SQL injection in OrderRepository.findByCustomer

// OrderRepository.java — Fortify dataflow trace Source: HttpServletRequest.getParameter("customerId") // line 84 ↓ Pass through: String customerId // line 85 ↓ Sink: jdbc.queryForList(sql + customerId) // line 87 // Vulnerable path: 3 steps · no sanitization detected

public List<Order> findByCustomer(String customerId) { - return jdbcTemplate.queryForList( - "SELECT * FROM orders WHERE customer_id = " + customerId); + return jdbcTemplate.queryForList( + "SELECT * FROM orders WHERE customer_id = ?", customerId); }

$ mvn test -Dtest=SqlInjectionRegressionTest [INFO] Running SqlInjectionRegressionTest [INFO] ✓ rejects_classic_or_injection (53ms) [INFO] ✓ rejects_drop_table_attempt (41ms) [INFO] ✓ rejects_union_select_exfiltration (62ms) [INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0 [INFO] BUILD SUCCESS — total tests: 47/47 passing

[09:14:22] $ git clone git@gitlab:order-service.git [09:14:48] $ cd order-service && git checkout -b fix/SEC-1745 [09:15:12] $ grep -n "queryForList" src/main/java/.../OrderRepository.java 87: return jdbcTemplate.queryForList( [09:16:03] $ apply playbook: spring-sql-injection@2.3 [09:16:21] ✓ replaced concatenation with ? placeholder [09:16:42] ✓ generated regression test from template [09:17:21] $ mvn test -q [09:18:35] ✓ BUILD SUCCESS · 47/47 tests pass [09:18:48] $ git commit -S -am "fix(security): parameterize..." [09:18:52] $ git push -u origin fix/SEC-1745 [09:18:58] → opened MR !8442

Reasoning: The finding is a textbook CWE-89 with a clear taint flow from HttpServletRequest.getParameter to jdbcTemplate.queryForList via string concatenation. The codebase is Spring Boot with JDBC Template usage (not raw JDBC, not JPA), which exactly matches the spring-sql-injection@2.3 playbook scope. No similar pattern exists in nearby files, so this is an isolated fix (not a cross-cutting refactor). The playbook has been applied 47 times with 98% success — confidence to proceed.