Go: convert sql-injection and nosql-injection sinks to use models-as-data by owen-mc · Pull Request #17242 · github/codeql

owen-mc · 2024-08-16T09:07:40Z

Convert sql-injection and nosql-injection sinks to use models-as-data. Follows on from #17177.

github-actions · 2024-08-16T09:10:34Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

go

Generated file changes for go

Changes to framework-coverage-go.rst:

-    `Couchbase official client(gocb) <https://github.com/couchbase/gocb>`_,"``github.com/couchbase/gocb*``, ``gopkg.in/couchbase/gocb*``",,36,
+    `Couchbase official client(gocb) <https://github.com/couchbase/gocb>`_,"``github.com/couchbase/gocb*``, ``gopkg.in/couchbase/gocb*``",,,8
-    `Couchbase unofficial client <http://www.github.com/couchbase/go-couchbase>`_,``github.com/couchbaselabs/gocb*``,,18,
+    `Couchbase unofficial client <http://www.github.com/couchbase/go-couchbase>`_,``github.com/couchbaselabs/gocb*``,,,4
-    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",16,584,74
+    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",16,584,104
-    `beego <https://beego.me/>`_,"``github.com/astaxie/beego*``, ``github.com/beego/beego*``",63,63,123
+    `beego <https://beego.me/>`_,"``github.com/astaxie/beego*``, ``github.com/beego/beego*``",63,63,213
-    Others,"``clevergo.tech/clevergo``, ``github.com/Sirupsen/logrus``, ``github.com/clevergo/clevergo``, ``github.com/codeskyblue/go-sh``, ``github.com/davecgh/go-spew/spew``, ``github.com/gofiber/fiber``, ``github.com/golang/glog``, ``github.com/sirupsen/logrus``, ``github.com/spf13/afero``, ``golang.org/x/crypto/ssh``, ``gopkg.in/glog``, ``k8s.io/klog``",,,564
+    Others,"``clevergo.tech/clevergo``, ``fixed-version:github.com/couchbase/gocb``, ``fixed-version:github.com/couchbaselabs/gocb``, ``fixed-version:gopkg.in/couchbase/gocb.v1``, ``github.com/Masterminds/squirrel``, ``github.com/Sirupsen/logrus``, ``github.com/clevergo/clevergo``, ``github.com/codeskyblue/go-sh``, ``github.com/davecgh/go-spew/spew``, ``github.com/go-gorm/gorm``, ``github.com/go-xorm/xorm``, ``github.com/gofiber/fiber``, ``github.com/gogf/gf/database/gdb``, ``github.com/golang/glog``, ``github.com/jinzhu/gorm``, ``github.com/jmoiron/sqlx``, ``github.com/lann/squirrel``, ``github.com/raindog308/gorqlite``, ``github.com/rqlite/gorqlite``, ``github.com/sirupsen/logrus``, ``github.com/spf13/afero``, ``github.com/uptrace/bun``, ``go.mongodb.org/mongo-driver/mongo``, ``golang.org/x/crypto/ssh``, ``gopkg.in/Masterminds/squirrel``, ``gopkg.in/glog``, ``gorm.io/gorm``, ``k8s.io/klog``, ``xorm.io/xorm``",,54,992
-    Totals,,267,906,943
+    Totals,,267,906,1503

Changes to framework-coverage-go.csv:

