Skip to content

Commit 437df5c

Browse files
smowtonsmowton
committed
Revert "Convert gocb nosql-injection sinks to MaD"
This reverts commit 2d2afb1.
1 parent a6e3b91 commit 437df5c

File tree

4 files changed

+138
-43
lines changed

4 files changed

+138
-43
lines changed

‎go/ql/lib/ext/github.com.couchbase.gocb.model.yml

Lines changed: 21 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -3,43 +3,28 @@ extensions:
33
pack: codeql/go-all
44
extensible: packageGrouping
55
data:
6-
- ["gocb1", "fixed-version:github.com/couchbase/gocb"]
7-
- ["gocb1", "fixed-version:gopkg.in/couchbase/gocb.v1"]
8-
- ["gocb1", "fixed-version:github.com/couchbaselabs/gocb"]
9-
- ["gocb2", "github.com/couchbase/gocb/v2"]
10-
- ["gocb2", "gopkg.in/couchbase/gocb.v2"]
11-
- ["gocb2", "github.com/couchbaselabs/gocb/v2"]
12-
- addsTo:
13-
pack: codeql/go-all
14-
extensible: sinkModel
15-
data:
16-
- ["group:gocb1", "Bucket", True, "ExecuteN1qlQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
17-
- ["group:gocb1", "Bucket", True, "ExecuteAnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
18-
- ["group:gocb1", "Cluster", True, "ExecuteN1qlQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
19-
- ["group:gocb1", "Cluster", True, "ExecuteAnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
20-
- ["group:gocb2", "Cluster", True, "AnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
21-
- ["group:gocb2", "Cluster", True, "Query", "", "", "Argument[0]", "nosql-injection", "manual"]
22-
- ["group:gocb2", "Scope", True, "AnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
23-
- ["group:gocb2", "Scope", True, "Query", "", "", "Argument[0]", "nosql-injection", "manual"]
6+
- ["gocb", "github.com/couchbase/gocb"]
7+
- ["gocb", "gopkg.in/couchbase/gocb"]
8+
- ["gocb", "github.com/couchbaselabs/gocb"]
249
- addsTo:
2510
pack: codeql/go-all
2611
extensible: summaryModel
2712
data:
28-
- ["group:gocb1", "", False, "NewAnalyticsQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
29-
- ["group:gocb1", "", False, "NewN1qlQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
30-
- ["group:gocb1", "AnalyticsQuery", True, "ContextId", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
31-
- ["group:gocb1", "AnalyticsQuery", True, "Deferred", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
32-
- ["group:gocb1", "AnalyticsQuery", True, "Pretty", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
33-
- ["group:gocb1", "AnalyticsQuery", True, "Priority", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
34-
- ["group:gocb1", "AnalyticsQuery", True, "RawParam", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
35-
- ["group:gocb1", "AnalyticsQuery", True, "ServerSideTimeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
36-
- ["group:gocb1", "N1qlQuery", True, "AdHoc", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
37-
- ["group:gocb1", "N1qlQuery", True, "Consistency", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
38-
- ["group:gocb1", "N1qlQuery", True, "ConsistentWith", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
39-
- ["group:gocb1", "N1qlQuery", True, "Custom", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
40-
- ["group:gocb1", "N1qlQuery", True, "PipelineBatch", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
41-
- ["group:gocb1", "N1qlQuery", True, "PipelineCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
42-
- ["group:gocb1", "N1qlQuery", True, "Profile", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
43-
- ["group:gocb1", "N1qlQuery", True, "ReadOnly", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
44-
- ["group:gocb1", "N1qlQuery", True, "ScanCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
45-
- ["group:gocb1", "N1qlQuery", True, "Timeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
13+
- ["group:gocb", "", False, "NewAnalyticsQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
14+
- ["group:gocb", "", False, "NewN1qlQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
15+
- ["group:gocb", "AnalyticsQuery", True, "ContextId", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
16+
- ["group:gocb", "AnalyticsQuery", True, "Deferred", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
17+
- ["group:gocb", "AnalyticsQuery", True, "Pretty", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
18+
- ["group:gocb", "AnalyticsQuery", True, "Priority", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
19+
- ["group:gocb", "AnalyticsQuery", True, "RawParam", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
20+
- ["group:gocb", "AnalyticsQuery", True, "ServerSideTimeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
21+
- ["group:gocb", "N1qlQuery", True, "AdHoc", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
22+
- ["group:gocb", "N1qlQuery", True, "Consistency", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
23+
- ["group:gocb", "N1qlQuery", True, "ConsistentWith", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
24+
- ["group:gocb", "N1qlQuery", True, "Custom", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
25+
- ["group:gocb", "N1qlQuery", True, "PipelineBatch", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
26+
- ["group:gocb", "N1qlQuery", True, "PipelineCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
27+
- ["group:gocb", "N1qlQuery", True, "Profile", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
28+
- ["group:gocb", "N1qlQuery", True, "ReadOnly", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
29+
- ["group:gocb", "N1qlQuery", True, "ScanCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
30+
- ["group:gocb", "N1qlQuery", True, "Timeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]

