{
  "sinks": [
    {
      "method": "createNativeQuery",
      "class": "EntityManager",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [
        0
      ]
    },
    {
      "method": "createQuery",
      "class": "EntityManager",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "high",
      "arg_positions": [
        0
      ],
      "note": "HQL injection if string concat used"
    },
    {
      "method": "executeQuery",
      "class": "Statement",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [
        0
      ]
    },
    {
      "method": "execute",
      "class": "Statement",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [
        0
      ]
    },
    {
      "method": "executeUpdate",
      "class": "Statement",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [
        0
      ]
    },
    {
      "method": "addBatch",
      "class": "Statement",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [
        0
      ]
    },
    {
      "method": "query",
      "class": "JdbcTemplate",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [0],
      "safe_if_string_literal_at": 0,
      "note": "Parameterised SQL literal with ? placeholders is bound by the driver; only non-literal SQL (variable / concat / format) taints. Added 3.153.0 (#233)."
    },
    {
      "method": "queryForObject",
      "class": "JdbcTemplate",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [0],
      "safe_if_string_literal_at": 0,
      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
    },
    {
      "method": "queryForList",
      "class": "JdbcTemplate",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [0],
      "safe_if_string_literal_at": 0,
      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
    },
    {
      "method": "update",
      "class": "JdbcTemplate",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [0],
      "safe_if_string_literal_at": 0,
      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
    },
    {
      "method": "execute",
      "class": "JdbcTemplate",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [0],
      "safe_if_string_literal_at": 0,
      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
    },
    {
      "method": "queryForRowSet",
      "class": "JdbcTemplate",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [0],
      "safe_if_string_literal_at": 0,
      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
    },
    {
      "method": "queryForMap",
      "class": "JdbcTemplate",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [0],
      "safe_if_string_literal_at": 0,
      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
    },
    {
      "method": "batchUpdate",
      "class": "JdbcTemplate",
      "type": "sql_injection",
      "cwe": "CWE-89",
      "severity": "critical",
      "arg_positions": [0],
      "safe_if_string_literal_at": 0,
      "note": "Parameterised SQL literal — see JdbcTemplate.query. Added 3.153.0 (#233)."
    },
    {
      "method": "insert",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
    },
    {
      "method": "insertSelective",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
    },
    {
      "method": "update",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
    },
    {
      "method": "updateByPrimaryKey",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
    },
    {
      "method": "updateByPrimaryKeySelective",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted fields in entity may be interpolated via ${} syntax"
    },
    {
      "method": "delete",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
    },
    {
      "method": "deleteByPrimaryKey",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
    },
    {
      "method": "selectOne",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
    },
    {
      "method": "selectList",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
    },
    {
      "method": "selectByPrimaryKey",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted parameter may be interpolated via ${} syntax"
    },
    {
      "method": "selectByExample",
      "class": "*Mapper",
      "type": "mybatis_mapper_call",
      "cwe": "CWE-89",
      "severity": "medium",
      "arg_positions": [0],
      "note": "MyBatis ORM - tainted fields in example criteria may be interpolated via ${} syntax"
    }
  ],
  "sanitizers": [
    {
      "method": "prepareStatement",
      "class": "Connection",
      "removes": [
        "sql_injection"
      ],
      "note": "Safe if parameters are bound with setX methods"
    },
    {
      "method": "setParameter",
      "class": "Query",
      "removes": [
        "sql_injection"
      ]
    },
    {
      "annotation": "@Param",
      "removes": [
        "sql_injection"
      ]
    },
    {
      "method": "parseInt",
      "class": "Integer",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"],
      "note": "Java numeric cast — output cannot carry string injection"
    },
    {
      "method": "parseLong",
      "class": "Long",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"]
    },
    {
      "method": "parseDouble",
      "class": "Double",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"]
    },
    {
      "method": "parseFloat",
      "class": "Float",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"]
    },
    {
      "method": "parseShort",
      "class": "Short",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"]
    },
    {
      "method": "parseByte",
      "class": "Byte",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"]
    },
    {
      "method": "valueOf",
      "class": "Integer",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"]
    },
    {
      "method": "valueOf",
      "class": "Long",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"]
    },
    {
      "method": "fromString",
      "class": "UUID",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"],
      "note": "UUID.fromString throws on non-UUID input — output is a typed UUID"
    },
    {
      "method": "valueOf",
      "class": "Enum",
      "removes": ["sql_injection", "command_injection", "path_traversal", "code_injection"],
      "note": "Enum.valueOf throws on unknown name — output is a typed enum"
    }
  ]
}