- package,sink,source,summary,sink:command-injection,sink:credentials-key,sink:jwt,sink:log-injection,sink:path-injection,sink:regex-use[0],sink:regex-use[1],sink:regex-use[c],sink:request-forgery,sink:request-forgery[TCP Addr + Port],sink:url-redirection,sink:url-redirection[0],sink:url-redirection[receiver],sink:xpath-injection,source:remote,summary:taint,summary:value
+ package,sink,source,summary,sink:command-injection,sink:credentials-key,sink:jwt,sink:log-injection,sink:nosql-injection,sink:path-injection,sink:regex-use[0],sink:regex-use[1],sink:regex-use[c],sink:request-forgery,sink:request-forgery[TCP Addr + Port],sink:sql-injection,sink:url-redirection,sink:url-redirection[0],sink:url-redirection[receiver],sink:xpath-injection,source:remote,summary:taint,summary:value
- ,,,8,,,,,,,,,,,,,,,,3,5
+ ,,,8,,,,,,,,,,,,,,,,,,3,5
- archive/tar,,,5,,,,,,,,,,,,,,,,5,
+ archive/tar,,,5,,,,,,,,,,,,,,,,,,5,
- archive/zip,,,6,,,,,,,,,,,,,,,,6,
+ archive/zip,,,6,,,,,,,,,,,,,,,,,,6,
- bufio,,,17,,,,,,,,,,,,,,,,17,
+ bufio,,,17,,,,,,,,,,,,,,,,,,17,
- bytes,,,43,,,,,,,,,,,,,,,,43,
+ bytes,,,43,,,,,,,,,,,,,,,,,,43,
- clevergo.tech/clevergo,1,,,,,,,,,,,,,,,1,,,,
+ clevergo.tech/clevergo,1,,,,,,,,,,,,,,,,,1,,,,
- compress/bzip2,,,1,,,,,,,,,,,,,,,,1,
+ compress/bzip2,,,1,,,,,,,,,,,,,,,,,,1,
- compress/flate,,,4,,,,,,,,,,,,,,,,4,
+ compress/flate,,,4,,,,,,,,,,,,,,,,,,4,
- compress/gzip,,,3,,,,,,,,,,,,,,,,3,
+ compress/gzip,,,3,,,,,,,,,,,,,,,,,,3,
- compress/lzw,,,1,,,,,,,,,,,,,,,,1,
+ compress/lzw,,,1,,,,,,,,,,,,,,,,,,1,
- compress/zlib,,,4,,,,,,,,,,,,,,,,4,
+ compress/zlib,,,4,,,,,,,,,,,,,,,,,,4,
- container/heap,,,5,,,,,,,,,,,,,,,,5,
+ container/heap,,,5,,,,,,,,,,,,,,,,,,5,
- container/list,,,20,,,,,,,,,,,,,,,,20,
+ container/list,,,20,,,,,,,,,,,,,,,,,,20,
- container/ring,,,5,,,,,,,,,,,,,,,,5,
+ container/ring,,,5,,,,,,,,,,,,,,,,,,5,
- context,,,5,,,,,,,,,,,,,,,,5,
+ context,,,5,,,,,,,,,,,,,,,,,,5,
- crypto,,,1,,,,,,,,,,,,,,,,1,
+ crypto,,,1,,,,,,,,,,,,,,,,,,1,
- crypto/cipher,,,3,,,,,,,,,,,,,,,,3,
+ crypto/cipher,,,3,,,,,,,,,,,,,,,,,,3,
- crypto/rsa,,,2,,,,,,,,,,,,,,,,2,
+ crypto/rsa,,,2,,,,,,,,,,,,,,,,,,2,
- crypto/tls,,,3,,,,,,,,,,,,,,,,3,
+ crypto/tls,,,3,,,,,,,,,,,,,,,,,,3,
- crypto/x509,,,1,,,,,,,,,,,,,,,,1,
+ crypto/x509,,,1,,,,,,,,,,,,,,,,,,1,
- database/sql,,,7,,,,,,,,,,,,,,,,7,
+ database/sql,24,,7,,,,,,,,,,,,24,,,,,,7,
- database/sql/driver,,,4,,,,,,,,,,,,,,,,4,
+ database/sql/driver,6,,4,,,,,,,,,,,,6,,,,,,4,
- encoding,,,4,,,,,,,,,,,,,,,,4,
+ encoding,,,4,,,,,,,,,,,,,,,,,,4,
- encoding/ascii85,,,2,,,,,,,,,,,,,,,,2,
+ encoding/ascii85,,,2,,,,,,,,,,,,,,,,,,2,
- encoding/asn1,,,8,,,,,,,,,,,,,,,,8,
+ encoding/asn1,,,8,,,,,,,,,,,,,,,,,,8,
- encoding/base32,,,3,,,,,,,,,,,,,,,,3,
+ encoding/base32,,,3,,,,,,,,,,,,,,,,,,3,
- encoding/base64,,,3,,,,,,,,,,,,,,,,3,
+ encoding/base64,,,3,,,,,,,,,,,,,,,,,,3,
- encoding/binary,,,2,,,,,,,,,,,,,,,,2,
+ encoding/binary,,,2,,,,,,,,,,,,,,,,,,2,
- encoding/csv,,,5,,,,,,,,,,,,,,,,5,
+ encoding/csv,,,5,,,,,,,,,,,,,,,,,,5,
