Skip to content

Commit 2d2afb1

Browse files
owen-mcowen-mc
committed
Convert gocb nosql-injection sinks to MaD
1 parent ec9d88b commit 2d2afb1

File tree

4 files changed

+43
-138
lines changed

4 files changed

+43
-138
lines changed

‎go/ql/lib/ext/github.com.couchbase.gocb.model.yml‎

Lines changed: 36 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,43 @@ extensions:
33
pack: codeql/go-all
44
extensible: packageGrouping
55
data:
6-
- ["gocb", "github.com/couchbase/gocb"]
7-
- ["gocb", "gopkg.in/couchbase/gocb"]
8-
- ["gocb", "github.com/couchbaselabs/gocb"]
6+
- ["gocb1", "fixed-version:github.com/couchbase/gocb"]
7+
- ["gocb1", "fixed-version:gopkg.in/couchbase/gocb.v1"]
8+
- ["gocb1", "fixed-version:github.com/couchbaselabs/gocb"]
9+
- ["gocb2", "github.com/couchbase/gocb/v2"]
10+
- ["gocb2", "gopkg.in/couchbase/gocb.v2"]
11+
- ["gocb2", "github.com/couchbaselabs/gocb/v2"]
12+
- addsTo:
13+
pack: codeql/go-all
14+
extensible: sinkModel
15+
data:
16+
- ["group:gocb1", "Bucket", True, "ExecuteN1qlQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
17+
- ["group:gocb1", "Bucket", True, "ExecuteAnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
18+
- ["group:gocb1", "Cluster", True, "ExecuteN1qlQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
19+
- ["group:gocb1", "Cluster", True, "ExecuteAnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
20+
- ["group:gocb2", "Cluster", True, "AnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
21+
- ["group:gocb2", "Cluster", True, "Query", "", "", "Argument[0]", "nosql-injection", "manual"]
22+
- ["group:gocb2", "Scope", True, "AnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
23+
- ["group:gocb2", "Scope", True, "Query", "", "", "Argument[0]", "nosql-injection", "manual"]
924
- addsTo:
1025
pack: codeql/go-all
1126
extensible: summaryModel
1227
data:
13-
- ["group:gocb", "", False, "NewAnalyticsQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
14-
- ["group:gocb", "", False, "NewN1qlQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
15-
- ["group:gocb", "AnalyticsQuery", True, "ContextId", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
16-
- ["group:gocb", "AnalyticsQuery", True, "Deferred", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
17-
- ["group:gocb", "AnalyticsQuery", True, "Pretty", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
18-
- ["group:gocb", "AnalyticsQuery", True, "Priority", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
19-
- ["group:gocb", "AnalyticsQuery", True, "RawParam", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
20-
- ["group:gocb", "AnalyticsQuery", True, "ServerSideTimeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
21-
- ["group:gocb", "N1qlQuery", True, "AdHoc", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
22-
- ["group:gocb", "N1qlQuery", True, "Consistency", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
23-
- ["group:gocb", "N1qlQuery", True, "ConsistentWith", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
24-
- ["group:gocb", "N1qlQuery", True, "Custom", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
25-
- ["group:gocb", "N1qlQuery", True, "PipelineBatch", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
26-
- ["group:gocb", "N1qlQuery", True, "PipelineCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
27-
- ["group:gocb", "N1qlQuery", True, "Profile", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
28-
- ["group:gocb", "N1qlQuery", True, "ReadOnly", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
29-
- ["group:gocb", "N1qlQuery", True, "ScanCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
30-
- ["group:gocb", "N1qlQuery", True, "Timeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
28+
- ["group:gocb1", "", False, "NewAnalyticsQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
29+
- ["group:gocb1", "", False, "NewN1qlQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
30+
- ["group:gocb1", "AnalyticsQuery", True, "ContextId", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
31+
- ["group:gocb1", "AnalyticsQuery", True, "Deferred", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
32+
- ["group:gocb1", "AnalyticsQuery", True, "Pretty", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
33+
- ["group:gocb1", "AnalyticsQuery", True, "Priority", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
34+
- ["group:gocb1", "AnalyticsQuery", True, "RawParam", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
35+
- ["group:gocb1", "AnalyticsQuery", True, "ServerSideTimeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
36+
- ["group:gocb1", "N1qlQuery", True, "AdHoc", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
37+
- ["group:gocb1", "N1qlQuery", True, "Consistency", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
38+
- ["group:gocb1", "N1qlQuery", True, "ConsistentWith", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
39+
- ["group:gocb1", "N1qlQuery", True, "Custom", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
40+
- ["group:gocb1", "N1qlQuery", True, "PipelineBatch", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
41+
- ["group:gocb1", "N1qlQuery", True, "PipelineCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
42+
- ["group:gocb1", "N1qlQuery", True, "Profile", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
43+
- ["group:gocb1", "N1qlQuery", True, "ReadOnly", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
44+
- ["group:gocb1", "N1qlQuery", True, "ScanCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
45+
- ["group:gocb1", "N1qlQuery", True, "Timeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]

