Skip to content

Commit db559f7

Browse files
owen-mcowen-mc
committed
Convert gogf/gf sql-injection sinks to MaD
1 parent ce0cb12 commit db559f7

File tree

7 files changed

+140
-112
lines changed

7 files changed

+140
-112
lines changed

‎go/ql/lib/ext/github.com.gogf.gf.database.gdb.model.yml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: sinkModel
5+
data:
6+
# These models are for v1. Some of them hold for v2, but we should model v2 properly.
7+
- ["github.com/gogf/gf/database/gdb", "Core", True, "DoCommit", "", "", "Argument[2]", "sql-injection", "manual"]
8+
- ["github.com/gogf/gf/database/gdb", "Core", True, "DoExec", "", "", "Argument[2]", "sql-injection", "manual"]
9+
- ["github.com/gogf/gf/database/gdb", "Core", True, "DoGetAll", "", "", "Argument[2]", "sql-injection", "manual"]
10+
- ["github.com/gogf/gf/database/gdb", "Core", True, "DoQuery", "", "", "Argument[2]", "sql-injection", "manual"]
11+
- ["github.com/gogf/gf/database/gdb", "Core", True, "DoPrepare", "", "", "Argument[2]", "sql-injection", "manual"]
12+
- ["github.com/gogf/gf/database/gdb", "Core", True, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
13+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetAll", "", "", "Argument[0]", "sql-injection", "manual"]
14+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetArray", "", "", "Argument[0]", "sql-injection", "manual"]
15+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetCount", "", "", "Argument[0]", "sql-injection", "manual"]
16+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetOne", "", "", "Argument[0]", "sql-injection", "manual"]
17+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetScan", "", "", "Argument[1]", "sql-injection", "manual"]
18+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetStruct", "", "", "Argument[1]", "sql-injection", "manual"]
19+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetStructs", "", "", "Argument[1]", "sql-injection", "manual"]
20+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetValue", "", "", "Argument[0]", "sql-injection", "manual"]
21+
- ["github.com/gogf/gf/database/gdb", "Core", True, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
22+
- ["github.com/gogf/gf/database/gdb", "Core", True, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
23+
- ["github.com/gogf/gf/database/gdb", "Core", True, "Raw", "", "", "Argument[0]", "sql-injection", "manual"]
24+
- ["github.com/gogf/gf/database/gdb", "DB", True, "DoCommit", "", "", "Argument[2]", "sql-injection", "manual"]
25+
- ["github.com/gogf/gf/database/gdb", "DB", True, "DoExec", "", "", "Argument[2]", "sql-injection", "manual"]
26+
- ["github.com/gogf/gf/database/gdb", "DB", True, "DoGetAll", "", "", "Argument[2]", "sql-injection", "manual"]
27+
- ["github.com/gogf/gf/database/gdb", "DB", True, "DoQuery", "", "", "Argument[2]", "sql-injection", "manual"]
28+
- ["github.com/gogf/gf/database/gdb", "DB", True, "DoPrepare", "", "", "Argument[2]", "sql-injection", "manual"]
29+
- ["github.com/gogf/gf/database/gdb", "DB", True, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
30+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetAll", "", "", "Argument[0]", "sql-injection", "manual"]
31+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetArray", "", "", "Argument[0]", "sql-injection", "manual"]
32+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetCount", "", "", "Argument[0]", "sql-injection", "manual"]
33+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetOne", "", "", "Argument[0]", "sql-injection", "manual"]
34+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetScan", "", "", "Argument[1]", "sql-injection", "manual"]
35+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetStruct", "", "", "Argument[1]", "sql-injection", "manual"]
36+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetStructs", "", "", "Argument[1]", "sql-injection", "manual"]
37+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetValue", "", "", "Argument[0]", "sql-injection", "manual"]
38+
- ["github.com/gogf/gf/database/gdb", "DB", True, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
39+
- ["github.com/gogf/gf/database/gdb", "DB", True, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
40+
- ["github.com/gogf/gf/database/gdb", "DB", True, "Raw", "", "", "Argument[0]", "sql-injection", "manual"]
41+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "DoCommit", "", "", "Argument[2]", "sql-injection", "manual"]
42+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "DoExec", "", "", "Argument[2]", "sql-injection", "manual"]
43+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "DoGetAll", "", "", "Argument[2]", "sql-injection", "manual"]
44+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "DoQuery", "", "", "Argument[2]", "sql-injection", "manual"]
45+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "DoPrepare", "", "", "Argument[2]", "sql-injection", "manual"]
46+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
47+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "GetAll", "", "", "Argument[0]", "sql-injection", "manual"]
48+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "GetArray", "", "", "Argument[0]", "sql-injection", "manual"]
49+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "GetCount", "", "", "Argument[0]", "sql-injection", "manual"]
50+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "GetOne", "", "", "Argument[0]", "sql-injection", "manual"]
51+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "GetScan", "", "", "Argument[1]", "sql-injection", "manual"]
52+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "GetStruct", "", "", "Argument[1]", "sql-injection", "manual"]
53+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "GetStructs", "", "", "Argument[1]", "sql-injection", "manual"]
54+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "GetValue", "", "", "Argument[0]", "sql-injection", "manual"]
55+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
56+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
57+
- ["github.com/gogf/gf/database/gdb", "Tx", True, "Raw", "", "", "Argument[0]", "sql-injection", "manual"]

