Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 806cfc7

Browse files
max-schaefermax-schaefer
authored
Merge pull request #149 from max-schaefer/cleanup-130
Clean up NoSQL library
2 parents f5a8e07 + 9a4bee9 commit 806cfc7

7 files changed

Lines changed: 57 additions & 41 deletions

File tree

‎change-notes/2020-05-20-mongodb-model.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
lgtm,codescanning
2+
* Modeling of the `go.mongodb.org/mongo-driver/mongo` package has been added, which may lead to more
3+
results from the security queries.

‎ql/src/semmle/go/frameworks/NoSQL.qll‎

Lines changed: 47 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -7,83 +7,98 @@ import go
77
/** Provides classes for working with NoSQL-related APIs. */
88
module NoSQL {
99
/**
10-
* A data-flow node whose string value is interpreted as (part of) a NoSQL query.
10+
* A data-flow node whose value is interpreted as (part of) a NoSQL query.
1111
*
1212
* Extend this class to refine existing API models. If you want to model new APIs,
13-
* extend `NoSQL::QueryString::Range` instead.
13+
* extend `NoSQL::Query::Range` instead.
1414
*/
15-
class NoSQLQueryString extends DataFlow::Node {
16-
NoSQLQueryString::Range self;
15+
class Query extends DataFlow::Node {
16+
Query::Range self;
1717

18-
NoSQLQueryString() { this = self }
18+
Query() { this = self }
1919
}
2020

21-
/** Provides classes for working with SQL query strings. */
22-
module NoSQLQueryString {
21+
/** Provides classes for working with NoSQL queries. */
22+
module Query {
2323
/**
24-
* A data-flow node whose string value is interpreted as (part of) a NoSQL query.
24+
* A data-flow node whose value is interpreted as (part of) a NoSQL query.
2525
*
2626
* Extend this class to model new APIs. If you want to refine existing API models,
27-
* extend `NoSQL::QueryString` instead.
27+
* extend `NoSQL::Query` instead.
2828
*/
2929
abstract class Range extends DataFlow::Node { }
3030

3131
/**
32-
* Holds if method `name` of `Collection` struct of `go.mongodb.org/mongo-driver/mongo`
33-
* package interprets parameter `n` as a query.
32+
* Holds if method `name` of struct `Collection` from package
33+
* [go.mongodb.org/mongo-driver/mongo](https://pkg.go.dev/go.mongodb.org/mongo-driver/mongo)
34+
* interprets parameter `n` as a query.
3435
*/
35-
private predicate collectionMethods(string name, int n) {
36-
// func (coll *Collection) CountDocuments(ctx context.Context, filter interface{}, opts ...*options.CountOptions) (int64, error)
36+
private predicate mongoDbCollectionMethod(string name, int n) {
37+
// func (coll *Collection) CountDocuments(ctx context.Context, filter interface{},
38+
// opts ...*options.CountOptions) (int64, error)
3739
name = "CountDocuments" and n = 1
3840
or
39-
// func (coll *Collection) DeleteMany(ctx context.Context, filter interface{}, opts ...*options.DeleteOptions) (*DeleteResult, error)
41+
// func (coll *Collection) DeleteMany(ctx context.Context, filter interface{},
42+
// opts ...*options.DeleteOptions) (*DeleteResult, error)
4043
name = "DeleteMany" and n = 1
4144
or
42-
// func (coll *Collection) DeleteOne(ctx context.Context, filter interface{}, opts ...*options.DeleteOptions) (*DeleteResult, error)
45+
// func (coll *Collection) DeleteOne(ctx context.Context, filter interface{},
46+
// opts ...*options.DeleteOptions) (*DeleteResult, error)
4347
name = "DeleteOne" and n = 1
4448
or
45-
// func (coll *Collection) Distinct(ctx context.Context, fieldName string, filter interface{}, ...) ([]interface{}, error)
49+
// func (coll *Collection) Distinct(ctx context.Context, fieldName string, filter interface{},
50+
// ...) ([]interface{}, error)
4651
name = "Distinct" and n = 2
4752
or
48-
// func (coll *Collection) Find(ctx context.Context, filter interface{}, opts ...*options.FindOptions) (*Cursor, error)
53+
// func (coll *Collection) Find(ctx context.Context, filter interface{},
54+
// opts ...*options.FindOptions) (*Cursor, error)
4955
name = "Find" and n = 1
5056
or
51-
// func (coll *Collection) FindOne(ctx context.Context, filter interface{}, opts ...*options.FindOneOptions) *SingleResult
57+
// func (coll *Collection) FindOne(ctx context.Context, filter interface{},
58+
// opts ...*options.FindOneOptions) *SingleResult
5259
name = "FindOne" and n = 1
5360
or
54-
// func (coll *Collection) FindOneAndDelete(ctx context.Context, filter interface{}, ...) *SingleResult
61+
// func (coll *Collection) FindOneAndDelete(ctx context.Context, filter interface{}, ...)
62+
// *SingleResult
5563
name = "FindOneAndDelete" and n = 1
5664
or
57-
// func (coll *Collection) FindOneAndReplace(ctx context.Context, filter interface{}, replacement interface{}, ...) *SingleResult
65+
// func (coll *Collection) FindOneAndReplace(ctx context.Context, filter interface{},
66+
// replacement interface{}, ...) *SingleResult
5867
name = "FindOneAndReplace" and n = 1
5968
or
60-
// func (coll *Collection) FindOneAndUpdate(ctx context.Context, filter interface{}, update interface{}, ...) *SingleResult
69+
// func (coll *Collection) FindOneAndUpdate(ctx context.Context, filter interface{},
70+
// update interface{}, ...) *SingleResult
6171
name = "FindOneAndUpdate" and n = 1
6272
or
63-
// func (coll *Collection) ReplaceOne(ctx context.Context, filter interface{}, replacement interface{}, ...) (*UpdateResult, error)
73+
// func (coll *Collection) ReplaceOne(ctx context.Context, filter interface{},
74+
// replacement interface{}, ...) (*UpdateResult, error)
6475
name = "ReplaceOne" and n = 1
6576
or
66-
// func (coll *Collection) UpdateMany(ctx context.Context, filter interface{}, update interface{}, ...) (*UpdateResult, error)
77+
// func (coll *Collection) UpdateMany(ctx context.Context, filter interface{},
78+
// update interface{}, ...) (*UpdateResult, error)
6779
name = "UpdateMany" and n = 1
6880
or
69-
// func (coll *Collection) UpdateOne(ctx context.Context, filter interface{}, update interface{}, ...) (*UpdateResult, error)
81+
// func (coll *Collection) UpdateOne(ctx context.Context, filter interface{},
82+
// update interface{}, ...) (*UpdateResult, error)
7083
name = "UpdateOne" and n = 1
7184
or
72-
// func (coll *Collection) Watch(ctx context.Context, pipeline interface{}, ...) (*ChangeStream, error)
85+
// func (coll *Collection) Watch(ctx context.Context, pipeline interface{}, ...)
86+
// (*ChangeStream, error)
7387
name = "Watch" and n = 1
7488
or
75-
// func (coll *Collection) Aggregate(ctx context.Context, pipeline interface{}, opts ...*options.AggregateOptions) (*Cursor, error)
89+
// func (coll *Collection) Aggregate(ctx context.Context, pipeline interface{},
90+
// opts ...*options.AggregateOptions) (*Cursor, error)
7691
name = "Aggregate" and n = 1
7792
}
7893

7994
/**
80-
* A query string used in an API function acting on a `Collection` struct of
81-
* `go.mongodb.org/mongo-driver/mongo` package
95+
* A query used in an API function acting on a `Collection` struct of package
96+
* [go.mongodb.org/mongo-driver/mongo](https://pkg.go.dev/go.mongodb.org/mongo-driver/mongo).
8297
*/
83-
private class MongoDbCollectionQueryString extends Range {
84-
MongoDbCollectionQueryString() {
98+
private class MongoDbCollectionQuery extends Range {
99+
MongoDbCollectionQuery() {
85100
exists(Method meth, string methodName, int n |
86-
collectionMethods(methodName, n) and
101+
mongoDbCollectionMethod(methodName, n) and
87102
meth.hasQualifiedName("go.mongodb.org/mongo-driver/mongo", "Collection", methodName) and
88103
this = meth.getACall().getArgument(n)
89104
)
@@ -97,7 +112,7 @@ module NoSQL {
97112
predicate isAdditionalMongoTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
98113
// Taint an entry if the `Value` is tainted
99114
exists(Write w, DataFlow::Node base, Field f | w.writesField(base, f, pred) |
100-
base = succ.getASuccessor*() and
115+
base = succ.(DataFlow::PostUpdateNode).getPreUpdateNode() and
101116
base.getType().hasQualifiedName("go.mongodb.org/mongo-driver/bson/primitive", "E") and
102117
f.getName() = "Value"
103118
)

‎ql/src/semmle/go/security/SqlInjection.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ module SqlInjection {
2323

2424
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2525

26-
override predicate isAdditionalTaintStep(DataFlow::Node prev, DataFlow::Node succ) {
27-
NoSQL::isAdditionalMongoTaintStep(prev, succ)
26+
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
27+
NoSQL::isAdditionalMongoTaintStep(pred, succ)
2828
}
2929

3030
override predicate isSanitizer(DataFlow::Node node) {

‎ql/src/semmle/go/security/SqlInjectionCustomizations.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ module SqlInjection {
4040
SqlQueryAsSink() { this instanceof SQL::QueryString }
4141
}
4242

43-
/** An NoSQL string, considered as a taint sink for SQL injection. */
43+
/** A NoSQL query, considered as a taint sink for SQL injection. */
4444
class NoSqlQueryAsSink extends Sink {
45-
NoSqlQueryAsSink() { this instanceof NoSQL::NoSQLQueryString }
45+
NoSqlQueryAsSink() { this instanceof NoSQL::Query }
4646
}
4747
}

ql/test/library-tests/semmle/go/frameworks/NoSQL/QueryString.expected renamed to ql/test/library-tests/semmle/go/frameworks/NoSQL/Query.expected

File renamed without changes.

‎ql/test/library-tests/semmle/go/frameworks/NoSQL/Query.ql‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
import go
2+
3+
select any(NoSQL::Query q)

‎ql/test/library-tests/semmle/go/frameworks/NoSQL/QueryString.ql‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

0 commit comments

Comments
 (0)