Skip to content

Commit fc527ae

Browse files
author
Alvaro Muñoz
committed
address code review feedback
1 parent a975314 commit fc527ae

File tree

4 files changed

+42
-44
lines changed

4 files changed

+42
-44
lines changed

‎go/ql/lib/semmle/go/frameworks/SQL.qll‎

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -294,46 +294,41 @@ module Xorm {
294294
* Provides classes for working with the [Bun](https://bun.uptrace.dev/) package.
295295
*/
296296
module Bun {
297-
/** Gets the package name for Bun. */
298-
string packagePath() { result = package("github.com/uptrace/bun", "") }
297+
/** Gets the package name for Bun package. */
298+
private string packagePath() { result = package("github.com/uptrace/bun", "") }
299299

300300
/** A model for sinks of Bun. */
301301
private class BunSink extends SQL::QueryString::Range {
302302
BunSink() {
303-
exists(Function f, int arg |
304-
f.(Method)
305-
.hasQualifiedName(packagePath(), ["DB", "Conn"],
306-
["ExecContext", "PrepareContext", "QueryContext", "QueryRowContext"]) and
303+
exists(Function f, string m, int arg | this = f.getACall().getArgument(arg) |
304+
f.hasQualifiedName(packagePath(), m) and
305+
m = "NewRawQuery" and
307306
arg = 1
308-
or
309-
f.(Method)
310-
.hasQualifiedName(packagePath(), ["DB", "Conn"],
311-
["Exec", "NewRaw", "Prepare", "Query", "QueryRow", "Raw"]) and
312-
arg = 0
313-
or
314-
exists(string tp, string m | f.(Method).hasQualifiedName(packagePath(), tp, m) |
307+
)
308+
or
309+
exists(Method f, string tp, string m, int arg | this = f.getACall().getArgument(arg) |
310+
f.hasQualifiedName(packagePath(), tp, m) and
311+
(
312+
tp = ["DB", "Conn"] and
313+
m = ["ExecContext", "PrepareContext", "QueryContext", "QueryRowContext"] and
314+
arg = 1
315+
or
316+
tp = ["DB", "Conn"] and
317+
m = ["Exec", "NewRaw", "Prepare", "Query", "QueryRow", "Raw"] and
318+
arg = 0
319+
or
315320
tp.matches("%Query") and
316321
m =
317322
[
318323
"ColumnExpr", "DistinctOn", "For", "GroupExpr", "Having", "ModelTableExpr",
319-
"OrderExpr", "TableExpr", "Where", "WhereIn", "WhereInMulti", "WhereOr"
324+
"OrderExpr", "TableExpr", "Where", "WhereOr"
320325
] and
321326
arg = 0
322327
or
323-
tp.matches("%Query") and
324-
m = ["FormatQuery", "With", "WithRecursive"] and
325-
arg = 1
326-
or
327328
tp = "RawQuery" and
328329
m = "NewRaw" and
329330
arg = 0
330-
or
331-
tp = "RawQuery" and
332-
m = "NewRawQuery" and
333-
arg = 1
334331
)
335-
|
336-
this = f.getACall().getArgument(arg)
337332
)
338333
}
339334
}