‎go/ql/lib/semmle/go/frameworks/SQL.qll

Lines changed: 0 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -85,9 +85,6 @@ module SQL {
8585
/** A string that might identify package `go-pg/pg/orm` or a specific version of it. */
8686
private string gopgorm() { result = package("github.com/go-pg/pg", "orm") }
8787

88-
/** A string that might identify package `github.com/gogf/gf/database/gdb` or a specific version of it. */
89-
private string gogf() { result = package("github.com/gogf/gf", "database/gdb") }
90-
9188
/**
9289
* A string argument to an API of `go-pg/pg` that is directly interpreted as SQL without
9390
* taking syntactic structure into account.
@@ -152,46 +149,6 @@ module SQL {
152149
)
153150
}
154151
}
155-
156-
/**
157-
* A string argument to an API of `github.com/gogf/gf/database/gdb`, or a specific version of it, that is directly interpreted as SQL without
158-
* taking syntactic structure into account.
159-
*/
160-
private class GogfQueryString extends Range {
161-
GogfQueryString() {
162-
exists(Method m, string name | m.implements(gogf(), ["DB", "Core", "TX"], name) |
163-
// func (c *Core) Exec(sql string, args ...interface{}) (result sql.Result, err error)
164-
// func (c *Core) GetAll(sql string, args ...interface{}) (Result, error)
165-
// func (c *Core) GetArray(sql string, args ...interface{}) ([]Value, error)
166-
// func (c *Core) GetCount(sql string, args ...interface{}) (int, error)
167-
// func (c *Core) GetOne(sql string, args ...interface{}) (Record, error)
168-
// func (c *Core) GetValue(sql string, args ...interface{}) (Value, error)
169-
// func (c *Core) Prepare(sql string, execOnMaster ...bool) (*Stmt, error)
170-
// func (c *Core) Query(sql string, args ...interface{}) (rows *sql.Rows, err error)
171-
// func (c *Core) Raw(rawSql string, args ...interface{}) *Model
172-
name =
173-
[
174-
"Query", "Exec", "Prepare", "GetAll", "GetOne", "GetValue", "GetArray", "GetCount",
175-
"Raw"
176-
] and
177-
this = m.getACall().getArgument(0)
178-
or
179-
// func (c *Core) GetScan(pointer interface{}, sql string, args ...interface{}) error
180-
// func (c *Core) GetStruct(pointer interface{}, sql string, args ...interface{}) error
181-
// func (c *Core) GetStructs(pointer interface{}, sql string, args ...interface{}) error
182-
name = ["GetScan", "GetStruct", "GetStructs"] and
183-
this = m.getACall().getArgument(1)
184-
or
185-
// func (c *Core) DoCommit(ctx context.Context, link Link, sql string, args []interface{}) (newSql string, newArgs []interface{}, err error)
186-
// func (c *Core) DoExec(ctx context.Context, link Link, sql string, args ...interface{}) (result sql.Result, err error)
187-
// func (c *Core) DoGetAll(ctx context.Context, link Link, sql string, args ...interface{}) (result Result, err error)
188-
// func (c *Core) DoPrepare(ctx context.Context, link Link, sql string) (*Stmt, error)
189-
// func (c *Core) DoQuery(ctx context.Context, link Link, sql string, args ...interface{}) (rows *sql.Rows, err error)
190-
name = ["DoGetAll", "DoQuery", "DoExec", "DoCommit", "DoPrepare"] and
191-
this = m.getACall().getArgument(2)
192-
)
193-
}
194-
}
195152
}
196153