- encoding/gob,,,7,,,,,,,,,,,,,,,,7,
+ encoding/gob,,,7,,,,,,,,,,,,,,,,,,7,
- encoding/hex,,,3,,,,,,,,,,,,,,,,3,
+ encoding/hex,,,3,,,,,,,,,,,,,,,,,,3,
- encoding/json,,,14,,,,,,,,,,,,,,,,14,
+ encoding/json,,,14,,,,,,,,,,,,,,,,,,14,
- encoding/pem,,,3,,,,,,,,,,,,,,,,3,
+ encoding/pem,,,3,,,,,,,,,,,,,,,,,,3,
- encoding/xml,,,23,,,,,,,,,,,,,,,,23,
+ encoding/xml,,,23,,,,,,,,,,,,,,,,,,23,
- errors,,,3,,,,,,,,,,,,,,,,3,
+ errors,,,3,,,,,,,,,,,,,,,,,,3,
- expvar,,,6,,,,,,,,,,,,,,,,6,
+ expvar,,,6,,,,,,,,,,,,,,,,,,6,
+ fixed-version:github.com/couchbase/gocb,4,,18,,,,,4,,,,,,,,,,,,,18,
+ fixed-version:github.com/couchbaselabs/gocb,4,,18,,,,,4,,,,,,,,,,,,,18,
+ fixed-version:gopkg.in/couchbase/gocb.v1,4,,18,,,,,4,,,,,,,,,,,,,18,
- fmt,3,,16,,,,3,,,,,,,,,,,,16,
+ fmt,3,,16,,,,3,,,,,,,,,,,,,,16,
- github.com/ChrisTrenkamp/goxpath,3,,,,,,,,,,,,,,,,3,,,
+ github.com/ChrisTrenkamp/goxpath,3,,,,,,,,,,,,,,,,,,3,,,
+ github.com/Masterminds/squirrel,35,,,,,,,,,,,,,,35,,,,,,,
- github.com/Sirupsen/logrus,118,,,,,,118,,,,,,,,,,,,,
+ github.com/Sirupsen/logrus,118,,,,,,118,,,,,,,,,,,,,,,
- github.com/antchfx/htmlquery,4,,,,,,,,,,,,,,,,4,,,
+ github.com/antchfx/htmlquery,4,,,,,,,,,,,,,,,,,,4,,,
- github.com/antchfx/jsonquery,4,,,,,,,,,,,,,,,,4,,,
+ github.com/antchfx/jsonquery,4,,,,,,,,,,,,,,,,,,4,,,
- github.com/antchfx/xmlquery,8,,,,,,,,,,,,,,,,8,,,
+ github.com/antchfx/xmlquery,8,,,,,,,,,,,,,,,,,,8,,,
- github.com/antchfx/xpath,4,,,,,,,,,,,,,,,,4,,,
+ github.com/antchfx/xpath,4,,,,,,,,,,,,,,,,,,4,,,
- github.com/appleboy/gin-jwt,1,,,,1,,,,,,,,,,,,,,,
+ github.com/appleboy/gin-jwt,1,,,,1,,,,,,,,,,,,,,,,,
- github.com/astaxie/beego,16,6,7,,,,11,4,,,,,,1,,,,6,7,
+ github.com/astaxie/beego,16,6,7,,,,11,,4,,,,,,,1,,,,6,7,
- github.com/astaxie/beego/context,2,15,1,,,,,1,,,,,,1,,,,15,1,
+ github.com/astaxie/beego/context,2,15,1,,,,,,1,,,,,,,1,,,,15,1,
- github.com/astaxie/beego/logs,22,,,,,,22,,,,,,,,,,,,,
+ github.com/astaxie/beego/logs,22,,,,,,22,,,,,,,,,,,,,,,
+ github.com/astaxie/beego/orm,30,,,,,,,,,,,,,,30,,,,,,,
- github.com/astaxie/beego/utils,1,,13,,,,1,,,,,,,,,,,,13,
+ github.com/astaxie/beego/utils,1,,13,,,,1,,,,,,,,,,,,,,13,
- github.com/beego/beego,16,6,7,,,,11,4,,,,,,1,,,,6,7,
+ github.com/beego/beego,16,6,7,,,,11,,4,,,,,,,1,,,,6,7,
+ github.com/beego/beego/client/orm,30,,,,,,,,,,,,,,30,,,,,,,
- github.com/beego/beego/context,2,15,1,,,,,1,,,,,,1,,,,15,1,
+ github.com/beego/beego/context,2,15,1,,,,,,1,,,,,,,1,,,,15,1,
- github.com/beego/beego/core/logs,22,,,,,,22,,,,,,,,,,,,,
+ github.com/beego/beego/core/logs,22,,,,,,22,,,,,,,,,,,,,,,
- github.com/beego/beego/core/utils,1,,13,,,,1,,,,,,,,,,,,13,
+ github.com/beego/beego/core/utils,1,,13,,,,1,,,,,,,,,,,,,,13,
- github.com/beego/beego/logs,22,,,,,,22,,,,,,,,,,,,,
+ github.com/beego/beego/logs,22,,,,,,22,,,,,,,,,,,,,,,
+ github.com/beego/beego/orm,30,,,,,,,,,,,,,,30,,,,,,,
- github.com/beego/beego/server/web,16,6,7,,,,11,4,,,,,,1,,,,6,7,
+ github.com/beego/beego/server/web,16,6,7,,,,11,,4,,,,,,,1,,,,6,7,
