Skip to content

Commit a1fdc6f

Browse files
owen-mcowen-mc
authored
Merge pull request #13599 from pwntester/ruby/gopg_improvements
Go: Improve go-pg support
2 parents 5575fc6 + eacecab commit a1fdc6f

File tree

9 files changed

+1188
-2
lines changed

9 files changed

+1188
-2
lines changed

‎go/ql/lib/change-notes/2023-06-28--improve-support-for-gopg-framework.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
lgtm,codescanning
2+
* Support for the [go-pg framework](https://github.com/go-pg/pg) has been improved.
3+

‎go/ql/lib/semmle/go/frameworks/SQL.qll

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,25 @@ module SQL {
145145
f.hasQualifiedName(gopgorm(), "Q") and
146146
arg = 0
147147
or
148-
exists(string tp, string m | f.(Method).hasQualifiedName(gopgorm(), tp, m) |
148+
exists(string tp, string m | f.(Method).hasQualifiedName([gopgorm(), gopg()], tp, m) |
149+
tp = ["DB", "Conn"] and
150+
m = ["QueryContext", "QueryOneContext"] and
151+
arg = 2
152+
or
153+
tp = ["DB", "Conn"] and
154+
m = ["ExecContext", "ExecOneContext", "Query", "QueryOne"] and
155+
arg = 1
156+
or
157+
tp = ["DB", "Conn"] and
158+
m = ["Exec", "ExecOne", "Prepare"] and
159+
arg = 0
160+
or
149161
tp = "Query" and
150-
m = ["ColumnExpr", "For", "Having", "Where", "WhereIn", "WhereInMulti", "WhereOr"] and
162+
m =
163+
[
164+
"ColumnExpr", "For", "GroupExpr", "Having", "Join", "OrderExpr", "TableExpr",
165+
"Where", "WhereIn", "WhereInMulti", "WhereOr"
166+
] and
151167
arg = 0
152168
or
153169
tp = "Query" and

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/go-pg/go-pg.expected

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
| go-pg.go:38:10:38:18 | untrusted | github.com/go-pg/pg/v10 | DB | Exec |
2+
| go-pg.go:39:13:39:21 | untrusted | github.com/go-pg/pg/v10 | DB | ExecOne |
3+
| go-pg.go:40:13:40:21 | untrusted | github.com/go-pg/pg/v10 | DB | Prepare |
4+
| go-pg.go:42:22:42:30 | untrusted | github.com/go-pg/pg/v10 | DB | ExecContext |
5+
| go-pg.go:43:25:43:33 | untrusted | github.com/go-pg/pg/v10 | DB | ExecOneContext |
6+
| go-pg.go:44:21:44:29 | untrusted | github.com/go-pg/pg/v10 | DB | Query |
7+
| go-pg.go:45:24:45:32 | untrusted | github.com/go-pg/pg/v10 | DB | QueryOne |
8+
| go-pg.go:47:45:47:53 | untrusted | github.com/go-pg/pg/v10 | DB | QueryOneContext |
9+
| go-pg.go:48:33:48:41 | untrusted | github.com/go-pg/pg/v10 | DB | QueryContext |
10+
| go-pg.go:52:14:52:22 | untrusted | github.com/go-pg/pg/v10/orm | Query | ColumnExpr |
11+
| go-pg.go:53:8:53:16 | untrusted | github.com/go-pg/pg/v10/orm | Query | Join |
12+
| go-pg.go:54:9:54:17 | untrusted | github.com/go-pg/pg/v10/orm | Query | Where |
13+
| go-pg.go:55:13:55:21 | untrusted | github.com/go-pg/pg/v10/orm | Query | OrderExpr |
14+
| go-pg.go:56:13:56:21 | untrusted | github.com/go-pg/pg/v10/orm | Query | GroupExpr |
15+
| go-pg.go:57:13:57:21 | untrusted | github.com/go-pg/pg/v10/orm | Query | TableExpr |
16+
| go-pg.go:58:11:58:19 | untrusted | github.com/go-pg/pg/v10/orm | Query | WhereIn |
17+
| go-pg.go:59:16:59:24 | untrusted | github.com/go-pg/pg/v10/orm | Query | WhereInMulti |
18+
| go-pg.go:60:11:60:19 | untrusted | github.com/go-pg/pg/v10/orm | Query | WhereOr |
19+
| go-pg.go:61:7:61:15 | untrusted | github.com/go-pg/pg/v10/orm | Query | For |
20+
| go-pg.go:62:10:62:18 | untrusted | github.com/go-pg/pg/v10/orm | Query | Having |

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/go-pg/go-pg.go

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
package main
2+
3+
import (
4+
"context"
5+
pg "github.com/go-pg/pg/v10"
6+
)
7+
8+
type Profile struct {
9+
ID int
10+
Lang string
11+
}
12+
13+
type User struct {
14+
ID int
15+
Name string
16+
ProfileID int
17+
Profile *Profile `pg:"-"`
18+
}
19+
20+
func getUntrustedString() string {
21+
return "trouble"
22+
}
23+
24+
func main() {
25+
26+
untrusted := getUntrustedString()
27+
28+
ctx := context.Background()
29+
db := pg.Connect(&pg.Options{
30+
Addr: ":5432",
31+
User: "user",
32+
Password: "pass",
33+
Database: "db_name",
34+
})
35+
36+
var version string
37+
38+
db.Exec(untrusted)
39+
db.ExecOne(untrusted)
40+
db.Prepare(untrusted)
41+
42+
db.ExecContext(ctx, untrusted)
43+
db.ExecOneContext(ctx, untrusted)
44+
db.Query(&version, untrusted)
45+
db.QueryOne(&version, untrusted)
46+
47+
db.QueryOneContext(ctx, pg.Scan(&version), untrusted)
48+
db.QueryContext(ctx, &version, untrusted)
49+
50+
var user User
51+
db.Model(&user).
52+
ColumnExpr(untrusted).
53+
Join(untrusted).
54+
Where(untrusted, 123).
55+
OrderExpr(untrusted).
56+
GroupExpr(untrusted).
57+
TableExpr(untrusted).
58+
WhereIn(untrusted, 1).
59+
WhereInMulti(untrusted, 1).
60+
WhereOr(untrusted, 1).
61+
For(untrusted).
62+
Having(untrusted).
63+
Select()
64+
}

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/go-pg/go-pg.ql

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import go
2+
3+
from SQL::QueryString qs, Method meth, string a, string b, string c
4+
where meth.hasQualifiedName(a, b, c) and qs = meth.getACall().getSyntacticArgument(_)
5+
select qs, a, b, c

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/go-pg/go.mod

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
module pwntester/go-pg
2+
3+
go 1.19
4+
5+
require github.com/go-pg/pg/v10 v10.11.0
6+
7+
require (
8+
github.com/go-pg/zerochecker v0.2.0 // indirect
9+
github.com/jinzhu/inflection v1.0.0 // indirect
10+
github.com/kr/text v0.2.0 // indirect
11+
github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc // indirect
12+
github.com/vmihailenco/bufpool v0.1.11 // indirect
13+
github.com/vmihailenco/msgpack/v5 v5.3.4 // indirect
14+
github.com/vmihailenco/tagparser v0.1.2 // indirect
15+
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
16+
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 // indirect
17+
golang.org/x/sys v0.0.0-20210923061019-b8560ed6a9b7 // indirect
18+
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
19+
mellium.im/sasl v0.3.1 // indirect
20+
)

0 commit comments

Comments
 (0)