Skip to content

Commit ddb7da4

Browse files
owen-mcowen-mc
committed
Add gogf models and tests
1 parent 9cf4117 commit ddb7da4

File tree

2 files changed

+270
-23
lines changed

2 files changed

+270
-23
lines changed

‎go/ql/lib/ext/github.com.gogf.gf.database.gdb.model.yml

Lines changed: 37 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -60,36 +60,59 @@ extensions:
6060
extensible: sourceModel
6161
data:
6262
# These models are for v1. Some of them hold for v2, but we should model v2 properly.
63-
- ["github.com/gogf/gf/database/gdb", "DB", True, "DoExec", "", "", "ReturnValue[0]", "database", "manual"]
63+
- ["github.com/gogf/gf/database/gdb", "Core", True, "DoGetAll", "", "", "ReturnValue[0]", "database", "manual"]
64+
- ["github.com/gogf/gf/database/gdb", "Core", True, "DoQuery", "", "", "ReturnValue[0]", "database", "manual"]
65+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetAll", "", "", "ReturnValue[0]", "database", "manual"]
66+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetArray", "", "", "ReturnValue[0]", "database", "manual"]
67+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetOne", "", "", "ReturnValue[0]", "database", "manual"]
68+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetScan", "", "", "Argument[0]", "database", "manual"]
69+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetStruct", "", "", "Argument[0]", "database", "manual"]
70+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetStructs", "", "", "Argument[0]", "database", "manual"]
71+
- ["github.com/gogf/gf/database/gdb", "Core", True, "GetValue", "", "", "ReturnValue[0]", "database", "manual"]
72+
- ["github.com/gogf/gf/database/gdb", "Core", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
73+
6474
- ["github.com/gogf/gf/database/gdb", "DB", True, "DoGetAll", "", "", "ReturnValue[0]", "database", "manual"]
6575
- ["github.com/gogf/gf/database/gdb", "DB", True, "DoQuery", "", "", "ReturnValue[0]", "database", "manual"]
6676
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetAll", "", "", "ReturnValue[0]", "database", "manual"]
77+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetArray", "", "", "ReturnValue[0]", "database", "manual"]
6778
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetOne", "", "", "ReturnValue[0]", "database", "manual"]
79+
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetScan", "", "", "Argument[0]", "database", "manual"]
6880
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetValue", "", "", "ReturnValue[0]", "database", "manual"]
6981
- ["github.com/gogf/gf/database/gdb", "DB", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
70-
- ["github.com/gogf/gf/database/gdb", "DB", True, "Raw", "", "", "ReturnValue[0]", "database", "manual"]
71-
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetScan", "", "", "Argument[0]", "database", "manual"]
72-
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetStruct", "", "", "Argument[0]", "database", "manual"]
73-
- ["github.com/gogf/gf/database/gdb", "DB", True, "GetStructs", "", "", "Argument[0]", "database", "manual"]
74-
- ["github.com/gogf/gf/database/gdb", "Model", True, "Raw", "", "", "ReturnValue[0]", "database", "manual"]
82+
83+
- ["github.com/gogf/gf/database/gdb", "Model", True, "All", "", "", "ReturnValue[0]", "database", "manual"]
84+
- ["github.com/gogf/gf/database/gdb", "Model", True, "Array", "", "", "ReturnValue[0]", "database", "manual"]
85+
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindAll", "", "", "ReturnValue[0]", "database", "manual"]
86+
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindArray", "", "", "ReturnValue[0]", "database", "manual"]
87+
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindOne", "", "", "ReturnValue[0]", "database", "manual"]
88+
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindScan", "", "", "Argument[0]", "database", "manual"]
89+
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindValue", "", "", "ReturnValue[0]", "database", "manual"]
90+
- ["github.com/gogf/gf/database/gdb", "Model", True, "One", "", "", "ReturnValue[0]", "database", "manual"]
91+
- ["github.com/gogf/gf/database/gdb", "Model", True, "Scan", "", "", "Argument[0]", "database", "manual"]
92+
- ["github.com/gogf/gf/database/gdb", "Model", True, "ScanList", "", "", "Argument[0]", "database", "manual"]
93+