- github.com/beego/beego/server/web/context,2,15,1,,,,,1,,,,,,1,,,,15,1,
+ github.com/beego/beego/server/web/context,2,15,1,,,,,,1,,,,,,,1,,,,15,1,
- github.com/beego/beego/utils,1,,13,,,,1,,,,,,,,,,,,13,
+ github.com/beego/beego/utils,1,,13,,,,1,,,,,,,,,,,,,,13,
- github.com/clevergo/clevergo,1,,,,,,,,,,,,,,,1,,,,
+ github.com/clevergo/clevergo,1,,,,,,,,,,,,,,,,,1,,,,
- github.com/codeskyblue/go-sh,4,,,4,,,,,,,,,,,,,,,,
+ github.com/codeskyblue/go-sh,4,,,4,,,,,,,,,,,,,,,,,,
- github.com/couchbase/gocb,,,18,,,,,,,,,,,,,,,,18,
+ github.com/couchbase/gocb/v2,4,,,,,,,4,,,,,,,,,,,,,,
- github.com/couchbaselabs/gocb,,,18,,,,,,,,,,,,,,,,18,
+ github.com/couchbaselabs/gocb/v2,4,,,,,,,4,,,,,,,,,,,,,,
- github.com/crankycoder/xmlpath,2,,,,,,,,,,,,,,,,2,,,
+ github.com/crankycoder/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,
- github.com/cristalhq/jwt,1,,,,1,,,,,,,,,,,,,,,
+ github.com/cristalhq/jwt,1,,,,1,,,,,,,,,,,,,,,,,
- github.com/davecgh/go-spew/spew,9,,,,,,9,,,,,,,,,,,,,
+ github.com/davecgh/go-spew/spew,9,,,,,,9,,,,,,,,,,,,,,,
- github.com/dgrijalva/jwt-go,3,,9,,2,1,,,,,,,,,,,,,9,
+ github.com/dgrijalva/jwt-go,3,,9,,2,1,,,,,,,,,,,,,,,9,
- github.com/elazarl/goproxy,2,2,2,,,,2,,,,,,,,,,,2,2,
+ github.com/elazarl/goproxy,2,2,2,,,,2,,,,,,,,,,,,,2,2,
- github.com/emicklei/go-restful,,7,,,,,,,,,,,,,,,,7,,
+ github.com/emicklei/go-restful,,7,,,,,,,,,,,,,,,,,,7,,
- github.com/evanphx/json-patch,,,12,,,,,,,,,,,,,,,,12,
+ github.com/evanphx/json-patch,,,12,,,,,,,,,,,,,,,,,,12,
- github.com/form3tech-oss/jwt-go,2,,,,2,,,,,,,,,,,,,,,
+ github.com/form3tech-oss/jwt-go,2,,,,2,,,,,,,,,,,,,,,,,
- github.com/gin-gonic/gin,3,46,2,,,,,3,,,,,,,,,,46,2,
+ github.com/gin-gonic/gin,3,46,2,,,,,,3,,,,,,,,,,,46,2,
- github.com/go-chi/chi,,3,,,,,,,,,,,,,,,,3,,
+ github.com/go-chi/chi,,3,,,,,,,,,,,,,,,,,,3,,
- github.com/go-chi/jwtauth,1,,,,1,,,,,,,,,,,,,,,
+ github.com/go-chi/jwtauth,1,,,,1,,,,,,,,,,,,,,,,,
+ github.com/go-gorm/gorm,13,,,,,,,,,,,,,,13,,,,,,,
- github.com/go-jose/go-jose,2,,,,2,,,,,,,,,,,,,,,
+ github.com/go-jose/go-jose,2,,,,2,,,,,,,,,,,,,,,,,
- github.com/go-jose/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,4,
+ github.com/go-jose/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,,,4,
- github.com/go-kit/kit/auth/jwt,1,,,,1,,,,,,,,,,,,,,,
+ github.com/go-kit/kit/auth/jwt,1,,,,1,,,,,,,,,,,,,,,,,
- github.com/go-pg/pg/orm,,,6,,,,,,,,,,,,,,,,6,
+ github.com/go-pg/pg/orm,,,6,,,,,,,,,,,,,,,,,,6,
- github.com/go-xmlpath/xmlpath,2,,,,,,,,,,,,,,,,2,,,
+ github.com/go-xmlpath/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,
+ github.com/go-xorm/xorm,42,,,,,,,,,,,,,,42,,,,,,,
- github.com/gobwas/ws,,2,,,,,,,,,,,,,,,,2,,
+ github.com/gobwas/ws,,2,,,,,,,,,,,,,,,,,,2,,
- github.com/gofiber/fiber,5,,,,,,,4,,,,,,,,1,,,,
+ github.com/gofiber/fiber,5,,,,,,,,4,,,,,,,,,1,,,,
- github.com/gogf/gf-jwt,1,,,,1,,,,,,,,,,,,,,,
+ github.com/gogf/gf-jwt,1,,,,1,,,,,,,,,,,,,,,,,
+ github.com/gogf/gf/database/gdb,51,,,,,,,,,,,,,,51,,,,,,,