‎go/ql/lib/ext/go.mongodb.org.mongo-driver.mongo.model.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ extensions:
33
pack: codeql/go-all
44
extensible: sinkModel
55
data:
6+
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "Aggregate", "", "", "Argument[1]", "nosql-injection", "manual"]
67
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "CountDocuments", "", "", "Argument[1]", "nosql-injection", "manual"]
78
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "DeleteMany", "", "", "Argument[1]", "nosql-injection", "manual"]
89
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "DeleteOne", "", "", "Argument[1]", "nosql-injection", "manual"]
@@ -16,4 +17,3 @@ extensions:
1617
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "UpdateMany", "", "", "Argument[1]", "nosql-injection", "manual"]
1718
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "UpdateOne", "", "", "Argument[1]", "nosql-injection", "manual"]
1819
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "Watch", "", "", "Argument[1]", "nosql-injection", "manual"]
19-
- ["go.mongodb.org/mongo-driver/mongo", "Collection", True, "Aggregate", "", "", "Argument[1]", "nosql-injection", "manual"]

‎go/ql/lib/semmle/go/frameworks/Couchbase.qll‎

Lines changed: 6 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -5,57 +5,23 @@
55
import go
66

77
/**
8+
* DEPRECATED
9+
*
810
* Provides models of commonly used functions in the official Couchbase Go SDK library.
911
*/
10-
module Couchbase {
12+
deprecated module Couchbase {
1113
/**
14+
* DEPRECATED
15+
*
1216
* Gets a package path for the official Couchbase Go SDK library.
1317
*
1418
* Note that v1 and v2 have different APIs, but the names are disjoint so there is no need to
1519
* distinguish between them.
1620
*/
17-
string packagePath() {
21+
deprecated string packagePath() {
1822
result =
1923
package([
2024
"gopkg.in/couchbase/gocb", "github.com/couchbase/gocb", "github.com/couchbaselabs/gocb"
2125
], "")
2226
}
23-
24-
/**
25-
* A query used in an API function acting on a `Bucket` or `Cluster` struct of v1 of
26-
* the official Couchbase Go library, gocb.
27-
*/
28-
private class CouchbaseV1Query extends NoSql::Query::Range {
29-
CouchbaseV1Query() {
30-
// func (b *Bucket) ExecuteAnalyticsQuery(q *AnalyticsQuery, params interface{}) (AnalyticsResults, error)
31-
// func (b *Bucket) ExecuteN1qlQuery(q *N1qlQuery, params interface{}) (QueryResults, error)
32-
// func (c *Cluster) ExecuteAnalyticsQuery(q *AnalyticsQuery, params interface{}) (AnalyticsResults, error)
33-
// func (c *Cluster) ExecuteN1qlQuery(q *N1qlQuery, params interface{}) (QueryResults, error)
34-
exists(Method meth, string structName, string methodName |
35-
structName in ["Bucket", "Cluster"] and
36-
methodName in ["ExecuteN1qlQuery", "ExecuteAnalyticsQuery"] and
37-
meth.hasQualifiedName(packagePath(), structName, methodName) and
38-
this = meth.getACall().getArgument(0)
39-
)
40-
}
41-
}
42-
43-
/**
44-
* A query used in an API function acting on a `Bucket` or `Cluster` struct of v1 of
45-
* the official Couchbase Go library, gocb.
46-
*/
47-
private class CouchbaseV2Query extends NoSql::Query::Range {
48-
CouchbaseV2Query() {
49-
// func (c *Cluster) AnalyticsQuery(statement string, opts *AnalyticsOptions) (*AnalyticsResult, error)
50-
// func (c *Cluster) Query(statement string, opts *QueryOptions) (*QueryResult, error)
51-
// func (s *Scope) AnalyticsQuery(statement string, opts *AnalyticsOptions) (*AnalyticsResult, error)
52-
// func (s *Scope) Query(statement string, opts *QueryOptions) (*QueryResult, error)
53-
exists(Method meth, string structName, string methodName |
54-
structName in ["Cluster", "Scope"] and
55-
methodName in ["AnalyticsQuery", "Query"] and
56-
meth.hasQualifiedName(packagePath(), structName, methodName) and
57-
this = meth.getACall().getArgument(0)
58-
)
59-
}
60-
}
6127
}