- ["github.com/gogf/gf/database/gdb", "Model", True, "Select", "", "", "ReturnValue[0]", "database", "manual"]
94+
- ["github.com/gogf/gf/database/gdb", "Model", True, "Struct", "", "", "Argument[0]", "database", "manual"]
95+
- ["github.com/gogf/gf/database/gdb", "Model", True, "Structs", "", "", "Argument[0]", "database", "manual"]
96+
- ["github.com/gogf/gf/database/gdb", "Model", True, "Value", "", "", "ReturnValue[0]", "database", "manual"]
97+
98+
- ["github.com/gogf/gf/database/gdb", "TX", True, "GetAll", "", "", "ReturnValue[0]", "database", "manual"]
99+
- ["github.com/gogf/gf/database/gdb", "TX", True, "GetOne", "", "", "ReturnValue[0]", "database", "manual"]
100+
- ["github.com/gogf/gf/database/gdb", "TX", True, "GetScan", "", "", "Argument[0]", "database", "manual"]
101+
- ["github.com/gogf/gf/database/gdb", "TX", True, "GetStruct", "", "", "Argument[0]", "database", "manual"]
102+
- ["github.com/gogf/gf/database/gdb", "TX", True, "GetStructs", "", "", "Argument[0]", "database", "manual"]
103+
- ["github.com/gogf/gf/database/gdb", "TX", True, "GetValue", "", "", "ReturnValue[0]", "database", "manual"]
104+
- ["github.com/gogf/gf/database/gdb", "TX", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
75105
- addsTo:
76106
pack: codeql/go-all
77107
extensible: summaryModel
78108
data:
79-
- ["github.com/gogf/gf/database/gdb", "Model", True, "All", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
80-
- ["github.com/gogf/gf/database/gdb", "Model", True, "Array", "", "", "Argument[receiver]", "ReturnValue[0].ArrayElement", "taint", "manual"]
81-
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindAll", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
82-
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindArray", "", "", "Argument[receiver]", "ReturnValue[0].ArrayElement", "taint", "manual"]
83-
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindOne", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
84-
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindValue", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
85-
- ["github.com/gogf/gf/database/gdb", "Model", True, "FindScan", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
86-
- ["github.com/gogf/gf/database/gdb", "Model", True, "One", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
87109
- ["github.com/gogf/gf/database/gdb", "Record", True, "GMap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
88110
- ["github.com/gogf/gf/database/gdb", "Record", True, "Interface", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
89111
- ["github.com/gogf/gf/database/gdb", "Record", True, "Json", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
90112
- ["github.com/gogf/gf/database/gdb", "Record", True, "Map", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
91113
- ["github.com/gogf/gf/database/gdb", "Record", True, "Struct", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
92114
- ["github.com/gogf/gf/database/gdb", "Record", True, "Xml", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
115+
93116
- ["github.com/gogf/gf/database/gdb", "Result", True, "Array", "", "", "Argument[receiver]", "ReturnValue.ArrayElement", "taint", "manual"]
94117
- ["github.com/gogf/gf/database/gdb", "Result", True, "Chunk", "", "", "Argument[receiver]", "ReturnValue.ArrayElement", "taint", "manual"]
95118
- ["github.com/gogf/gf/database/gdb", "Result", True, "Interface", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
@@ -102,7 +125,6 @@ extensions:
102125
- ["github.com/gogf/gf/database/gdb", "Result", True, "RecordKeyInt", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
103126
- ["github.com/gogf/gf/database/gdb", "Result", True, "RecordKeyStr", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
104127
- ["github.com/gogf/gf/database/gdb", "Result", True, "RecordKeyUint", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
105-
- ["github.com/gogf/gf/database/gdb", "Result", True, "RecordKeyValue", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
106128
- ["github.com/gogf/gf/database/gdb", "Result", True, "ScanList", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
107129
- ["github.com/gogf/gf/database/gdb", "Result", True, "Structs", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
108130
- ["github.com/gogf/gf/database/gdb", "Result", True, "Xml", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]