- github.com/going/toolkit/xmlpath,2,,,,,,,,,,,,,,,,2,,,
+ github.com/going/toolkit/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,
- github.com/golang-jwt/jwt,3,,11,,2,1,,,,,,,,,,,,,11,
+ github.com/golang-jwt/jwt,3,,11,,2,1,,,,,,,,,,,,,,,11,
- github.com/golang/glog,90,,,,,,90,,,,,,,,,,,,,
+ github.com/golang/glog,90,,,,,,90,,,,,,,,,,,,,,,
- github.com/golang/protobuf/proto,,,4,,,,,,,,,,,,,,,,4,
+ github.com/golang/protobuf/proto,,,4,,,,,,,,,,,,,,,,,,4,
- github.com/gorilla/mux,,1,,,,,,,,,,,,,,,,1,,
+ github.com/gorilla/mux,,1,,,,,,,,,,,,,,,,,,1,,
- github.com/gorilla/websocket,,3,,,,,,,,,,,,,,,,3,,
+ github.com/gorilla/websocket,,3,,,,,,,,,,,,,,,,,,3,,
- github.com/jbowtie/gokogiri/xml,4,,,,,,,,,,,,,,,,4,,,
+ github.com/jbowtie/gokogiri/xml,4,,,,,,,,,,,,,,,,,,4,,,
- github.com/jbowtie/gokogiri/xpath,1,,,,,,,,,,,,,,,,1,,,
+ github.com/jbowtie/gokogiri/xpath,1,,,,,,,,,,,,,,,,,,1,,,
+ github.com/jinzhu/gorm,13,,,,,,,,,,,,,,13,,,,,,,
+ github.com/jmoiron/sqlx,12,,,,,,,,,,,,,,12,,,,,,,
- github.com/json-iterator/go,,,4,,,,,,,,,,,,,,,,4,
+ github.com/json-iterator/go,,,4,,,,,,,,,,,,,,,,,,4,
- github.com/kataras/iris/context,6,,,,,,,6,,,,,,,,,,,,
+ github.com/kataras/iris/context,6,,,,,,,,6,,,,,,,,,,,,,
- github.com/kataras/iris/middleware/jwt,2,,,,2,,,,,,,,,,,,,,,
+ github.com/kataras/iris/middleware/jwt,2,,,,2,,,,,,,,,,,,,,,,,
- github.com/kataras/iris/server/web/context,6,,,,,,,6,,,,,,,,,,,,
+ github.com/kataras/iris/server/web/context,6,,,,,,,,6,,,,,,,,,,,,,
- github.com/kataras/jwt,5,,,,5,,,,,,,,,,,,,,,
+ github.com/kataras/jwt,5,,,,5,,,,,,,,,,,,,,,,,
- github.com/labstack/echo,3,12,2,,,,,2,,,,,,1,,,,12,2,
+ github.com/labstack/echo,3,12,2,,,,,,2,,,,,,,1,,,,12,2,
+ github.com/lann/squirrel,35,,,,,,,,,,,,,,35,,,,,,,
- github.com/lestrrat-go/jwx,1,,,,1,,,,,,,,,,,,,,,
+ github.com/lestrrat-go/jwx,1,,,,1,,,,,,,,,,,,,,,,,
- github.com/lestrrat-go/jwx/jwk,1,,,,1,,,,,,,,,,,,,,,
+ github.com/lestrrat-go/jwx/jwk,1,,,,1,,,,,,,,,,,,,,,,,
- github.com/lestrrat-go/libxml2/parser,3,,,,,,,,,,,,,,,,3,,,
+ github.com/lestrrat-go/libxml2/parser,3,,,,,,,,,,,,,,,,,,3,,,
- github.com/lestrrat/go-jwx/jwk,1,,,,1,,,,,,,,,,,,,,,
+ github.com/lestrrat/go-jwx/jwk,1,,,,1,,,,,,,,,,,,,,,,,
- github.com/masterzen/xmlpath,2,,,,,,,,,,,,,,,,2,,,
+ github.com/masterzen/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,
- github.com/moovweb/gokogiri/xml,4,,,,,,,,,,,,,,,,4,,,
+ github.com/moovweb/gokogiri/xml,4,,,,,,,,,,,,,,,,,,4,,,
- github.com/moovweb/gokogiri/xpath,1,,,,,,,,,,,,,,,,1,,,
+ github.com/moovweb/gokogiri/xpath,1,,,,,,,,,,,,,,,,,,1,,,
- github.com/ory/fosite/token/jwt,2,,,,2,,,,,,,,,,,,,,,
+ github.com/ory/fosite/token/jwt,2,,,,2,,,,,,,,,,,,,,,,,
+ github.com/raindog308/gorqlite,24,,,,,,,,,,,,,,24,,,,,,,
- github.com/revel/revel,2,23,10,,,,,1,,,,,,1,,,,23,10,
+ github.com/revel/revel,2,23,10,,,,,,1,,,,,,,1,,,,23,10,
- github.com/robfig/revel,2,23,10,,,,,1,,,,,,1,,,,23,10,
+ github.com/robfig/revel,2,23,10,,,,,,1,,,,,,,1,,,,23,10,
+ github.com/rqlite/gorqlite,24,,,,,,,,,,,,,,24,,,,,,,
