Skip to content

Commit ce0cb12

Browse files
owen-mcowen-mc
committed
Upgrade and convert gorqlite sql-injection sinks to MaD
1 parent 06f86dd commit ce0cb12

File tree

10 files changed

+245
-45
lines changed

10 files changed

+245
-45
lines changed

‎go/ql/lib/ext/github.com.rqlite.gorqlite.model.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: packageGrouping
5+
data:
6+
- ["gorqlite", "github.com/rqlite/gorqlite"]
7+
- ["gorqlite", "github.com/raindog308/gorqlite"]
8+
- addsTo:
9+
pack: codeql/go-all
10+
extensible: sinkModel
11+
data:
12+
- ["group:gorqlite", "Connection", True, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
13+
- ["group:gorqlite", "Connection", True, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
14+
- ["group:gorqlite", "Connection", True, "QueryOne", "", "", "Argument[0]", "sql-injection", "manual"]
15+
- ["group:gorqlite", "Connection", True, "QueryOneContext", "", "", "Argument[1]", "sql-injection", "manual"]
16+
- ["group:gorqlite", "Connection", True, "QueryOneParameterized", "", "", "Argument[0]", "sql-injection", "manual"]
17+
- ["group:gorqlite", "Connection", True, "QueryOneParameterizedContext", "", "", "Argument[1]", "sql-injection", "manual"]
18+
- ["group:gorqlite", "Connection", True, "QueryParameterized", "", "", "Argument[0]", "sql-injection", "manual"]
19+
- ["group:gorqlite", "Connection", True, "QueryParameterizedContext", "", "", "Argument[1]", "sql-injection", "manual"]
20+
- ["group:gorqlite", "Connection", True, "Queue", "", "", "Argument[0]", "sql-injection", "manual"]
21+
- ["group:gorqlite", "Connection", True, "QueueContext", "", "", "Argument[1]", "sql-injection", "manual"]
22+
- ["group:gorqlite", "Connection", True, "QueueOne", "", "", "Argument[0]", "sql-injection", "manual"]
23+
- ["group:gorqlite", "Connection", True, "QueueOneContext", "", "", "Argument[1]", "sql-injection", "manual"]
24+
- ["group:gorqlite", "Connection", True, "QueueOneParameterized", "", "", "Argument[0]", "sql-injection", "manual"]
25+
- ["group:gorqlite", "Connection", True, "QueueOneParameterizedContext", "", "", "Argument[1]", "sql-injection", "manual"]
26+
- ["group:gorqlite", "Connection", True, "QueueParameterized", "", "", "Argument[0]", "sql-injection", "manual"]
27+
- ["group:gorqlite", "Connection", True, "QueueParameterizedContext", "", "", "Argument[1]", "sql-injection", "manual"]
28+
- ["group:gorqlite", "Connection", True, "Write", "", "", "Argument[0]", "sql-injection", "manual"]
29+
- ["group:gorqlite", "Connection", True, "WriteContext", "", "", "Argument[1]", "sql-injection", "manual"]
30+
- ["group:gorqlite", "Connection", True, "WriteOne", "", "", "Argument[0]", "sql-injection", "manual"]
31+
- ["group:gorqlite", "Connection", True, "WriteOneContext", "", "", "Argument[1]", "sql-injection", "manual"]
32+
- ["group:gorqlite", "Connection", True, "WriteOneParameterized", "", "", "Argument[0]", "sql-injection", "manual"]
33+
- ["group:gorqlite", "Connection", True, "WriteOneParameterizedContext", "", "", "Argument[1]", "sql-injection", "manual"]
34+
- ["group:gorqlite", "Connection", True, "WriteParameterized", "", "", "Argument[0]", "sql-injection", "manual"]
35+
- ["group:gorqlite", "Connection", True, "WriteParameterizedContext", "", "", "Argument[1]", "sql-injection", "manual"]

‎go/ql/lib/semmle/go/frameworks/SQL.qll

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -85,11 +85,6 @@ module SQL {
8585
/** A string that might identify package `go-pg/pg/orm` or a specific version of it. */
8686
private string gopgorm() { result = package("github.com/go-pg/pg", "orm") }
8787

