Add additional Hibernate SQL sinks

lcartey · aibaars · commit bdcf4198e60b · 2020-08-07T14:03:24.000+02:00
diff --git a/java/ql/src/semmle/code/java/frameworks/Hibernate.qll b/java/ql/src/semmle/code/java/frameworks/Hibernate.qll
@@ -10,11 +10,11 @@ class HibernateSession extends RefType {
 }
 
 /**
- * Holds if `m` is a method on `HibernateSession` taking an SQL string as its
- * first argument.
+ * Holds if `m` is a method on `HibernateSession`, or a subclass, taking an SQL
+ * string as its first argument.
  */
 predicate hibernateSqlMethod(Method m) {
-  m.getDeclaringType() instanceof HibernateSession and
+  m.getDeclaringType().getASourceSupertype*() instanceof HibernateSession and
   m.getParameterType(0) instanceof TypeString and
   (
     m.hasName("createQuery") or

Original file line number	Diff line number	Diff line change
`@@ -10,11 +10,11 @@ class HibernateSession extends RefType {`
`10`	`10`	`}`
`11`	`11`
`12`	`12`	`/**`
`13`		- * Holds if `m` is a method on `HibernateSession` taking an SQL string as its
`14`		`- * first argument.`
	`13`	+ * Holds if `m` is a method on `HibernateSession`, or a subclass, taking an SQL
	`14`	`+ * string as its first argument.`
`15`	`15`	`*/`
`16`	`16`	`predicate hibernateSqlMethod(Method m) {`
`17`		`- m.getDeclaringType() instanceof HibernateSession and`
	`17`	`+ m.getDeclaringType().getASourceSupertype*() instanceof HibernateSession and`
`18`	`18`	`m.getParameterType(0) instanceof TypeString and`
`19`	`19`	`(`
`20`	`20`	`m.hasName("createQuery") or`