Skip to content

Commit a4afff2

Browse files
committed
Add extra variable for tracking flow
1 parent e7f99cd commit a4afff2

File tree

1 file changed

+9
-5
lines changed

1 file changed

+9
-5
lines changed

go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_jmoiron_sqlx.go

+9-5
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
"github.com/jmoiron/sqlx"
77
)
88

9-
func test_sqlx(q sqlx.Queryer) {
9+
func test_sqlx(q sqlx.Ext) {
1010
var user User
1111

1212
err := sqlx.Get(q, &user, "SELECT * FROM users WHERE id = 1") // $ source
@@ -18,9 +18,11 @@ func test_sqlx(q sqlx.Queryer) {
1818
rows, err := sqlx.NamedQuery(q, "SELECT * FROM users WHERE id = :id", map[string]any{"id": 1}) // $ source
1919
ignore(err)
2020

21-
rows.StructScan(&user)
21+
var user2 User
2222

23-
sink(user) // $ hasTaintFlow="user"
23+
rows.StructScan(&user2)
24+
25+
sink(user2) // $ hasTaintFlow="user2"
2426
}
2527

2628
func test_sqlx_ctx(ctx context.Context, q sqlx.ExtContext) {
@@ -35,9 +37,11 @@ func test_sqlx_ctx(ctx context.Context, q sqlx.ExtContext) {
3537
rows, err := sqlx.NamedQueryContext(ctx, q, "SELECT * FROM users WHERE id = :id", map[string]any{"id": 1}) // $ source
3638
ignore(err)
3739

38-
rows.StructScan(&user)
40+
var user2 User
3941

40-
sink(user) // $ hasTaintFlow="user"
42+
rows.StructScan(&user2)
43+
44+
sink(user2) // $ hasTaintFlow="user2"
4145
}
4246

4347
func test_sqlx_DB(db *sqlx.DB) {

0 commit comments

Comments
 (0)