Skip to content

Commit 3eb5b26

Browse files
owen-mcowen-mc
committed
Convert Bun sql-injection sinks to MaD
1 parent 3b2b7d7 commit 3eb5b26

File tree

5 files changed

+158
-64
lines changed

5 files changed

+158
-64
lines changed

‎go/ql/lib/ext/github.com.uptrace.bun.model.yml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: sinkModel
5+
data:
6+
- ["github.com/uptrace/bun", "", True, "NewRawQuery", "", "", "Argument[1]", "sql-injection", "manual"]
7+
- ["github.com/uptrace/bun", "AddColumnQuery", True, "ColumnExpr", "", "", "Argument[0]", "sql-injection", "manual"]
8+
- ["github.com/uptrace/bun", "AddColumnQuery", True, "ModelTableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
9+
- ["github.com/uptrace/bun", "AddColumnQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
10+
- ["github.com/uptrace/bun", "Conn", True, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
11+
- ["github.com/uptrace/bun", "Conn", True, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
12+
- ["github.com/uptrace/bun", "Conn", True, "NewRaw", "", "", "Argument[0]", "sql-injection", "manual"]
13+
- ["github.com/uptrace/bun", "Conn", True, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
14+
- ["github.com/uptrace/bun", "Conn", True, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
15+
- ["github.com/uptrace/bun", "Conn", True, "QueryRow", "", "", "Argument[0]", "sql-injection", "manual"]
16+
- ["github.com/uptrace/bun", "Conn", True, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
17+
- ["github.com/uptrace/bun", "Conn", True, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
18+
- ["github.com/uptrace/bun", "Conn", True, "QueryRowContext", "", "", "Argument[1]", "sql-injection", "manual"]
19+
- ["github.com/uptrace/bun", "Conn", True, "Raw", "", "", "Argument[0]", "sql-injection", "manual"]
20+
- ["github.com/uptrace/bun", "CreateIndexQuery", True, "ColumnExpr", "", "", "Argument[0]", "sql-injection", "manual"]
21+
- ["github.com/uptrace/bun", "CreateIndexQuery", True, "ModelTableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
22+
- ["github.com/uptrace/bun", "CreateIndexQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
23+
- ["github.com/uptrace/bun", "CreateIndexQuery", True, "Where", "", "", "Argument[0]", "sql-injection", "manual"]
24+
- ["github.com/uptrace/bun", "CreateIndexQuery", True, "WhereOr", "", "", "Argument[0]", "sql-injection", "manual"]
25+
- ["github.com/uptrace/bun", "CreateTableQuery", True, "ColumnExpr", "", "", "Argument[0]", "sql-injection", "manual"]
26+
- ["github.com/uptrace/bun", "CreateTableQuery", True, "ModelTableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
27+
- ["github.com/uptrace/bun", "CreateTableQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
28+
- ["github.com/uptrace/bun", "DB", True, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
29+
- ["github.com/uptrace/bun", "DB", True, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
30+
- ["github.com/uptrace/bun", "DB", True, "NewRaw", "", "", "Argument[0]", "sql-injection", "manual"]
31+
- ["github.com/uptrace/bun", "DB", True, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
32+
- ["github.com/uptrace/bun", "DB", True, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
33+
- ["github.com/uptrace/bun", "DB", True, "QueryRow", "", "", "Argument[0]", "sql-injection", "manual"]
34+
- ["github.com/uptrace/bun", "DB", True, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
35+
- ["github.com/uptrace/bun", "DB", True, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
36+
- ["github.com/uptrace/bun", "DB", True, "QueryRowContext", "", "", "Argument[1]", "sql-injection", "manual"]
37+
- ["github.com/uptrace/bun", "DB", True, "Raw", "", "", "Argument[0]", "sql-injection", "manual"]
38+
- ["github.com/uptrace/bun", "DeleteQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
39+
- ["github.com/uptrace/bun", "DeleteQuery", True, "Where", "", "", "Argument[0]", "sql-injection", "manual"]
40+
- ["github.com/uptrace/bun", "DeleteQuery", True, "WhereOr", "", "", "Argument[0]", "sql-injection", "manual"]
41+
- ["github.com/uptrace/bun", "DropColumnQuery", True, "ColumnExpr", "", "", "Argument[0]", "sql-injection", "manual"]
42+
- ["github.com/uptrace/bun", "DropColumnQuery", True, "ModelTableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
43+
- ["github.com/uptrace/bun", "DropColumnQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
44+
- ["github.com/uptrace/bun", "DropTableQuery", True, "ModelTableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
45+
- ["github.com/uptrace/bun", "DropTableQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
46+
- ["github.com/uptrace/bun", "InsertQuery", True, "ColumnExpr", "", "", "Argument[0]", "sql-injection", "manual"]
47+
- ["github.com/uptrace/bun", "InsertQuery", True, "ModelTableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
48+
- ["github.com/uptrace/bun", "InsertQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
49+
- ["github.com/uptrace/bun", "InsertQuery", True, "Where", "", "", "Argument[0]", "sql-injection", "manual"]
50+
- ["github.com/uptrace/bun", "InsertQuery", True, "WhereOr", "", "", "Argument[0]", "sql-injection", "manual"]
51+
- ["github.com/uptrace/bun", "MergeQuery", True, "ModelTableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
52+
- ["github.com/uptrace/bun", "MergeQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
53+
- ["github.com/uptrace/bun", "RawQuery", True, "NewRaw", "", "", "Argument[0]", "sql-injection", "manual"]
54+
- ["github.com/uptrace/bun", "SelectQuery", True, "ColumnExpr", "", "", "Argument[0]", "sql-injection", "manual"]
55+
- ["github.com/uptrace/bun", "SelectQuery", True, "DistinctOn", "", "", "Argument[0]", "sql-injection", "manual"]
56+
- ["github.com/uptrace/bun", "SelectQuery", True, "For", "", "", "Argument[0]", "sql-injection", "manual"]
57+
- ["github.com/uptrace/bun", "SelectQuery", True, "GroupExpr", "", "", "Argument[0]", "sql-injection", "manual"]
58+
- ["github.com/uptrace/bun", "SelectQuery", True, "Having", "", "", "Argument[0]", "sql-injection", "manual"]
59+
- ["github.com/uptrace/bun", "SelectQuery", True, "ModelTableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
60+
- ["github.com/uptrace/bun", "SelectQuery", True, "OrderExpr", "", "", "Argument[0]", "sql-injection", "manual"]
61+
- ["github.com/uptrace/bun", "SelectQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
62+
- ["github.com/uptrace/bun", "SelectQuery", True, "Where", "", "", "Argument[0]", "sql-injection", "manual"]
63+
- ["github.com/uptrace/bun", "SelectQuery", True, "WhereOr", "", "", "Argument[0]", "sql-injection", "manual"]
64+
- ["github.com/uptrace/bun", "TruncateTableQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
65+
- ["github.com/uptrace/bun", "UpdateQuery", True, "ModelTableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
66+
- ["github.com/uptrace/bun", "UpdateQuery", True, "TableExpr", "", "", "Argument[0]", "sql-injection", "manual"]
67+
- ["github.com/uptrace/bun", "UpdateQuery", True, "Where", "", "", "Argument[0]", "sql-injection", "manual"]
68+
- ["github.com/uptrace/bun", "UpdateQuery", True, "WhereOr", "", "", "Argument[0]", "sql-injection", "manual"]

