DatabaseClient.sql() (Spring R2DBC) not detected as SQL injection sink by S2077/S3649

Rules and Languages
1

Hi team,

I recently noticed that Spring R2DBC’s DatabaseClient.sql() is not recognized as a SQL injection sink by rules S2077 and S3649.

JdbcClient.sql() was added as a sink alongside other Spring sinks in SONARJAVA-4866 (April 2024), but the reactive counterpart was not included:

// NOT detected — R2DBC reactive client
client.sql(“SELECT * FROM users WHERE id = '” + userInput + “'”)

// IS detected — blocking JDBC client
jdbcTemplate.queryForObject(“SELECT * FROM users WHERE id = '” + userInput + “'”, String.class)

The only R2DBC-related sink currently covered is the internal StringBasedR2dbcQuery constructor (used by @Query annotations), not the DatabaseClient API that developers use directly for raw SQL.

This was previously raised in Implements SQL Injections rules for spring-data-r2dbc back in 2020, where a SonarSource engineer acknowledged the gap and mentioned a ticket would be created, but DatabaseClient.sql() was never added.

Spring R2DBC is widely adopted for reactive applications. Without this sink, projects using DatabaseClient for raw SQL have no SonarQube protection against SQL injection.

Is there any update on the status of this? Are there plans to add DatabaseClient.sql() as a recognized sink in an upcoming release?

Regards,

Ali

2

Hi Ali,

In fact, the ticket you’re referring to was resolved in 2021.

Could you give us a self-contained reproducer? Also, what’s your context for this? I.e. are you on SonarQube Cloud? SonarQube for IDE (flavor and version)? SonarQube self-managed (flavor and version)?

 
Thx,
Ann