{"action":"created","issue":{"url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/76","labels_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/76/labels{/name}","comments_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/76/comments","events_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/76/events","html_url":"https://github.com/h3xstream/find-sec-bugs/issues/76","id":103978216,"number":76,"title":"EntityManager createQuery trips SECSQLIJPA even with safe usage","user":{"login":"ThrawnCA","id":3080440,"avatar_url":"https://avatars.githubusercontent.com/u/3080440?v=3","gravatar_id":"","url":"https://api.github.com/users/ThrawnCA","html_url":"https://github.com/ThrawnCA","followers_url":"https://api.github.com/users/ThrawnCA/followers","following_url":"https://api.github.com/users/ThrawnCA/following{/other_user}","gists_url":"https://api.github.com/users/ThrawnCA/gists{/gist_id}","starred_url":"https://api.github.com/users/ThrawnCA/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThrawnCA/subscriptions","organizations_url":"https://api.github.com/users/ThrawnCA/orgs","repos_url":"https://api.github.com/users/ThrawnCA/repos","events_url":"https://api.github.com/users/ThrawnCA/events{/privacy}","received_events_url":"https://api.github.com/users/ThrawnCA/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/h3xstream/find-sec-bugs/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"h3xstream","id":593130,"avatar_url":"https://avatars.githubusercontent.com/u/593130?v=3","gravatar_id":"","url":"https://api.github.com/users/h3xstream","html_url":"https://github.com/h3xstream","followers_url":"https://api.github.com/users/h3xstream/followers","following_url":"https://api.github.com/users/h3xstream/following{/other_user}","gists_url":"https://api.github.com/users/h3xstream/gists{/gist_id}","starred_url":"https://api.github.com/users/h3xstream/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h3xstream/subscriptions","organizations_url":"https://api.github.com/users/h3xstream/orgs","repos_url":"https://api.github.com/users/h3xstream/repos","events_url":"https://api.github.com/users/h3xstream/events{/privacy}","received_events_url":"https://api.github.com/users/h3xstream/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/h3xstream/find-sec-bugs/milestones/6","html_url":"https://github.com/h3xstream/find-sec-bugs/milestones/version-1.4.3","labels_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/milestones/6/labels","id":1261481,"number":6,"title":"version-1.4.3","description":"","creator":{"login":"h3xstream","id":593130,"avatar_url":"https://avatars.githubusercontent.com/u/593130?v=3","gravatar_id":"","url":"https://api.github.com/users/h3xstream","html_url":"https://github.com/h3xstream","followers_url":"https://api.github.com/users/h3xstream/followers","following_url":"https://api.github.com/users/h3xstream/following{/other_user}","gists_url":"https://api.github.com/users/h3xstream/gists{/gist_id}","starred_url":"https://api.github.com/users/h3xstream/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h3xstream/subscriptions","organizations_url":"https://api.github.com/users/h3xstream/orgs","repos_url":"https://api.github.com/users/h3xstream/repos","events_url":"https://api.github.com/users/h3xstream/events{/privacy}","received_events_url":"https://api.github.com/users/h3xstream/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":2,"state":"open","created_at":"2015-08-18T21:44:24Z","updated_at":"2015-08-31T06:19:33Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2015-08-31T03:20:11Z","updated_at":"2015-09-01T03:57:39Z","closed_at":null,"body":"Using the ``createQuery`` and ``createNativeQuery`` methods of a JPA EntityManager trips the SECSQLIJPA detector even if there are no tainted inputs.\r\n\r\nThis class trips the detector for me:\r\n\r\n    package findbugs.sample;\r\n\r\n    import javax.persistence.EntityManager;\r\n    import javax.persistence.PersistenceContext;\r\n    import javax.persistence.Query;\r\n\r\n    public class TestInjectionWithConstantString {\r\n\r\n        @PersistenceContext\r\n        private EntityManager entityManager;\r\n\r\n        public void queryWithConstantString() {\r\n            entityManager.createQuery(\"foo\");\r\n            entityManager.createNativeQuery(\"foo\");\r\n        }\r\n\r\n    }\r\n"},"comment":{"url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/comments/136570869","html_url":"https://github.com/h3xstream/find-sec-bugs/issues/76#issuecomment-136570869","issue_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/76","id":136570869,"user":{"login":"ThrawnCA","id":3080440,"avatar_url":"https://avatars.githubusercontent.com/u/3080440?v=3","gravatar_id":"","url":"https://api.github.com/users/ThrawnCA","html_url":"https://github.com/ThrawnCA","followers_url":"https://api.github.com/users/ThrawnCA/followers","following_url":"https://api.github.com/users/ThrawnCA/following{/other_user}","gists_url":"https://api.github.com/users/ThrawnCA/gists{/gist_id}","starred_url":"https://api.github.com/users/ThrawnCA/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThrawnCA/subscriptions","organizations_url":"https://api.github.com/users/ThrawnCA/orgs","repos_url":"https://api.github.com/users/ThrawnCA/repos","events_url":"https://api.github.com/users/ThrawnCA/events{/privacy}","received_events_url":"https://api.github.com/users/ThrawnCA/received_events","type":"User","site_admin":false},"created_at":"2015-09-01T03:57:39Z","updated_at":"2015-09-01T03:57:39Z","body":"@formanek My use case is that I enforce FindBugs checks in our Maven builds, starting with default priority and increasing sensitivity as I fix the bugs. I'm not all that interested in reporting, which people tend not to see up front, or the FindBugs GUI, which is nice when going through and fixing a stack of bugs, but otherwise not a part of our builds. Any time a detector fires, the build fails.\r\n\r\nI can (and do) deal with false positives using an exclusion file, but I prefer to do that only if we really are doing something the detector prohibits."}}