Java: model R2DBC SQL injection sinks

java/ql/lib/change-notes/2026-08-04-spring-r2dbc-sql-injection.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added SQL injection sink models for Spring R2DBC `DatabaseClient` and the R2DBC SPI.

java/ql/lib/ext/io.r2dbc.spi.model.yml

@@ -0,0 +1,7 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["io.r2dbc.spi", "Connection", True, "createStatement", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Batch", True, "add", "(String)", "", "Argument[0]", "sql-injection", "manual"]

java/ql/lib/ext/org.springframework.r2dbc.core.model.yml

@@ -0,0 +1,12 @@
+extensions:
+  - addsTo:
+      pack: codeql/java-all
+      extensible: sinkModel
+    data:
+      - ["org.springframework.r2dbc.core", "DatabaseClient", True, "sql", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["org.springframework.r2dbc.core", "DatabaseClient$GenericExecuteSpec", True, "fetch", "", "", "Argument[this]", "sql-injection", "manual"]
+  - addsTo:
+      pack: codeql/java-all
+      extensible: summaryModel
+    data:
+      - ["org.springframework.r2dbc.core", "DatabaseClient", True, "sql", "(java.util.function.Supplier)", "", "Argument[0].ReturnValue", "ReturnValue", "taint", "manual"]

java/ql/test/query-tests/security/CWE-089/semmle/examples/SpringJdbc.java

@@ -1,5 +1,8 @@
 import java.sql.ResultSet;
 import java.util.Map;
+import java.util.function.Supplier;
+import io.r2dbc.spi.Batch;
+import io.r2dbc.spi.Connection;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.core.namedparam.NamedParameterJdbcOperations;
 import org.springframework.jdbc.core.namedparam.SqlParameterSource;
@@ -13,6 +16,7 @@
 import org.springframework.jdbc.object.SqlFunction;
 import org.springframework.jdbc.object.SqlUpdate;
 import org.springframework.jdbc.object.UpdatableSqlQuery;
+import org.springframework.r2dbc.core.DatabaseClient;
 
 public class SpringJdbc {
 
@@ -80,4 +84,11 @@ public static void test(JdbcTemplate template, NamedParameterJdbcOperations name
     namedParamTemplate.update(source(), null, null, null); // $ sqlInjection
   }
 
+  public static void testR2dbc(DatabaseClient client, Connection connection, Batch batch) {
+    client.sql(source()); // $ sqlInjection
+    client.sql((Supplier<String>) SpringJdbc::source).fetch(); // $ sqlInjection
+    connection.createStatement(source()); // $ sqlInjection
+    batch.add(source()); // $ sqlInjection
+  }
+
 }

java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Batch.java

@@ -0,0 +1,5 @@
+package io.r2dbc.spi;
+
+public interface Batch {
+  Batch add(String sql);
+}

java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Connection.java

@@ -0,0 +1,5 @@
+package io.r2dbc.spi;
+
+public interface Connection {
+  Statement createStatement(String sql);
+}

java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Statement.java

@@ -0,0 +1,4 @@
+package io.r2dbc.spi;
+
+public interface Statement {
+}

java/ql/test/query-tests/security/CWE-089/semmle/examples/org/springframework/r2dbc/core/DatabaseClient.java

@@ -0,0 +1,13 @@
+package org.springframework.r2dbc.core;
+
+import java.util.function.Supplier;
+
+public interface DatabaseClient {
+  GenericExecuteSpec sql(String sql);
+
+  GenericExecuteSpec sql(Supplier<String> sqlSupplier);
+
+  interface GenericExecuteSpec {
+    Object fetch();
+  }
+}