False SQL injection alarms

SonarQube Server / Community Build
1

I am getting the message “Change this code to not construct SQL queries directly from user-controlled data” from SonarQube even though prepared statements with parameterization are used.

In the image supplied, the Update class implements the PreparedStatementCreator interface supported by Spring JdbcTemplate. It uses parameter markers (mapped to question marks in the SQL) for all supplied variables. So it is not vulnerable to SQL injection.

Why does this message appear - is this a bug in SonarQube? Or is it simply by design not capable of performing a deep enough analysis to avoid a false alarm in this case?

This is SonarQube version 10.8.1.101195.

image
image2560×1392 303 KB

2

Hey there.

I’ve moved your post to the section on reporting false-positives.

Take a look at this post:

  • There’s some stuff missing from your report, like a text-based code sample
  • Please also make sure this can be reproduced using a supported version of SonarQube (v2025.1 LTA or v2025.3).
3

Thanks for your swift reply.

I was not aware the SonarQube version my company is using is unsupported.
Unfortunately, these upgrades are handled by someone else, and I am unable to verify that this issue can be reproduced with a supported version.

Additionally, the time spent on creating a minimal code sample is likely higher than manually administering these issues to remove them from the report.

So I am not going to proceed further with this on this forum.