Rust: Accept that sql-injection sinks are sinks for this query, and that the existing sinks created for this query are also new sql-injection sinks.

Author: geoffw0

rust/ql/lib/codeql/rust/frameworks/sqlx.model.yml

@@ -3,11 +3,11 @@ extensions:
       pack: codeql/rust-all
       extensible: sinkModel
     data:
-      - ["sqlx_core::query::query", "Argument[0]", "database-store", "manual"]
-      - ["sqlx_core::query_as::query_as", "Argument[0]", "database-store", "manual"]
-      - ["sqlx_core::query_with::query_with", "Argument[0]", "database-store", "manual"]
-      - ["sqlx_core::query_as_with::query_as_with", "Argument[0]", "database-store", "manual"]
-      - ["sqlx_core::query_scalar::query_scalar", "Argument[0]", "database-store", "manual"]
-      - ["sqlx_core::query_scalar_with::query_scalar_with", "Argument[0]", "database-store", "manual"]
-      - ["sqlx_core::raw_sql::raw_sql", "Argument[0]", "database-store", "manual"]
-      - ["<_ as sqlx_core::executor::Executor>::execute", "Argument[0]", "database-store", "manual"]
+      - ["sqlx_core::query::query", "Argument[0]", "sql-injection", "manual"]
+      - ["sqlx_core::query_as::query_as", "Argument[0]", "sql-injection", "manual"]
+      - ["sqlx_core::query_with::query_with", "Argument[0]", "sql-injection", "manual"]
+      - ["sqlx_core::query_as_with::query_as_with", "Argument[0]", "sql-injection", "manual"]
+      - ["sqlx_core::query_scalar::query_scalar", "Argument[0]", "sql-injection", "manual"]
+      - ["sqlx_core::query_scalar_with::query_scalar_with", "Argument[0]", "sql-injection", "manual"]
+      - ["sqlx_core::raw_sql::raw_sql", "Argument[0]", "sql-injection", "manual"]
+      - ["<_ as sqlx_core::executor::Executor>::execute", "Argument[0]", "sql-injection", "manual"]

rust/ql/lib/codeql/rust/security/CleartextStorageDatabaseExtensions.qll

@@ -39,8 +39,10 @@ module CleartextStorageDatabase {
 
   /**
    * A sink for cleartext storage vulnerabilities from model data.
+   *  - SQL commands
+   *  - other database storage operations
    */
   private class ModelsAsDataSink extends Sink {
-    ModelsAsDataSink() { exists(string s | sinkNode(this, s) and s.matches("database-store")) }
+    ModelsAsDataSink() { sinkNode(this, ["sql-injection", "database-store"]) }
   }
 }