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/bun/bun.expected‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,17 @@
1-
| bun.go:27:10:27:18 | untrusted | github.com/uptrace/bun | DB | Exec |
2-
| bun.go:28:22:28:30 | untrusted | github.com/uptrace/bun | DB | ExecContext |
3-
| bun.go:29:26:29:34 | untrusted | github.com/uptrace/bun | DB | QueryRowContext |
4-
| bun.go:30:28:30:36 | untrusted | github.com/uptrace/bun | SelectQuery | ColumnExpr |
5-
| bun.go:30:28:30:36 | untrusted | github.com/uptrace/bun | countQuery | ColumnExpr |
6-
| bun.go:30:28:30:36 | untrusted | github.com/uptrace/bun | selectExistsQuery | ColumnExpr |
7-
| bun.go:30:28:30:36 | untrusted | github.com/uptrace/bun | selectQueryBuilder | ColumnExpr |
8-
| bun.go:30:28:30:36 | untrusted | github.com/uptrace/bun | whereExistsQuery | ColumnExpr |
9-
| bun.go:31:12:31:20 | untrusted | github.com/uptrace/bun | DB | NewRaw |
10-
| bun.go:32:23:32:31 | untrusted | github.com/uptrace/bun | DB | QueryContext |
11-
| bun.go:33:26:33:34 | untrusted | github.com/uptrace/bun | DB | QueryRowContext |
12-
| bun.go:34:14:34:22 | untrusted | github.com/uptrace/bun | DB | QueryRow |
13-
| bun.go:35:9:35:17 | untrusted | github.com/uptrace/bun | DB | Raw |
14-
| bun.go:36:11:36:19 | untrusted | github.com/uptrace/bun | DB | Query |
15-
| bun.go:37:13:37:21 | untrusted | github.com/uptrace/bun | DB | Prepare |
16-
| bun.go:38:25:38:33 | untrusted | github.com/uptrace/bun | DB | PrepareContext |
1+
| bun.go:26:10:26:18 | untrusted | github.com/uptrace/bun.DB | Exec |
2+
| bun.go:27:22:27:30 | untrusted | github.com/uptrace/bun.DB | ExecContext |
3+
| bun.go:28:26:28:34 | untrusted | github.com/uptrace/bun.DB | QueryRowContext |
4+
| bun.go:29:28:29:36 | untrusted | github.com/uptrace/bun.SelectQuery | ColumnExpr |
5+
| bun.go:29:28:29:36 | untrusted | github.com/uptrace/bun.countQuery | ColumnExpr |
6+
| bun.go:29:28:29:36 | untrusted | github.com/uptrace/bun.selectExistsQuery | ColumnExpr |
7+
| bun.go:29:28:29:36 | untrusted | github.com/uptrace/bun.selectQueryBuilder | ColumnExpr |
8+
| bun.go:29:28:29:36 | untrusted | github.com/uptrace/bun.whereExistsQuery | ColumnExpr |
9+
| bun.go:30:12:30:20 | untrusted | github.com/uptrace/bun.DB | NewRaw |
10+
| bun.go:31:23:31:31 | untrusted | github.com/uptrace/bun.DB | QueryContext |
11+
| bun.go:32:26:32:34 | untrusted | github.com/uptrace/bun.DB | QueryRowContext |
12+
| bun.go:33:14:33:22 | untrusted | github.com/uptrace/bun.DB | QueryRow |
13+
| bun.go:34:9:34:17 | untrusted | github.com/uptrace/bun.DB | Raw |
14+
| bun.go:35:11:35:19 | untrusted | github.com/uptrace/bun.DB | Query |
15+
| bun.go:36:13:36:21 | untrusted | github.com/uptrace/bun.DB | Prepare |
16+
| bun.go:37:25:37:33 | untrusted | github.com/uptrace/bun.DB | PrepareContext |
17+
| bun.go:38:22:38:30 | untrusted | github.com/uptrace/bun | NewRawQuery |

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/bun/bun.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77
"github.com/uptrace/bun"
88
"github.com/uptrace/bun/dialect/sqlitedialect"
99
"github.com/uptrace/bun/driver/sqliteshim"
10-
"github.com/uptrace/bun/extra/bundebug"
1110
)
1211

1312
func getUntrustedString() string {
@@ -36,4 +35,5 @@ func main() {
3635
db.Query(untrusted)
3736
db.Prepare(untrusted)
3837
db.PrepareContext(ctx, untrusted)
38+
bun.NewRawQuery(db, untrusted)
3939
}

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/bun/bun.ql‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
import go
22

3-
from SQL::QueryString qs, Method meth, string a, string b, string c
4-
where meth.hasQualifiedName(a, b, c) and qs = meth.getACall().getSyntacticArgument(_)
5-
select qs, a, b, c
3+
from SQL::QueryString qs, Function func, string a, string b
4+
where
5+
func.hasQualifiedName(a, b) and
6+
qs = func.getACall().getSyntacticArgument(_)
7+
select qs, a, b

0 commit comments

Comments
 (0)