‎go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_gogf_gf_database_gdb.go

Lines changed: 233 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,242 @@
11
package test
22

3-
import (
4-
"fmt"
3+
//go:generate depstubber -vendor github.com/gogf/gf/database/gdb Core,DB,Model,TX,Record,Result
54

5+
import (
66
"github.com/gogf/gf/database/gdb"
77
)
88

9-
func gogf(g gdb.DB) {
10-
u1, err := g.GetOne("SELECT user from users") // $source
9+
func gogf_Core(g gdb.Core) {
10+
v1, _ := g.DoGetAll(nil, nil, "SELECT user from users") // $ source
11+
sink(v1) // $ hasTaintFlow="v1"
12+
13+
v2, _ := g.DoQuery(nil, nil, "SELECT user from users") // $ source
14+
sink(v2) // $ hasTaintFlow="v2"
15+
16+
v3, _ := g.GetAll("SELECT user from users") // $ source
17+
sink(v3) // $ hasTaintFlow="v3"
18+
19+
v4, _ := g.GetArray("SELECT user from users") // $ source
20+
sink(v4) // $ hasTaintFlow="v4"
21+
22+
v5, _ := g.GetOne("SELECT user from users") // $ source
23+
sink(v5) // $ hasTaintFlow="v5"
24+
25+
var v6 User
26+
g.GetScan(&v6, "SELECT user from users") // $ source
27+
sink(v6) // $ hasTaintFlow="v6"
28+
29+
var v7 User
30+
g.GetStruct(&v7, "SELECT user from users") // $ source
31+
sink(v7) // $ hasTaintFlow="v7"
32+
33+
var v8 []User // $ source
34+
g.GetStructs(v8, "SELECT user from users")
35+
sink(v8) // $ hasTaintFlow="v8"
36+
37+
v9, _ := g.GetValue("SELECT user from users") // $ source
38+
sink(v9) // $ hasTaintFlow="v9"
39+
40+
v10, _ := g.Query("SELECT user from users") // $ source
41+
sink(v10) // $ hasTaintFlow="v10"
42+
}
43+
44+
func gogf_DB(g gdb.DB) {
45+
v1, _ := g.DoGetAll(nil, nil, "SELECT user from users") // $ source
46+
sink(v1) // $ hasTaintFlow="v1"
47+
48+
v2, _ := g.DoQuery(nil, nil, "SELECT user from users") // $ source
49+
sink(v2) // $ hasTaintFlow="v2"
50+
51+
v3, _ := g.GetAll("SELECT user from users") // $ source
52+
sink(v3) // $ hasTaintFlow="v3"
53+
54+
v4, _ := g.GetArray("SELECT user from users") // $ source
55+
sink(v4) // $ hasTaintFlow="v4"
56+
57+
v5, _ := g.GetOne("SELECT user from users") // $ source
58+
sink(v5) // $ hasTaintFlow="v5"
59+
60+
var v6 User
61+
g.GetScan(&v6, "SELECT user from users") // $ source
62+
sink(v6) // $ hasTaintFlow="v6"
63+
64+
v7, _ := g.GetValue("SELECT user from users") // $ source
65+
sink(v7) // $ hasTaintFlow="v7"
66+
67+
v8, _ := g.Query("SELECT user from users") // $ source
68+
sink(v8) // $ hasTaintFlow="v8"
69+
}
70+
71+
func gogf_Model(g gdb.Model) {
72+
v1, _ := g.All() // $ source
73+
sink(v1) // $ hasTaintFlow="v1"
74+
75+
v2, _ := g.Array() // $ source
76+
sink(v2) // $ hasTaintFlow="v2"
77+
78+
v3, _ := g.FindAll() // $ source
79+
sink(v3) // $ hasTaintFlow="v3"
80+
81+
v4, _ := g.FindArray() // $ source
82+
sink(v4) // $ hasTaintFlow="v4"
83+
84+
v5, _ := g.FindOne() // $ source
85+