- github.com/santhosh-tekuri/xpathparser,2,,,,,,,,,,,,,,,,2,,,
+ github.com/santhosh-tekuri/xpathparser,2,,,,,,,,,,,,,,,,,,2,,,
- github.com/sendgrid/sendgrid-go/helpers/mail,,,1,,,,,,,,,,,,,,,,1,
+ github.com/sendgrid/sendgrid-go/helpers/mail,,,1,,,,,,,,,,,,,,,,,,1,
- github.com/sirupsen/logrus,118,,,,,,118,,,,,,,,,,,,,
+ github.com/sirupsen/logrus,118,,,,,,118,,,,,,,,,,,,,,,
- github.com/spf13/afero,34,,,,,,,34,,,,,,,,,,,,
+ github.com/spf13/afero,34,,,,,,,,34,,,,,,,,,,,,,
- github.com/square/go-jose,2,,,,2,,,,,,,,,,,,,,,
+ github.com/square/go-jose,2,,,,2,,,,,,,,,,,,,,,,,
- github.com/square/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,4,
+ github.com/square/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,,,4,
+ github.com/uptrace/bun,63,,,,,,,,,,,,,,63,,,,,,,
- github.com/valyala/fasthttp,35,50,5,,,,,8,,,,17,8,2,,,,50,5,
+ github.com/valyala/fasthttp,35,50,5,,,,,,8,,,,17,8,,2,,,,50,5,
+ go.mongodb.org/mongo-driver/mongo,14,,,,,,,14,,,,,,,,,,,,,,
- go.uber.org/zap,33,,11,,,,33,,,,,,,,,,,,11,
+ go.uber.org/zap,33,,11,,,,33,,,,,,,,,,,,,,11,
- golang.org/x/crypto/ssh,4,,,4,,,,,,,,,,,,,,,,
+ golang.org/x/crypto/ssh,4,,,4,,,,,,,,,,,,,,,,,,
- golang.org/x/net/context,,,5,,,,,,,,,,,,,,,,5,
+ golang.org/x/net/context,,,5,,,,,,,,,,,,,,,,,,5,
- golang.org/x/net/html,,,16,,,,,,,,,,,,,,,,16,
+ golang.org/x/net/html,,,16,,,,,,,,,,,,,,,,,,16,
- golang.org/x/net/websocket,,2,,,,,,,,,,,,,,,,2,,
+ golang.org/x/net/websocket,,2,,,,,,,,,,,,,,,,,,2,,
- google.golang.org/protobuf/internal/encoding/text,,,1,,,,,,,,,,,,,,,,1,
+ google.golang.org/protobuf/internal/encoding/text,,,1,,,,,,,,,,,,,,,,,,1,
- google.golang.org/protobuf/internal/impl,,,2,,,,,,,,,,,,,,,,2,
+ google.golang.org/protobuf/internal/impl,,,2,,,,,,,,,,,,,,,,,,2,
- google.golang.org/protobuf/proto,,,8,,,,,,,,,,,,,,,,8,
+ google.golang.org/protobuf/proto,,,8,,,,,,,,,,,,,,,,,,8,
- google.golang.org/protobuf/reflect/protoreflect,,,1,,,,,,,,,,,,,,,,1,
+ google.golang.org/protobuf/reflect/protoreflect,,,1,,,,,,,,,,,,,,,,,,1,
+ gopkg.in/Masterminds/squirrel,35,,,,,,,,,,,,,,35,,,,,,,
- gopkg.in/couchbase/gocb,,,18,,,,,,,,,,,,,,,,18,
+ gopkg.in/couchbase/gocb.v2,4,,,,,,,4,,,,,,,,,,,,,,
- gopkg.in/glog,90,,,,,,90,,,,,,,,,,,,,
+ gopkg.in/glog,90,,,,,,90,,,,,,,,,,,,,,,
- gopkg.in/go-jose/go-jose,2,,,,2,,,,,,,,,,,,,,,
+ gopkg.in/go-jose/go-jose,2,,,,2,,,,,,,,,,,,,,,,,
- gopkg.in/go-jose/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,4,
+ gopkg.in/go-jose/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,,,4,
- gopkg.in/go-xmlpath/xmlpath,2,,,,,,,,,,,,,,,,2,,,
+ gopkg.in/go-xmlpath/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,
- gopkg.in/macaron,1,12,1,,,,,,,,,,,,,1,,12,1,
+ gopkg.in/macaron,1,12,1,,,,,,,,,,,,,,,1,,12,1,
- gopkg.in/square/go-jose,2,,,,2,,,,,,,,,,,,,,,
+ gopkg.in/square/go-jose,2,,,,2,,,,,,,,,,,,,,,,,
- gopkg.in/square/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,4,
+ gopkg.in/square/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,,,4,