88-
/** A string that might identify package `github.com/rqlite/gorqlite` or `github.com/raindog308/gorqlite` or a specific version of it. */
89-
private string gorqlite() {
90-
result = package(["github.com/rqlite/gorqlite", "github.com/raindog308/gorqlite"], "")
91-
}
92-
9388
/** A string that might identify package `github.com/gogf/gf/database/gdb` or a specific version of it. */
9489
private string gogf() { result = package("github.com/gogf/gf", "database/gdb") }
9590

@@ -158,25 +153,6 @@ module SQL {
158153
}
159154
}
160155

161-
/**
162-
* A string argument to an API of `github.com/rqlite/gorqlite`, or a specific version of it, that is directly interpreted as SQL without
163-
* taking syntactic structure into account.
164-
*/
165-
private class GorqliteQueryString extends Range {
166-
GorqliteQueryString() {
167-
// func (conn *Connection) Query(sqlStatements []string) (results []QueryResult, err error)
168-
// func (conn *Connection) QueryOne(sqlStatement string) (qr QueryResult, err error)
169-
// func (conn *Connection) Queue(sqlStatements []string) (seq int64, err error)
170-
// func (conn *Connection) QueueOne(sqlStatement string) (seq int64, err error)
171-
// func (conn *Connection) Write(sqlStatements []string) (results []WriteResult, err error)
172-
// func (conn *Connection) WriteOne(sqlStatement string) (wr WriteResult, err error)
173-
exists(Method m, string name | m.hasQualifiedName(gorqlite(), "Connection", name) |
174-
name = ["Query", "QueryOne", "Queue", "QueueOne", "Write", "WriteOne"] and
175-
this = m.getACall().getArgument(0)
176-
)
177-
}
178-
}
179-
180156
/**
181157
* A string argument to an API of `github.com/gogf/gf/database/gdb`, or a specific version of it, that is directly interpreted as SQL without
182158
* taking syntactic structure into account.

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gorqlite/QueryString.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
testFailures
2+
invalidModelRow
3+
failures

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gorqlite/QueryString.ql

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
import go
2+
import semmle.go.dataflow.ExternalFlow
3+
import ModelValidation
4+
import TestUtilities.InlineExpectationsTest
5+
6+
module SqlTest implements TestSig {
7+
string getARelevantTag() { result = "query" }
8+
9+
predicate hasActualResult(Location location, string element, string tag, string value) {
10+
tag = "query" and
11+
exists(SQL::Query q, SQL::QueryString qs | qs = q.getAQueryString() |
12+
q.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
13+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
14+
element = q.toString() and
15+
value = qs.toString()
16+
)
17+
}
18+
}
19+
20+
module QueryString implements TestSig {
21+
string getARelevantTag() { result = "querystring" }
22+
23+
predicate hasActualResult(Location location, string element, string tag, string value) {
24+
tag = "querystring" and
25+
element = "" and
26+
exists(SQL::QueryString qs | not exists(SQL::Query q | qs = q.getAQueryString()) |
27+
qs.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
28+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
29+
value = qs.toString()
30+
)
31+
}
32+
}
33+
34+
module Config implements DataFlow::ConfigSig {
35+
predicate isSource(DataFlow::Node n) { n.asExpr() instanceof StringLit }
36+
37+
predicate isSink(DataFlow::Node n) {
38+
n = any(DataFlow::CallNode cn | cn.getTarget().getName() = "sink").getAnArgument()
39+
}
40+
}
41+
42+
module Flow = TaintTracking::Global<Config>;
43+
44+
module TaintFlow implements TestSig {
45+
string getARelevantTag() { result = "flowfrom" }
46+
47+
predicate hasActualResult(Location location, string element, string tag, string value) {
48+
tag = "flowfrom" and
49+
element = "" and
50+
exists(DataFlow::Node fromNode, DataFlow::Node toNode |
51+
toNode
52+
.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
53+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
54+
Flow::flow(fromNode, toNode) and
55+
value = fromNode.asExpr().(StringLit).getValue()
56+
)
57+
}
58+
}
59+
60+
import MakeTest<MergeTests3<SqlTest, QueryString, TaintFlow>>