197154
/** A model for sinks of GORM. */

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gogf/QueryString.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
testFailures
2+
invalidModelRow
3+
failures

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gogf/QueryString.ql

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
import go
2+
import semmle.go.dataflow.ExternalFlow
3+
import ModelValidation
4+
import TestUtilities.InlineExpectationsTest
5+
6+
module SqlTest implements TestSig {
7+
string getARelevantTag() { result = "query" }
8+
9+
predicate hasActualResult(Location location, string element, string tag, string value) {
10+
tag = "query" and
11+
exists(SQL::Query q, SQL::QueryString qs | qs = q.getAQueryString() |
12+
q.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
13+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
14+
element = q.toString() and
15+
value = qs.toString()
16+
)
17+
}
18+
}
19+
20+
module QueryString implements TestSig {
21+
string getARelevantTag() { result = "querystring" }
22+
23+
predicate hasActualResult(Location location, string element, string tag, string value) {
24+
tag = "querystring" and
25+
element = "" and
26+
exists(SQL::QueryString qs | not exists(SQL::Query q | qs = q.getAQueryString()) |
27+
qs.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
28+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
29+
value = qs.toString()
30+
)
31+
}
32+
}
33+
34+
module Config implements DataFlow::ConfigSig {
35+
predicate isSource(DataFlow::Node n) { n.asExpr() instanceof StringLit }
36+
37+
predicate isSink(DataFlow::Node n) {
38+
n = any(DataFlow::CallNode cn | cn.getTarget().getName() = "sink").getAnArgument()
39+
}
40+
}
41+
42+
module Flow = TaintTracking::Global<Config>;
43+
44+
module TaintFlow implements TestSig {
45+
string getARelevantTag() { result = "flowfrom" }
46+
47+
predicate hasActualResult(Location location, string element, string tag, string value) {
48+
tag = "flowfrom" and
49+
element = "" and
50+
exists(DataFlow::Node fromNode, DataFlow::Node toNode |
51+
toNode
52+
.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
53+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
54+
Flow::flow(fromNode, toNode) and
55+
value = fromNode.asExpr().(StringLit).getValue()
56+
)
57+
}
58+
}
59+
60+
import MakeTest<MergeTests3<SqlTest, QueryString, TaintFlow>>

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gogf/gogf.expected

Lines changed: 0 additions & 47 deletions
This file was deleted.

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gogf/gogf.go

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,13 @@ package main
44
//go:generate depstubber -vendor github.com/gogf/gf/database/gdb DB,Core,TX ""
55

66
import (
7+
"context"
8+
79
"github.com/gogf/gf/database/gdb"
810
"github.com/gogf/gf/frame/g"
911
)
1012

