Model some squirrel methods in QL

We need to put a restriction on the type of the argument.

Author: owen-mc

go/ql/lib/ext/github.com.mastermind.squirrel.model.yml

@@ -20,7 +20,7 @@ extensions:
       - ["group:squirrel", "DeleteBuilder", True, "OrderBy", "", "", "Argument[0]", "sql-injection", "manual"] # TODO: when sources can have access paths, use .ArrayElement
       - ["group:squirrel", "DeleteBuilder", True, "Prefix", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["group:squirrel", "DeleteBuilder", True, "Suffix", "", "", "Argument[0]", "sql-injection", "manual"]
-      - ["group:squirrel", "DeleteBuilder", True, "Where", "", "", "Argument[0]", "sql-injection", "manual"]
+      # DeleteBuilder.Where has to be modeled in QL to avoid FPs when a non-string argument is used
 
       - ["group:squirrel", "InsertBuilder", True, "Columns", "", "", "Argument[0]", "sql-injection", "manual"] # TODO: when sources can have access paths, use .ArrayElement
       - ["group:squirrel", "InsertBuilder", True, "Into", "", "", "Argument[0]", "sql-injection", "manual"]
@@ -40,12 +40,12 @@ extensions:
       - ["group:squirrel", "SelectBuilder", True, "Prefix", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["group:squirrel", "SelectBuilder", True, "RightJoin", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["group:squirrel", "SelectBuilder", True, "Suffix", "", "", "Argument[0]", "sql-injection", "manual"]
-      - ["group:squirrel", "SelectBuilder", True, "Where", "", "", "Argument[0]", "sql-injection", "manual"]
+      # SelectBuilder.Where has to be modeled in QL to avoid FPs when a non-string argument is used
 
       - ["group:squirrel", "UpdateBuilder", True, "From", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["group:squirrel", "UpdateBuilder", True, "OrderBy", "", "", "Argument[0]", "sql-injection", "manual"] # TODO: when sources can have access paths, use .ArrayElement
       - ["group:squirrel", "UpdateBuilder", True, "Prefix", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["group:squirrel", "UpdateBuilder", True, "Set", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["group:squirrel", "UpdateBuilder", True, "Suffix", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["group:squirrel", "UpdateBuilder", True, "Table", "", "", "Argument[0]", "sql-injection", "manual"]
-      - ["group:squirrel", "UpdateBuilder", True, "Where", "", "", "Argument[0]", "sql-injection", "manual"]
+      # UpdateBuilder.Where has to be modeled in QL to avoid FPs when a non-string argument is used

go/ql/lib/semmle/go/frameworks/SQL.qll

@@ -79,6 +79,27 @@ module SQL {
       }
     }
 
+    /**
+     * An argument to an API of the squirrel library that is directly interpreted as SQL without
+     * taking syntactic structure into account.
+     */
+    private class SquirrelQueryString extends Range {
+      SquirrelQueryString() {
+        exists(string sq, Method m, string builder |
+          FlowExtensions::packageGrouping("squirrel", sq) and
+          builder = ["DeleteBuilder", "SelectBuilder", "UpdateBuilder"]
+        |
+          m.hasQualifiedName(sq, builder, "Where") and
+          this = m.getACall().getArgument(0)
+        ) and
+        (
+          this.getType().getUnderlyingType() instanceof StringType
+          or
+          this.getType().getUnderlyingType().(SliceType).getElementType() instanceof StringType
+        )
+      }
+    }
+
     /** A string that might identify package `go-pg/pg` or a specific version of it. */
     private string gopg() { result = package("github.com/go-pg/pg", "") }