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gorqlite/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@ module main
22

33
go 1.18
44

5-
require github.com/rqlite/gorqlite v0.0.0-20220528150909-c4e99ae96be6
5+
require github.com/rqlite/gorqlite v0.0.0-20240808172217-12ae7d03ef19

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gorqlite/gorqlite.expected

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gorqlite/gorqlite.go

Lines changed: 34 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,49 @@
11
package main
22

3-
//go:generate depstubber -vendor github.com/rqlite/gorqlite Connection Open
3+
//go:generate depstubber -vendor github.com/rqlite/gorqlite Connection,ParameterizedStatement Open
44

55
import (
6+
"context"
7+
68
"github.com/rqlite/gorqlite"
79
)
810

9-
func gorqlitetest(sql string, sqls []string) {
11+
func gorqlitetest(sql string, sqls []string, param_sql gorqlite.ParameterizedStatement, param_sqls []gorqlite.ParameterizedStatement, ctx context.Context) {
1012
conn, _ := gorqlite.Open("dbUrl")
11-
conn.Query(sqls) // $ querystring=sqls
12-
conn.Queue(sqls) // $ querystring=sqls
13-
conn.Write(sqls) // $ querystring=sqls
13+
14+
conn.Query(sqls) // $ querystring=sqls
15+
conn.Queue(sqls) // $ querystring=sqls
16+
conn.Write(sqls) // $ querystring=sqls
17+
1418
conn.QueryOne(sql) // $ querystring=sql
1519
conn.QueueOne(sql) // $ querystring=sql
1620
conn.WriteOne(sql) // $ querystring=sql
21+
22+
conn.QueryParameterized(param_sqls) // $ querystring=param_sqls
23+
conn.QueueParameterized(param_sqls) // $ querystring=param_sqls
24+
conn.WriteParameterized(param_sqls) // $ querystring=param_sqls
25+
26+
conn.QueryOneParameterized(param_sql) // $ querystring=param_sql
27+
conn.QueueOneParameterized(param_sql) // $ querystring=param_sql
28+
conn.WriteOneParameterized(param_sql) // $ querystring=param_sql
29+
30+
conn.QueryContext(ctx, sqls) // $ querystring=sqls
31+
conn.QueueContext(ctx, sqls) // $ querystring=sqls
32+
conn.WriteContext(ctx, sqls) // $ querystring=sqls
33+
34+
conn.QueryOneContext(ctx, sql) // $ querystring=sql
35+
conn.QueueOneContext(ctx, sql) // $ querystring=sql
36+
conn.WriteOneContext(ctx, sql) // $ querystring=sql
37+
38+
conn.QueryParameterizedContext(ctx, param_sqls) // $ querystring=param_sqls
39+
conn.QueueParameterizedContext(ctx, param_sqls) // $ querystring=param_sqls
40+
conn.WriteParameterizedContext(ctx, param_sqls) // $ querystring=param_sqls
41+
42+
conn.QueryOneParameterizedContext(ctx, param_sql) // $ querystring=param_sql
43+
conn.QueueOneParameterizedContext(ctx, param_sql) // $ querystring=param_sql
44+
conn.WriteOneParameterizedContext(ctx, param_sql) // $ querystring=param_sql
1745
}
46+
1847
func main() {
1948
return
2049
}

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gorqlite/gorqlite.ql

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gorqlite/vendor/github.com/rqlite/gorqlite/stub.go

Lines changed: 111 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gorqlite/vendor/modules.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
# github.com/rqlite/gorqlite v0.0.0-20220528150909-c4e99ae96be6
1+
# github.com/rqlite/gorqlite v0.0.0-20240808172217-12ae7d03ef19
22
## explicit
33
github.com/rqlite/gorqlite

0 commit comments

Comments
 (0)