11-
func gogfCoreTest(sql string, c *gdb.Core) {
13+
func gogfCoreTest(sql string, c *gdb.Core, ctx context.Context) {
1214
c.Exec(sql, nil) // $ querystring=sql
1315
c.GetAll(sql, nil) // $ querystring=sql
1416
c.GetArray(sql, nil) // $ querystring=sql
@@ -21,14 +23,14 @@ func gogfCoreTest(sql string, c *gdb.Core) {
2123
c.GetScan(nil, sql, nil) // $ querystring=sql
2224
c.GetStruct(nil, sql, nil) // $ querystring=sql
2325
c.GetStructs(nil, sql, nil) // $ querystring=sql
24-
c.DoCommit(nil, nil, sql, nil) // $ querystring=sql
25-
c.DoExec(nil, nil, sql, nil) // $ querystring=sql
26-
c.DoGetAll(nil, nil, sql, nil) // $ querystring=sql
27-
c.DoQuery(nil, nil, sql, nil) // $ querystring=sql
28-
c.DoPrepare(nil, nil, sql) // $ querystring=sql
26+
c.DoCommit(ctx, nil, sql, nil) // $ querystring=sql
27+
c.DoExec(ctx, nil, sql, nil) // $ querystring=sql
28+
c.DoGetAll(ctx, nil, sql, nil) // $ querystring=sql
29+
c.DoQuery(ctx, nil, sql, nil) // $ querystring=sql
30+
c.DoPrepare(ctx, nil, sql) // $ querystring=sql
2931
}
3032

31-
func gogfDbtest(sql string, c gdb.DB) {
33+
func gogfDbtest(sql string, c gdb.DB, ctx context.Context) {
3234
c.Exec(sql, nil) // $ querystring=sql
3335
c.GetAll(sql, nil) // $ querystring=sql
3436
c.GetArray(sql, nil) // $ querystring=sql
@@ -39,14 +41,14 @@ func gogfDbtest(sql string, c gdb.DB) {
3941
c.Query(sql, nil) // $ querystring=sql
4042
c.Raw(sql, nil) // $ querystring=sql
4143
c.GetScan(nil, sql, nil) // $ querystring=sql
42-
c.DoCommit(nil, nil, sql, nil) // $ querystring=sql
43-
c.DoExec(nil, nil, sql, nil) // $ querystring=sql
44-
c.DoGetAll(nil, nil, sql, nil) // $ querystring=sql
45-
c.DoQuery(nil, nil, sql, nil) // $ querystring=sql
46-
c.DoPrepare(nil, nil, sql) // $ querystring=sql
44+
c.DoCommit(ctx, nil, sql, nil) // $ querystring=sql
45+
c.DoExec(ctx, nil, sql, nil) // $ querystring=sql
46+
c.DoGetAll(ctx, nil, sql, nil) // $ querystring=sql
47+
c.DoQuery(ctx, nil, sql, nil) // $ querystring=sql
48+
c.DoPrepare(ctx, nil, sql) // $ querystring=sql
4749
}
4850

49-
func gogfGTest(sql string) {
51+
func gogfGTest(sql string, ctx context.Context) {
5052
c := g.DB("ad")
5153
c.Exec(sql, nil) // $ querystring=sql
5254
c.GetAll(sql, nil) // $ querystring=sql
@@ -58,11 +60,11 @@ func gogfGTest(sql string) {
5860
c.Query(sql, nil) // $ querystring=sql
5961
c.Raw(sql, nil) // $ querystring=sql
6062
c.GetScan(nil, sql, nil) // $ querystring=sql
61-
c.DoCommit(nil, nil, sql, nil) // $ querystring=sql
62-
c.DoExec(nil, nil, sql, nil) // $ querystring=sql
63-
c.DoGetAll(nil, nil, sql, nil) // $ querystring=sql
64-
c.DoQuery(nil, nil, sql, nil) // $ querystring=sql
65-
c.DoPrepare(nil, nil, sql) // $ querystring=sql
63+
c.DoCommit(ctx, nil, sql, nil) // $ querystring=sql
64+
c.DoExec(ctx, nil, sql, nil) // $ querystring=sql
65+
c.DoGetAll(ctx, nil, sql, nil) // $ querystring=sql
66+
c.DoQuery(ctx, nil, sql, nil) // $ querystring=sql
67+
c.DoPrepare(ctx, nil, sql) // $ querystring=sql
6668
}
6769

6870
func main() {

‎go/ql/test/library-tests/semmle/go/frameworks/SQL/gogf/gogf.ql

Lines changed: 0 additions & 4 deletions
This file was deleted.

0 commit comments

Comments
 (0)