sink(v5) // $ hasTaintFlow="v5"
86+
87+
var v6 User
88+
g.FindScan(&v6) // $ source
89+
sink(v6) // $ hasTaintFlow="v6"
90+
91+
v7, _ := g.FindValue() // $ source
92+
sink(v7) // $ hasTaintFlow="v7"
93+
94+
v8, _ := g.One() // $ source
95+
sink(v8) // $ hasTaintFlow="v8"
96+
97+
var v9 User
98+
g.Scan(&v9) // $ source
99+
sink(v9) // $ hasTaintFlow="v9"
100+
101+
var v10 []User
102+
g.ScanList(&v10, "") // $ source
103+
sink(v10) // $ hasTaintFlow="v10"
104+
105+
v11, _ := g.Select() // $ source
106+
sink(v11) // $ hasTaintFlow="v11"
107+
108+
var v12 User
109+
g.Struct(&v12) // $ source
110+
sink(v12) // $ hasTaintFlow="v12"
111+
112+
var v13 []User
113+
g.Structs(&v13, "") // $ source
114+
sink(v13) // $ hasTaintFlow="v13"
115+
116+
v14, _ := g.Value() // $ source
117+
sink(v14) // $ hasTaintFlow="v14"
118+
}
119+
120+
func gogf_TX(g gdb.TX) {
121+
v1, _ := g.GetAll("SELECT user from users") // $ source
122+
sink(v1) // $ hasTaintFlow="v1"
123+
124+
v2, _ := g.GetOne("SELECT user from users") // $ source
125+
sink(v2) // $ hasTaintFlow="v2"
126+
127+
var v3 User
128+
g.GetScan(&v3, "SELECT user from users") // $ source
129+
sink(v3) // $ hasTaintFlow="v3"
130+
131+
var v4 User
132+
g.GetStruct(&v4, "SELECT user from users") // $ source
133+
sink(v4) // $ hasTaintFlow="v4"
134+
135+
var v5 []User // $ source
136+
g.GetStructs(v5, "SELECT user from users")
137+
sink(v5) // $ hasTaintFlow="v5"
138+
139+
v6, _ := g.GetValue("SELECT user from users") // $ source
140+
sink(v6) // $ hasTaintFlow="v6"
141+
142+
v7, _ := g.Query("SELECT user from users") // $ source
143+
sink(v7) // $ hasTaintFlow="v7"
144+
}
145+
146+
func gogf_Record_summary(g gdb.Core) {
147+
record1, _ := g.GetOne("SELECT summary from records") // $ source
148+
gmap := record1.GMap()
149+
sink(gmap) // $ hasTaintFlow="gmap"
150+
151+
record2, _ := g.GetOne("SELECT summary from records") // $ source
152+
interface_ := record2.Interface()
153+
sink(interface_) // $ hasTaintFlow="interface_"
154+
155+
record3, _ := g.GetOne("SELECT summary from records") // $ source
156+
json := record3.Json()
157+
sink(json) // $ hasTaintFlow="json"
158+
159+
record4, _ := g.GetOne("SELECT summary from records") // $ source
160+
map_ := record4.Map()
161+
sink(map_) // $ hasTaintFlow="map_"
162+
163+
record5, _ := g.GetOne("SELECT summary from records") // $ source
164+
var struct_ struct{}
165+
record5.Struct(&struct_)
166+
sink(struct_) // $ hasTaintFlow="struct_"
167+
168+
record6, _ := g.GetOne("SELECT summary from records") // $ source
169+
xml := record6.Xml()
170+
sink(xml) // $ hasTaintFlow="xml"
171+
172+
// Note: currently missing models for methods on return type of `GMap`,
173+
// which is `StrAnyMap` from package "github.com/gogf/gf/container/gmap".
174+
}
175+
176+
func gogf_Result_summary(g gdb.Core) {
177+
