Merge pull request #3671 from semgrep/kb/sqli-fmt-string-mvar-focus

fix(java): formatted-sql-string Java rule had incorrect mvar-focus

Author: kurt-r2c

java/lang/security/audit/formatted-sql-string.java

@@ -143,3 +143,13 @@ public List<Student> addWhere(String name, CriteriaQuery Query)
         return students;
     }
 }
+
+public class SqlExampleFocusMetavar {
+    public void get(HttpServletRequest req) {
+        Connection c = DB.getConnection();
+        String p = req.getParam("param");
+        PreparedStatement statement = c.prepareStatment("SELECT * FROM " + p);
+        // ruleid: formatted-sql-string
+        ResultSet rs = statement.executeQuery();
+    }
+}

java/lang/security/audit/formatted-sql-string.yaml

@@ -46,7 +46,7 @@ rules:
               ...
             }
         - pattern: (String $INPUT)
-    - focus-metavariable: $INPUT
+        - focus-metavariable: $INPUT
     label: INPUT
   - patterns:
     - pattern-either: