A static mining pass cannot prove an end-to-end taint flow
from an untrusted source to the sink, so confirm data flow before remediating.
| Field | Value |
|---|---|
| Rule key | javasecurity:S3649 |
| Type | Vulnerability |
| Severity | Blocker |
| Primary CWE | CWE-89 (SQL Injection) |
| Tags | android, cwe, sql |
What it detects
JDBC/JPA query sinks whose SQL argument is built from dynamic (non-literal) data.
Sinks:
Statement.executeQuery / execute / executeUpdate / executeLargeUpdate / addBatchConnection.prepareStatement / prepareCallEntityManager.createQuery / createNativeQuery, HibernatecreateSQLQuery
Emission rule: Only emits when the query argument is not a constant string literal (e.g. concatenation, variable, or method call). Parameterized queries using ? placeholders with literal SQL are skipped.
Metric: java-sql-injection-mining
| dimension | meaning |
|---|---|
rule | SonarSource rule key |
cwe | primary CWE identifier |
severity | always blocker |
sink | the detected sink (method/constructor) |
package_name | enclosing Java package |
class_name | enclosing class/interface/enum/record |
method_name | enclosing method/constructor (or <none>) |
file | file path (relative to scan target) |
line | 1-based line of the finding |
arg_kind | classification of the relevant argument (literal, concatenation, variable, method_call, field, object_creation, expression, none) |
Security standards
- CWE-20 (Improper Input Validation)
- CWE-89 (SQL Injection)
- OWASP ASVS 4.0: 5.1.3, 5.1.4, 5.3.4, 5.3.5
- OWASP Mobile Top 10 2024: M4
- OWASP Top 10 2021: A3
- OWASP Top 10: A1
- PCI DSS 3.2: 6.5.1
- PCI DSS 4.0: 6.2.4
- STIG ASD V5R3: V-222607, V-222609
Run locally
Part of the java-security-blocker-mining suite covering 19 blocker-severity
Java vulnerability rules. Each codemod is read-only and emits a single named metric.