Description

Detects potential SQL injection vulnerabilities in Kotlin code where user-controlled input could be concatenated or interpolated into SQL queries without proper sanitization. This can allow attackers to manipulate SQL statements and potentially access, modify or delete unauthorized data from the database.

Detection Strategy

• Identifies calls to SQL execution methods like executeQuery(), rawQuery() or similar database query functions

• Examines the first argument of these SQL methods to check if it contains string concatenation or variable interpolation

• Analyzes if query strings incorporate user-controlled input through concatenation operators (+) or string templates (${var})

• Reports a vulnerability when SQL queries are built using unsafe string operations with potentially tainted input

Vulnerable code example

import java.sql.Connection

fun getUserById(dbConnection: Connection, userId: String) {
    // VULNERABLE: Direct string concatenation of user input in SQL query
    val sql = "SELECT * FROM users WHERE id = '$userId'" // User input directly in query
    val statement = dbConnection.createStatement()
    statement.executeQuery(sql)  // SQL injection possible with input like: ' OR '1'='1
}

✅ Secure code example

import java.sql.Connection

fun getUserById(dbConnection: Connection, userId: String) {
    // SECURE: Using PreparedStatement with parameterized query
    val sql = "SELECT * FROM users WHERE id = ?"
    val preparedStatement = dbConnection.prepareStatement(sql)
    preparedStatement.setString(1, userId)  // User input safely bound as parameter
    preparedStatement.executeQuery()...