Merge pull request github#13644 from porcupineyhairs/dsnImprove

Go : Improvements to DSN Injection query

Author: owen-mc

go/ql/src/experimental/CWE-134/DsnBad.go renamed to go/ql/src/experimental/CWE-74/DsnBad.go

@@ -6,7 +6,7 @@
  * @id go/dsn-injection
  * @tags security
  *       experimental
- *       external/cwe/cwe-134
+ *       external/cwe/cwe-74
  */
 
 import go
@@ -18,5 +18,5 @@ private class UntrustedFlowAsSource extends Source instanceof UntrustedFlowSourc
 
 from DsnInjection cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "This query depends on a $@.", source.getNode(),
-  "user-provided value"
+select sink.getNode(), source, sink, "Data-Source Name is built using $@.", source.getNode(),
+  "untrusted user input"

go/ql/src/experimental/CWE-134/DsnGood.go renamed to go/ql/src/experimental/CWE-74/DsnGood.go

@@ -14,8 +14,11 @@ class DsnInjection extends TaintTracking::Configuration {
   override predicate isSource(DataFlow::Node node) { node instanceof Source }
 
   override predicate isSink(DataFlow::Node node) {
-    exists(Function f | f.hasQualifiedName("database/sql", "Open") |
-      node = f.getACall().getArgument(1)
+    exists(DataFlow::CallNode c |
+      c.getTarget().hasQualifiedName("database/sql", "Open") and
+      c.getArgument(0).getStringValue() = "mysql"
+    |
+      node = c.getArgument(1)
     )
   }
 

go/ql/src/experimental/CWE-134/DsnInjection.qhelp renamed to go/ql/src/experimental/CWE-74/DsnInjection.qhelp

@@ -6,7 +6,7 @@
  * @id go/dsn-injection-local
  * @tags security
  *       experimental
- *       external/cwe/cwe-134
+ *       external/cwe/cwe-74
  */
 
 import go

go/ql/src/experimental/CWE-134/DsnInjection.ql renamed to go/ql/src/experimental/CWE-74/DsnInjection.ql

@@ -9,4 +9,4 @@ nodes
 | Dsn.go:50:29:50:33 | dbDSN | semmle.label | dbDSN |
 subpaths
 #select
-| Dsn.go:50:29:50:33 | dbDSN | Dsn.go:47:10:47:30 | call to FormValue | Dsn.go:50:29:50:33 | dbDSN | This query depends on a $@. | Dsn.go:47:10:47:30 | call to FormValue | user-provided value |
+| Dsn.go:50:29:50:33 | dbDSN | Dsn.go:47:10:47:30 | call to FormValue | Dsn.go:50:29:50:33 | dbDSN | Data-Source Name is built using $@. | Dsn.go:47:10:47:30 | call to FormValue | untrusted user input |