‎go/ql/lib/semmle/go/frameworks/SQL.qll

Lines changed: 3 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -171,45 +171,8 @@ module Xorm {
171171
}
172172

173173
/**
174+
* DEPRECATED
175+
*
174176
* Provides classes for working with the [Bun](https://bun.uptrace.dev/) package.
175177
*/
176-
module Bun {
177-
/** Gets the package name for Bun package. */
178-
private string packagePath() { result = package("github.com/uptrace/bun", "") }
179-
180-
/** A model for sinks of Bun. */
181-
private class BunSink extends SQL::QueryString::Range {
182-
BunSink() {
183-
exists(Function f, string m, int arg | this = f.getACall().getArgument(arg) |
184-
f.hasQualifiedName(packagePath(), m) and
185-
m = "NewRawQuery" and
186-
arg = 1
187-
)
188-
or
189-
exists(Method f, string tp, string m, int arg | this = f.getACall().getArgument(arg) |
190-
f.hasQualifiedName(packagePath(), tp, m) and
191-
(
192-
tp = ["DB", "Conn"] and
193-
m = ["ExecContext", "PrepareContext", "QueryContext", "QueryRowContext"] and
194-
arg = 1
195-
or
196-
tp = ["DB", "Conn"] and
197-
m = ["Exec", "NewRaw", "Prepare", "Query", "QueryRow", "Raw"] and
198-
arg = 0
199-
or
200-
tp.matches("%Query") and
201-
m =
202-
[
203-
"ColumnExpr", "DistinctOn", "For", "GroupExpr", "Having", "ModelTableExpr",
204-
"OrderExpr", "TableExpr", "Where", "WhereOr"
205-
] and
206-
arg = 0
207-
or
208-
tp = "RawQuery" and
209-
m = "NewRaw" and
210-
arg = 0
211-
)
212-
)
213-
}
214-
}
215-
}
178+
deprecated module Bun { }

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/bun/QueryString.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
failures
2+
invalidModelRow
3+
testFailures

