Skip to content

Commit 60b422a

Browse files
committed
fix second round of code review. improve documents, fix better-sqlite3 method
1 parent eb552b7 commit 60b422a

File tree

3 files changed

+16
-21
lines changed

3 files changed

+16
-21
lines changed

javascript/ql/lib/semmle/javascript/frameworks/SQL.qll

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -123,9 +123,8 @@ private module Postgres {
123123
}
124124

125125
/**
126-
* Gets a Postgres Query class.
127-
*
128-
* Please note that according to [this documentation](https://node-postgres.com/apis/client) this is an advance feature
126+
* Gets the Postgres Query class.
127+
* This class can be used to create reusable query objects (see https://node-postgres.com/apis/client).
129128
*/
130129
API::Node query() { result = API::moduleImport("pg").getMember("Query") }
131130

@@ -309,20 +308,16 @@ private module Sqlite {
309308
*/
310309
private module BetterSqlite3 {
311310
/**
312-
* Gets an expression that constructs or returns a `better-sqlite3` database instance.
311+
* Gets a `better-sqlite3` database instance.
313312
*/
314313
API::Node database() {
315-
// initialDatabaseInstance is an instance of Database that constructed and instantiated in the first step of Database initialization,
316-
// not from a return value of the other library functions
317-
exists(API::Node initialDatabaseInstance |
318-
initialDatabaseInstance =
319-
[
320-
API::moduleImport("better-sqlite3").getInstance(),
321-
API::moduleImport("better-sqlite3").getReturn()
322-
]
323-
|
324-
result = [initialDatabaseInstance, initialDatabaseInstance.getMember("exec").getReturn()]
325-
)
314+
result =
315+
[
316+
API::moduleImport("better-sqlite3").getInstance(),
317+
API::moduleImport("better-sqlite3").getReturn()
318+
]
319+
or
320+
result = database().getMember("exec").getReturn()
326321
}
327322

328323
/** A call to a better-sqlite3 query method. */

javascript/ql/src/experimental/semmle/javascript/SQL.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
import javascript
66

7-
module ExperimentalSQL {
7+
module ExperimentalSql {
88
/**
99
* Provides SQL injection Sinks for the [TypeORM](https://www.npmjs.com/package/typeorm) package
1010
*/

javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,9 @@
8282
| sqlite3.js:7:8:7:45 | "UPDATE ... id = ?" |
8383
| sqlite3.js:8:8:8:45 | "UPDATE ... id = ?" |
8484
| sqlite-types.ts:4:12:4:49 | "UPDATE ... id = ?" |
85-
| sqlite.js:9:10:9:65 | 'SELECT ... id = 1" |
86-
| sqlite.js:12:10:12:65 | 'SELECT ... id = 1" |
87-
| sqlite.js:15:10:15:74 | 'INSERT ... ',100)' |
88-
| sqlite.js:18:14:19:18 | 'SELECT ... id = 1" |
89-
| sqlite.js:25:19:25:74 | 'SELECT ... id = 1" |
85+
| sqlite.js:8:10:8:65 | 'SELECT ... id = 1" |
86+
| sqlite.js:11:10:11:65 | 'SELECT ... id = 1" |
87+
| sqlite.js:14:10:14:50 | 'SELECT ... id > 5' |
88+
| sqlite.js:17:14:18:18 | 'SELECT ... id = 1" |
89+
| sqlite.js:24:19:24:74 | 'SELECT ... id = 1" |
9090
| sqliteArray.js:6:12:6:49 | "UPDATE ... id = ?" |

0 commit comments

Comments
 (0)