github
diff --git a/‎java/ql/lib/ext/io.r2dbc.spi.model.yml‎
Lines changed: 4 additions & 0 deletions b/‎java/ql/lib/ext/io.r2dbc.spi.model.yml‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎java/ql/test/query-tests/security/CWE-089/semmle/examples/SpringJdbc.java‎
Lines changed: 5 additions & 0 deletions b/‎java/ql/test/query-tests/security/CWE-089/semmle/examples/SpringJdbc.java‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Connection.java‎
Lines changed: 6 additions & 0 deletions b/‎java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Connection.java‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Statement.java‎
Lines changed: 1 addition & 0 deletions b/‎java/ql/test/query-tests/security/CWE-089/semmle/examples/io/r2dbc/spi/Statement.java‎
Lines changed: 1 addition & 0 deletions
@@ -5,3 +5,7 @@ extensions:
     data:
       - ["io.r2dbc.spi", "Connection", True, "createStatement", "(String)", "", "Argument[0]", "sql-injection", "manual"]
       - ["io.r2dbc.spi", "Batch", True, "add", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Connection", True, "createSavepoint", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Connection", True, "releaseSavepoint", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Connection", True, "rollbackTransactionToSavepoint", "(String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["io.r2dbc.spi", "Statement", True, "returnGeneratedValues", "(String[])", "", "Argument[0]", "sql-injection", "manual"]
@@ -106,6 +106,11 @@ public static void testR2dbc(DatabaseClient client, Connection connection, Batch
         .fetch();
     connection.createStatement(source()); // $ sqlInjection
     batch.add(source()); // $ sqlInjection
+    connection.createSavepoint(source()); // $ sqlInjection
+    connection.releaseSavepoint(source()); // $ sqlInjection
+    connection.rollbackTransactionToSavepoint(source()); // $ sqlInjection
+    connection.createStatement("INSERT INTO test VALUES (1)")
+        .returnGeneratedValues(source()); // $ sqlInjection
   }
 
 }
@@ -2,4 +2,10 @@
 
 public interface Connection {
   Statement createStatement(String sql);
+
+  void createSavepoint(String name);
+
+  void releaseSavepoint(String name);
+
+  void rollbackTransactionToSavepoint(String name);
 }
@@ -1,4 +1,5 @@
 package io.r2dbc.spi;
 
 public interface Statement {
+  Statement returnGeneratedValues(String... columns);
 }
Original file line number	Diff line number	Diff line change
`@@ -106,6 +106,11 @@ public static void testR2dbc(DatabaseClient client, Connection connection, Batch`
`106`	`106`	`.fetch();`
`107`	`107`	`connection.createStatement(source()); // $ sqlInjection`
`108`	`108`	`batch.add(source()); // $ sqlInjection`
	`109`	`+ connection.createSavepoint(source()); // $ sqlInjection`
	`110`	`+ connection.releaseSavepoint(source()); // $ sqlInjection`
	`111`	`+ connection.rollbackTransactionToSavepoint(source()); // $ sqlInjection`
	`112`	`+ connection.createStatement("INSERT INTO test VALUES (1)")`
	`113`	`+ .returnGeneratedValues(source()); // $ sqlInjection`
`109`	`114`	`}`
`110`	`115`
`111`	`116`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`package io.r2dbc.spi;`
`2`	`2`
`3`	`3`	`public interface Statement {`
	`4`	`+ Statement returnGeneratedValues(String... columns);`
`4`	`5`	`}`