‎go/ql/lib/ext/go.mongodb.org.mongo-driver.mongo.model.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ extensions:
33
pack: codeql/go-all
44
extensible: sinkModel
55
data:
6-
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "Aggregate", "", "", "Argument[1]", "nosql-injection", "manual"]
76
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "CountDocuments", "", "", "Argument[1]", "nosql-injection", "manual"]
87
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "DeleteMany", "", "", "Argument[1]", "nosql-injection", "manual"]
98
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "DeleteOne", "", "", "Argument[1]", "nosql-injection", "manual"]
@@ -17,3 +16,4 @@ extensions:
1716
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "UpdateMany", "", "", "Argument[1]", "nosql-injection", "manual"]
1817
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "UpdateOne", "", "", "Argument[1]", "nosql-injection", "manual"]
1918
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "Watch", "", "", "Argument[1]", "nosql-injection", "manual"]
19+
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "Aggregate", "", "", "Argument[1]", "nosql-injection", "manual"]

‎go/ql/lib/semmle/go/frameworks/Couchbase.qll

Lines changed: 40 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,23 +5,57 @@
55
import go
66

77
/**
8-
* DEPRECATED
9-
*
108
* Provides models of commonly used functions in the official Couchbase Go SDK library.
119
*/
12-
deprecated module Couchbase {
10+
module Couchbase {
1311
/**
14-
* DEPRECATED
15-
*
1612
* Gets a package path for the official Couchbase Go SDK library.
1713
*
1814
* Note that v1 and v2 have different APIs, but the names are disjoint so there is no need to
1915
* distinguish between them.
2016
*/
21-
deprecated string packagePath() {
17+
string packagePath() {
2218
result =
2319
package([
2420
"gopkg.in/couchbase/gocb", "github.com/couchbase/gocb", "github.com/couchbaselabs/gocb"
2521
], "")
2622
}
23+
24+
/**
25+
* A query used in an API function acting on a `Bucket` or `Cluster` struct of v1 of
26+
* the official Couchbase Go library, gocb.
27+
*/
28+
private class CouchbaseV1Query extends NoSql::Query::Range {
29+
CouchbaseV1Query() {
30+
// func (b *Bucket) ExecuteAnalyticsQuery(q *AnalyticsQuery, params interface{}) (AnalyticsResults, error)
31+
// func (b *Bucket) ExecuteN1qlQuery(q *N1qlQuery, params interface{}) (QueryResults, error)
32+
// func (c *Cluster) ExecuteAnalyticsQuery(q *AnalyticsQuery, params interface{}) (AnalyticsResults, error)
33+
// func (c *Cluster) ExecuteN1qlQuery(q *N1qlQuery, params interface{}) (QueryResults, error)
34+
exists(Method meth, string structName, string methodName |
35+
structName in ["Bucket", "Cluster"] and
36+
methodName in ["ExecuteN1qlQuery", "ExecuteAnalyticsQuery"] and
37+
meth.hasQualifiedName(packagePath(), structName, methodName) and
38+
this = meth.getACall().getArgument(0)
39+
)
40+
}
41+
}
42+
43+
/**
44+
* A query used in an API function acting on a `Bucket` or `Cluster` struct of v1 of
45+
* the official Couchbase Go library, gocb.
46+
*/
47+
private class CouchbaseV2Query extends NoSql::Query::Range {
48+
CouchbaseV2Query() {
49+
// func (c *Cluster) AnalyticsQuery(statement string, opts *AnalyticsOptions) (*AnalyticsResult, error)
50+
// func (c *Cluster) Query(statement string, opts *QueryOptions) (*QueryResult, error)
51+
// func (s *Scope) AnalyticsQuery(statement string, opts *AnalyticsOptions) (*AnalyticsResult, error)
52+
// func (s *Scope) Query(statement string, opts *QueryOptions) (*QueryResult, error)
53+
exists(Method meth, string structName, string methodName |
54+
structName in ["Cluster", "Scope"] and
55+
methodName in ["AnalyticsQuery", "Query"] and
56+
meth.hasQualifiedName(packagePath(), structName, methodName) and
57+
this = meth.getACall().getArgument(0)
58+
)
59+
}
60+
}
2761
}

