Rust: Address review comments.

geoffw0 · geoffw0 · commit d828941b7c02 · 2024-11-20T22:39:27.000Z
diff --git a/rust/ql/src/queries/security/CWE-089/SqlInjection.ql b/rust/ql/src/queries/security/CWE-089/SqlInjection.ql
@@ -27,9 +27,6 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
   predicate isBarrier(DataFlow::Node barrier) { barrier instanceof SqlInjection::Barrier }
 }
 
-/**
- * Detect taint flow of tainted data that reaches a SQL sink.
- */
 module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;
 
 from SqlInjectionFlow::PathNode sourceNode, SqlInjectionFlow::PathNode sinkNode
diff --git a/rust/ql/src/queries/security/CWE-089/SqlInjectionBad.rs b/rust/ql/src/queries/security/CWE-089/SqlInjectionBad.rs
@@ -4,4 +4,4 @@ let unsafe_query = format!("SELECT * FROM people WHERE firstname='{remote_contro
 
 let _ = conn.execute(unsafe_query.as_str()).await?; // BAD (arbitrary SQL injection is possible)
 
-let _ = sqlx::query(unsafe_query.as_str()).fetch_all(&mut conn).await?; // $ BAD (arbitrary SQL injection is possible)
+let _ = sqlx::query(unsafe_query.as_str()).fetch_all(&mut conn).await?; // BAD (arbitrary SQL injection is possible)

Original file line number	Diff line number	Diff line change
`@@ -27,9 +27,6 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {`
`27`	`27`	`predicate isBarrier(DataFlow::Node barrier) { barrier instanceof SqlInjection::Barrier }`
`28`	`28`	`}`
`29`	`29`
`30`		`-/**`
`31`		`- * Detect taint flow of tainted data that reaches a SQL sink.`
`32`		`- */`
`33`	`30`	`module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;`
`34`	`31`
`35`	`32`	`from SqlInjectionFlow::PathNode sourceNode, SqlInjectionFlow::PathNode sinkNode`
Original file line number	Diff line number	Diff line change
`@@ -4,4 +4,4 @@ let unsafe_query = format!("SELECT * FROM people WHERE firstname='{remote_contro`
`4`	`4`
`5`	`5`	`let _ = conn.execute(unsafe_query.as_str()).await?; // BAD (arbitrary SQL injection is possible)`
`6`	`6`
`7`		`-let _ = sqlx::query(unsafe_query.as_str()).fetch_all(&mut conn).await?; // $ BAD (arbitrary SQL injection is possible)`
	`7`	`+let _ = sqlx::query(unsafe_query.as_str()).fetch_all(&mut conn).await?; // BAD (arbitrary SQL injection is possible)`