- gopkg.in/xmlpath,2,,,,,,,,,,,,,,,,2,,,
+ gopkg.in/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,
- gopkg.in/yaml,,,9,,,,,,,,,,,,,,,,9,
+ gopkg.in/yaml,,,9,,,,,,,,,,,,,,,,,,9,
+ gorm.io/gorm,13,,,,,,,,,,,,,,13,,,,,,,
- html,,,2,,,,,,,,,,,,,,,,2,
+ html,,,2,,,,,,,,,,,,,,,,,,2,
- html/template,,,6,,,,,,,,,,,,,,,,6,
+ html/template,,,6,,,,,,,,,,,,,,,,,,6,
- io,,,19,,,,,,,,,,,,,,,,19,
+ io,,,19,,,,,,,,,,,,,,,,,,19,
- io/fs,,,12,,,,,,,,,,,,,,,,12,
+ io/fs,,,12,,,,,,,,,,,,,,,,,,12,
- io/ioutil,5,,2,,,,,5,,,,,,,,,,,2,
+ io/ioutil,5,,2,,,,,,5,,,,,,,,,,,,2,
- k8s.io/api/core,,,10,,,,,,,,,,,,,,,,10,
+ k8s.io/api/core,,,10,,,,,,,,,,,,,,,,,,10,
- k8s.io/apimachinery/pkg/runtime,,,47,,,,,,,,,,,,,,,,47,
+ k8s.io/apimachinery/pkg/runtime,,,47,,,,,,,,,,,,,,,,,,47,
- k8s.io/klog,90,,,,,,90,,,,,,,,,,,,,
+ k8s.io/klog,90,,,,,,90,,,,,,,,,,,,,,,
- launchpad.net/xmlpath,2,,,,,,,,,,,,,,,,2,,,
+ launchpad.net/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,
- log,20,,3,,,,20,,,,,,,,,,,,3,
+ log,20,,3,,,,20,,,,,,,,,,,,,,3,
- math/big,,,1,,,,,,,,,,,,,,,,1,
+ math/big,,,1,,,,,,,,,,,,,,,,,,1,
- mime,,,5,,,,,,,,,,,,,,,,5,
+ mime,,,5,,,,,,,,,,,,,,,,,,5,
- mime/multipart,,,8,,,,,,,,,,,,,,,,8,
+ mime/multipart,,,8,,,,,,,,,,,,,,,,,,8,
- mime/quotedprintable,,,1,,,,,,,,,,,,,,,,1,
+ mime/quotedprintable,,,1,,,,,,,,,,,,,,,,,,1,
- net,,,20,,,,,,,,,,,,,,,,20,
+ net,,,20,,,,,,,,,,,,,,,,,,20,
- net/http,2,16,22,,,,,1,,,,,,,1,,,16,22,
+ net/http,2,16,22,,,,,,1,,,,,,,,1,,,16,22,
- net/http/httputil,,,10,,,,,,,,,,,,,,,,10,
+ net/http/httputil,,,10,,,,,,,,,,,,,,,,,,10,
- net/mail,,,6,,,,,,,,,,,,,,,,6,
+ net/mail,,,6,,,,,,,,,,,,,,,,,,6,
- net/textproto,,,19,,,,,,,,,,,,,,,,19,
+ net/textproto,,,19,,,,,,,,,,,,,,,,,,19,
- net/url,,,23,,,,,,,,,,,,,,,,23,
+ net/url,,,23,,,,,,,,,,,,,,,,,,23,
- nhooyr.io/websocket,,2,,,,,,,,,,,,,,,,2,,
+ nhooyr.io/websocket,,2,,,,,,,,,,,,,,,,,,2,,
- os,27,,4,1,,,,26,,,,,,,,,,,4,
+ os,27,,4,1,,,,,26,,,,,,,,,,,,4,
- os/exec,2,,,2,,,,,,,,,,,,,,,,
+ os/exec,2,,,2,,,,,,,,,,,,,,,,,,
- path,,,5,,,,,,,,,,,,,,,,5,
+ path,,,5,,,,,,,,,,,,,,,,,,5,
- path/filepath,,,13,,,,,,,,,,,,,,,,13,
+ path/filepath,,,13,,,,,,,,,,,,,,,,,,13,
- reflect,,,37,,,,,,,,,,,,,,,,37,
+ reflect,,,37,,,,,,,,,,,,,,,,,,37,
- regexp,10,,20,,,,,,3,3,4,,,,,,,,20,
+ regexp,10,,20,,,,,,,3,3,4,,,,,,,,,20,
- sort,,,1,,,,,,,,,,,,,,,,1,
+ sort,,,1,,,,,,,,,,,,,,,,,,1,
- strconv,,,9,,,,,,,,,,,,,,,,9,
+ strconv,,,9,,,,,,,,,,,,,,,,,,9,
- strings,,,34,,,,,,,,,,,,,,,,34,
+ strings,,,34,,,,,,,,,,,,,,,,,,34,
- sync,,,10,,,,,,,,,,,,,,,,10,
+ sync,,,10,,,,,,,,,,,,,,,,,,10,
- sync/atomic,,,24,,,,,,,,,,,,,,,,24,
+ sync/atomic,,,24,,,,,,,,,,,,,,,,,,24,
- syscall,5,,8,5,,,,,,,,,,,,,,,8,
+ syscall,5,,8,5,,,,,,,,,,,,,,,,,8,
- text/scanner,,,3,,,,,,,,,,,,,,,,3,
+ text/scanner,,,3,,,,,,,,,,,,,,,,,,3,
- text/tabwriter,,,1,,,,,,,,,,,,,,,,1,
+ text/tabwriter,,,1,,,,,,,,,,,,,,,,,,1,
- text/template,,,6,,,,,,,,,,,,,,,,6,
+ text/template,,,6,,,,,,,,,,,,,,,,,,6,
+ xorm.io/xorm,42,,,,,,,,,,,,,,42,,,,,,,