‎go/ql/lib/semmle/go/frameworks/NoSQL.qll‎

Lines changed: 0 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -31,82 +31,6 @@ module NoSql {
3131
)
3232
}
3333
}
34-
// /**
35-
// * Holds if method `name` of struct `Collection` from package
36-
// * [go.mongodb.org/mongo-driver/mongo](https://pkg.go.dev/go.mongodb.org/mongo-driver/mongo)
37-
// * interprets parameter `n` as a query.
38-
// */
39-
// private predicate mongoDbCollectionMethod(string name, int n) {
40-
// // func (coll *Collection) CountDocuments(ctx context.Context, filter interface{},
41-
// // opts ...*options.CountOptions) (int64, error)
42-
// name = "CountDocuments" and n = 1
43-
// or
44-
// // func (coll *Collection) DeleteMany(ctx context.Context, filter interface{},
45-
// // opts ...*options.DeleteOptions) (*DeleteResult, error)
46-
// name = "DeleteMany" and n = 1
47-
// or
48-
// // func (coll *Collection) DeleteOne(ctx context.Context, filter interface{},
49-
// // opts ...*options.DeleteOptions) (*DeleteResult, error)
50-
// name = "DeleteOne" and n = 1
51-
// or
52-
// // func (coll *Collection) Distinct(ctx context.Context, fieldName string, filter interface{},
53-
// // ...) ([]interface{}, error)
54-
// name = "Distinct" and n = 2
55-
// or
56-
// // func (coll *Collection) Find(ctx context.Context, filter interface{},
57-
// // opts ...*options.FindOptions) (*Cursor, error)
58-
// name = "Find" and n = 1
59-
// or
60-
// // func (coll *Collection) FindOne(ctx context.Context, filter interface{},
61-
// // opts ...*options.FindOneOptions) *SingleResult
62-
// name = "FindOne" and n = 1
63-
// or
64-
// // func (coll *Collection) FindOneAndDelete(ctx context.Context, filter interface{}, ...)
65-
// // *SingleResult
66-
// name = "FindOneAndDelete" and n = 1
67-
// or
68-
// // func (coll *Collection) FindOneAndReplace(ctx context.Context, filter interface{},
69-
// // replacement interface{}, ...) *SingleResult
70-
// name = "FindOneAndReplace" and n = 1
71-
// or
72-
// // func (coll *Collection) FindOneAndUpdate(ctx context.Context, filter interface{},
73-
// // update interface{}, ...) *SingleResult
74-
// name = "FindOneAndUpdate" and n = 1
75-
// or
76-
// // func (coll *Collection) ReplaceOne(ctx context.Context, filter interface{},
77-
// // replacement interface{}, ...) (*UpdateResult, error)
78-
// name = "ReplaceOne" and n = 1
79-
// or
80-
// // func (coll *Collection) UpdateMany(ctx context.Context, filter interface{},
81-
// // update interface{}, ...) (*UpdateResult, error)
82-
// name = "UpdateMany" and n = 1
83-
// or
84-
// // func (coll *Collection) UpdateOne(ctx context.Context, filter interface{},
85-
// // update interface{}, ...) (*UpdateResult, error)
86-
// name = "UpdateOne" and n = 1
87-
// or
88-
// // func (coll *Collection) Watch(ctx context.Context, pipeline interface{}, ...)
89-
// // (*ChangeStream, error)
90-
// name = "Watch" and n = 1
91-
// or
92-
// // func (coll *Collection) Aggregate(ctx context.Context, pipeline interface{},
93-
// // opts ...*options.AggregateOptions) (*Cursor, error)
94-
// name = "Aggregate" and n = 1
95-
// }
96-
// /**
97-
// * A query used in an API function acting on a `Collection` struct of package
98-
// * [go.mongodb.org/mongo-driver/mongo](https://pkg.go.dev/go.mongodb.org/mongo-driver/mongo).
99-
// */
100-
// private class MongoDbCollectionQuery extends Range {
101-
// MongoDbCollectionQuery() {
102-
// exists(Method meth, string methodName, int n |
103-
// mongoDbCollectionMethod(methodName, n) and
104-
// meth.hasQualifiedName(package("go.mongodb.org/mongo-driver", "mongo"), "Collection",
105-
// methodName) and
106-
// this = meth.getACall().getArgument(n)
107-
// )
108-
// }
109-
// }
11034
}
11135

11236
/**

0 commit comments

Comments
 (0)