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/bun/QueryString.ql

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
import go
2+
import semmle.go.dataflow.ExternalFlow
3+
import ModelValidation
4+
import TestUtilities.InlineExpectationsTest
5+
6+
module SqlTest implements TestSig {
7+
string getARelevantTag() { result = "query" }
8+
9+
predicate hasActualResult(Location location, string element, string tag, string value) {
10+
tag = "query" and
11+
exists(SQL::Query q, SQL::QueryString qs | qs = q.getAQueryString() |
12+
q.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
13+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
14+
element = q.toString() and
15+
value = qs.toString()
16+
)
17+
}
18+
}
19+
20+
module QueryString implements TestSig {
21+
string getARelevantTag() { result = "querystring" }
22+
23+
predicate hasActualResult(Location location, string element, string tag, string value) {
24+
tag = "querystring" and
25+
element = "" and
26+
exists(SQL::QueryString qs | not exists(SQL::Query q | qs = q.getAQueryString()) |
27+
qs.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
28+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
29+
value = qs.toString()
30+
)
31+
}
32+
}
33+
34+
module Config implements DataFlow::ConfigSig {
35+
predicate isSource(DataFlow::Node n) { n.asExpr() instanceof StringLit }
36+
37+
predicate isSink(DataFlow::Node n) {
38+
n = any(DataFlow::CallNode cn | cn.getTarget().getName() = "sink").getAnArgument()
39+
}
40+
}
41+
42+
module Flow = TaintTracking::Global<Config>;
43+
44+
module TaintFlow implements TestSig {
45+
string getARelevantTag() { result = "flowfrom" }
46+
47+
predicate hasActualResult(Location location, string element, string tag, string value) {
48+
tag = "flowfrom" and
49+
element = "" and
50+
exists(DataFlow::Node fromNode, DataFlow::Node toNode |
51+
toNode
52+
.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
53+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
54+
Flow::flow(fromNode, toNode) and
55+
value = fromNode.asExpr().(StringLit).getValue()
56+
)
57+
}
58+
}
59+
60+
import MakeTest<MergeTests3<SqlTest, QueryString, TaintFlow>>

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/bun/bun.go

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -22,28 +22,28 @@ func main() {
2222
panic(err)
2323
}
2424
db := bun.NewDB(sqlite, sqlitedialect.New())
25-
bun.NewRawQuery(db, untrusted)
26-
27-
db.ExecContext(ctx, untrusted)
28-
db.PrepareContext(ctx, untrusted)
29-
db.QueryContext(ctx, untrusted)
30-
db.QueryRowContext(ctx, untrusted)
31-
32-
db.Exec(untrusted)
33-
db.NewRaw(untrusted)
34-
db.Prepare(untrusted)
35-
db.Query(untrusted)
36-
db.QueryRow(untrusted)
37-
db.Raw(untrusted)
38-
39-
db.NewSelect().ColumnExpr(untrusted)
40-
db.NewSelect().DistinctOn(untrusted)
41-
db.NewSelect().For(untrusted)
42-
db.NewSelect().GroupExpr(untrusted)
43-
db.NewSelect().Having(untrusted)
44-
db.NewSelect().ModelTableExpr(untrusted)
45-
db.NewSelect().OrderExpr(untrusted)
46-
db.NewSelect().TableExpr(untrusted)
47-
db.NewSelect().Where(untrusted)
48-
db.NewSelect().WhereOr(untrusted)
25+
bun.NewRawQuery(db, untrusted) // $ querystring=untrusted
26+
27+
db.ExecContext(ctx, untrusted) // $ querystring=untrusted
28+
db.PrepareContext(ctx, untrusted) // $ querystring=untrusted
29+
db.QueryContext(ctx, untrusted) // $ querystring=untrusted
30+
db.QueryRowContext(ctx, untrusted) // $ querystring=untrusted
31+
32+
db.Exec(untrusted) // $ querystring=untrusted
33+
db.NewRaw(untrusted) // $ querystring=untrusted
34+
db.Prepare(untrusted) // $ querystring=untrusted
35+
db.Query(untrusted) // $ querystring=untrusted
36+
db.QueryRow(untrusted) // $ querystring=untrusted
37+
db.Raw(untrusted) // $ querystring=untrusted
38+
39+
db.NewSelect().ColumnExpr(untrusted) // $ querystring=untrusted
40+
db.NewSelect().DistinctOn(untrusted) // $ querystring=untrusted
41+
db.NewSelect().For(untrusted) // $ querystring=untrusted
42+
db.NewSelect().GroupExpr(untrusted) // $ querystring=untrusted
43+
db.NewSelect().Having(untrusted) // $ querystring=untrusted
44+
db.NewSelect().ModelTableExpr(untrusted) // $ querystring=untrusted
45+
db.NewSelect().OrderExpr(untrusted) // $ querystring=untrusted
46+
db.NewSelect().TableExpr(untrusted) // $ querystring=untrusted
47+
db.NewSelect().Where(untrusted) // $ querystring=untrusted
48+
db.NewSelect().WhereOr(untrusted) // $ querystring=untrusted
4949
}

0 commit comments

Comments
 (0)