…oved) Various non-existent methods were modeled, and I couldn't find any evidence that they used to exist. They aren't in the stubs or tests. I have removed them.

Separate the tests for Squirrel and database/sql. Add tests for database/sql/driver.

egregius313

LGTM

owen-mc added the no-change-note-required This PR does not need a change note label Aug 16, 2024

owen-mc requested a review from a team as a code owner August 16, 2024 09:07

github-actions bot added the Go label Aug 16, 2024

owen-mc force-pushed the go/mad/convert-sink-4 branch from a339773 to 63cc0a4 Compare August 16, 2024 10:03

owen-mc added 16 commits August 16, 2024 11:18

Convert squirrel sql-injection sinks to MaD (non-existent methods rem…

06f86dd

…oved) Various non-existent methods were modeled, and I couldn't find any evidence that they used to exist. They aren't in the stubs or tests. I have removed them.

Upgrade and convert gorqlite sql-injection sinks to MaD

ce0cb12

Convert gogf/gf sql-injection sinks to MaD

db559f7

Convert sqlx sql-injection sinks to MaD

7ad63fc

Convert Gorm sql-injection sinks to MaD

ba31041

Convert Xorm sql-injection sinks to MaD

3b2b7d7

Convert Bun sql-injection sinks to MaD

3eb5b26

Update Beego orm tests

e1bdc7f

Convert Beego orm sql-injection sinks to MaD

ad21357

Convert database/sql sql-injection sinks to MaD

501bb3e

Improve SQL tests

c7859ec

Separate the tests for Squirrel and database/sql. Add tests for database/sql/driver.

Convert database/sql/driver sql-injection sinks to MaD

652dd88

Add Argument.getACorrespondingSyntacticArgument

ced000a

Accept MaD sinks with kind nosql-injection

86e9f15

Convert mongodb nosql-injection sinks to MaD

ec9d88b

Convert gocb nosql-injection sinks to MaD

2d2afb1

owen-mc force-pushed the go/mad/convert-sink-4 branch from 63cc0a4 to 2d2afb1 Compare August 16, 2024 10:19

owen-mc requested a review from egregius313 August 16, 2024 12:05

egregius313 approved these changes Aug 20, 2024

View reviewed changes

owen-mc merged commit 38f4f4c into github:main Aug 20, 2024

owen-mc deleted the go/mad/convert-sink-4 branch August 20, 2024 11:01

smowton mentioned this pull request Aug 24, 2024

Go: Revert problematic conversion from QL-specified sink nodes to models-as-data; add change note for one correct but undocumented fix #17296

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Go: convert sql-injection and nosql-injection sinks to use models-as-data#17242

Go: convert sql-injection and nosql-injection sinks to use models-as-data#17242
owen-mc merged 16 commits intogithub:mainfrom
owen-mc:go/mad/convert-sink-4

owen-mc commented Aug 16, 2024

Uh oh!

github-actions bot commented Aug 16, 2024

go

Generated file changes for go

Uh oh!

egregius313 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

owen-mc commented Aug 16, 2024

Uh oh!

github-actions bot commented Aug 16, 2024

go

Generated file changes for go

Uh oh!

egregius313 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants