Add database/sql/driver taint-tracking

Author: gagliardetto

ql/src/semmle/go/frameworks/SQL.qll

@@ -48,6 +48,41 @@ module SQL {
     }
   }
 
+  private class SqlDriverMethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    SqlDriverMethodModels() {
+      // signature: func (NotNull).ConvertValue(v interface{}) (Value, error)
+      this.hasQualifiedName("database/sql/driver", "NotNull", "ConvertValue") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func (Null).ConvertValue(v interface{}) (Value, error)
+      this.hasQualifiedName("database/sql/driver", "Null", "ConvertValue") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func (ValueConverter).ConvertValue(v interface{}) (Value, error)
+      this.implements("database/sql/driver", "ValueConverter", "ConvertValue") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func (Conn).Prepare(query string) (Stmt, error)
+      this.implements("database/sql/driver", "Conn", "Prepare") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func (ConnPrepareContext).PrepareContext(ctx context.Context, query string) (Stmt, error)
+      this.implements("database/sql/driver", "ConnPrepareContext", "PrepareContext") and
+      (inp.isParameter(1) and outp.isResult(0))
+      or
+      // signature: func (Valuer).Value() (Value, error)
+      this.implements("database/sql/driver", "Valuer", "Value") and
+      (inp.isReceiver() and outp.isResult(0))
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+
   /**
    * A data-flow node whose string value is interpreted as (part of) a SQL query.
    *