‎go/ql/lib/semmle/go/frameworks/NoSQL.qll

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,82 @@ module NoSql {
3131
)
3232
}
3333
}
34+
// /**
35+
// * Holds if method `name` of struct `Collection` from package
36+
// * [go.mongodb.org/mongo-driver/mongo](https://pkg.go.dev/go.mongodb.org/mongo-driver/mongo)
37+
// * interprets parameter `n` as a query.
38+
// */
39+
// private predicate mongoDbCollectionMethod(string name, int n) {
40+
// // func (coll *Collection) CountDocuments(ctx context.Context, filter interface{},
41+
// // opts ...*options.CountOptions) (int64, error)
42+
// name = "CountDocuments" and n = 1
43+
// or
44+
// // func (coll *Collection) DeleteMany(ctx context.Context, filter interface{},
45+
// // opts ...*options.DeleteOptions) (*DeleteResult, error)
46+
// name = "DeleteMany" and n = 1
47+
// or
48+
// // func (coll *Collection) DeleteOne(ctx context.Context, filter interface{},
49+
// // opts ...*options.DeleteOptions) (*DeleteResult, error)
50+
// name = "DeleteOne" and n = 1
51+
// or
52+
// // func (coll *Collection) Distinct(ctx context.Context, fieldName string, filter interface{},
53+
// // ...) ([]interface{}, error)
54+
// name = "Distinct" and n = 2
55+
// or
56+
// // func (coll *Collection) Find(ctx context.Context, filter interface{},
57+
// // opts ...*options.FindOptions) (*Cursor, error)
58+
// name = "Find" and n = 1
59+
// or
60+
// // func (coll *Collection) FindOne(ctx context.Context, filter interface{},
61+
// // opts ...*options.FindOneOptions) *SingleResult
62+
// name = "FindOne" and n = 1
63+
// or
64+
// // func (coll *Collection) FindOneAndDelete(ctx context.Context, filter interface{}, ...)
65+
// // *SingleResult
66+
// name = "FindOneAndDelete" and n = 1
67+
// or
68+
// // func (coll *Collection) FindOneAndReplace(ctx context.Context, filter interface{},
69+
// // replacement interface{}, ...) *SingleResult
70+
// name = "FindOneAndReplace" and n = 1
71+
// or
72+
// // func (coll *Collection) FindOneAndUpdate(ctx context.Context, filter interface{},
73+
// // update interface{}, ...) *SingleResult
74+
// name = "FindOneAndUpdate" and n = 1
75+
// or
76+
// // func (coll *Collection) ReplaceOne(ctx context.Context, filter interface{},
77+
// // replacement interface{}, ...) (*UpdateResult, error)
78+
// name = "ReplaceOne" and n = 1
79+
// or
80+
// // func (coll *Collection) UpdateMany(ctx context.Context, filter interface{},
81+
// // update interface{}, ...) (*UpdateResult, error)
82+
// name = "UpdateMany" and n = 1
83+
// or
84+
// // func (coll *Collection) UpdateOne(ctx context.Context, filter interface{},
85+
// // update interface{}, ...) (*UpdateResult, error)
86+
// name = "UpdateOne" and n = 1
87+
// or
88+
// // func (coll *Collection) Watch(ctx context.Context, pipeline interface{}, ...)
89+
// // (*ChangeStream, error)
90+
// name = "Watch" and n = 1
91+
// or
92+
// // func (coll *Collection) Aggregate(ctx context.Context, pipeline interface{},
93+
// // opts ...*options.AggregateOptions) (*Cursor, error)
94+
// name = "Aggregate" and n = 1
95+
// }
96+
// /**
97+
// * A query used in an API function acting on a `Collection` struct of package
98+
// * [go.mongodb.org/mongo-driver/mongo](https://pkg.go.dev/go.mongodb.org/mongo-driver/mongo).
99+
// */
100+
// private class MongoDbCollectionQuery extends Range {
101+
// MongoDbCollectionQuery() {
102+
// exists(Method meth, string methodName, int n |
103+
// mongoDbCollectionMethod(methodName, n) and
104+
// meth.hasQualifiedName(package("go.mongodb.org/mongo-driver", "mongo"), "Collection",
105+
// methodName) and
106+
// this = meth.getACall().getArgument(n)
107+
// )
108+
// }
109+
// }
34110
}
35111

36112
/**

0 commit comments

Comments
 (0)