I identified another low-hanging fruit in terms of Semantic UAST types: string interpolation.
The node is similar if most drivers I've seen, and the semantic is pretty well-understood. Essentially all nodes of this kind follow the following structure:
type StringInterpolation struct{
Parts []Any
}
Each part can be a String, Identifier or any other expression that yields a value. The effect of this operation is to convert all arguments to String and join them into a single one.
Current list of discovered interpolation nodes:
bash:string
csharp:InterpolatedStringExpression
javascript:TemplateLiteral
php:Scalar_Encapsed
python:JoinedStr
ruby:dstr
If we decide to go full-in on Semantic, there some other candidates:
- Go:
fmt.Sprintf, strings.Join(, "")
- Java:
String.format
But for now, I propose to only touch the unique AST nodes, not function calls.
In terms of functionality, this will allow to better detect SQL injections and similar bugs.