result1, _ := g.GetAll("SELECT summary from records") // $ source
178+
array := result1.Array()
179+
sink(array) // $ hasTaintFlow="array"
180+
181+
result2, _ := g.GetAll("SELECT summary from records") // $ source
182+
chunk := result2.Chunk(1)
183+
sink(chunk) // $ hasTaintFlow="chunk"
184+
185+
result3, _ := g.GetAll("SELECT summary from records") // $ source
186+
interface_ := result3.Interface()
187+
sink(interface_) // $ hasTaintFlow="interface_"
188+
189+
result4, _ := g.GetAll("SELECT summary from records") // $ source
190+
json := result4.Json()
191+
sink(json) // $ hasTaintFlow="json"
192+
193+
result5, _ := g.GetAll("SELECT summary from records") // $ source
194+
list := result5.List()
195+
sink(list) // $ hasTaintFlow="list"
196+
197+
result6, _ := g.GetAll("SELECT summary from records") // $ source
198+
mapkeyint := result6.MapKeyInt("")
199+
sink(mapkeyint) // $ hasTaintFlow="mapkeyint"
200+
201+
result7, _ := g.GetAll("SELECT summary from records") // $ source
202+
mapkeystr := result7.MapKeyStr("")
203+
sink(mapkeystr) // $ hasTaintFlow="mapkeystr"
204+
205+
result8, _ := g.GetAll("SELECT summary from records") // $ source
206+
mapkeyuint := result8.MapKeyUint("")
207+
sink(mapkeyuint) // $ hasTaintFlow="mapkeyuint"
208+
209+
result9, _ := g.GetAll("SELECT summary from records") // $ source
210+
mapkeyvalue := result9.MapKeyValue("")
211+
sink(mapkeyvalue) // $ hasTaintFlow="mapkeyvalue"
212+
213+
result10, _ := g.GetAll("SELECT summary from records") // $ source
214+
recordkeyint := result10.RecordKeyInt("")
215+
sink(recordkeyint) // $ hasTaintFlow="recordkeyint"
216+
217+
result11, _ := g.GetAll("SELECT summary from records") // $ source
218+
recordkeystr := result11.RecordKeyStr("")
219+
sink(recordkeystr) // $ hasTaintFlow="recordkeystr"
220+
221+
result12, _ := g.GetAll("SELECT summary from records") // $ source
222+
recordkeyuint := result12.RecordKeyUint("")
223+
sink(recordkeyuint) // $ hasTaintFlow="recordkeyuint"
224+
225+
result13, _ := g.GetAll("SELECT summary from records") // $ source
226+
var structslice1 []struct{}
227+
result13.ScanList(&structslice1, "")
228+
sink(structslice1) // $ hasTaintFlow="structslice1"
229+
230+
result14, _ := g.GetAll("SELECT summary from records") // $ source
231+
var structslice2 []struct{}
232+
result14.Structs(&structslice2)
233+
sink(structslice2) // $ hasTaintFlow="structslice2"
11234

12-
if err != nil {
13-
return
14-
}
235+
result15, _ := g.GetAll("SELECT summary from records") // $ source
236+
xml := result15.Xml()
237+
sink(xml) // $ hasTaintFlow="xml"
15238

16-
fmt.Println(u1)
239+
// Note: currently missing models for methods on the type `Var` from
240+
// package "github.com/gogf/gf/container/gvar", which is involved in the
241+
// return type of `Array` and `MapKeyValue`.
17242
}

0 commit comments

Comments
 (0)