Skip to content

Commit 6d61820

Browse files
owen-mcowen-mc
authored
Merge pull request #19088 from owen-mc/review/egregius313/18913
Go: Add database source models for the github.com/couchbase/gocb package (#2)
2 parents 9d3d3de + 2790415 commit 6d61820

File tree

21 files changed

+6219
-364
lines changed

21 files changed

+6219
-364
lines changed

‎go/ql/lib/change-notes/2025-03-03-couchbase-source-models.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* `database` source models have been added for v1 and v2 of the `github.com/couchbase/gocb` package.
5+

‎go/ql/lib/ext/github.com.couchbase.gocb.model.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,32 @@ extensions:
99
- ["gocb2", "github.com/couchbase/gocb/v2"]
1010
- ["gocb2", "gopkg.in/couchbase/gocb.v2"]
1111
- ["gocb2", "github.com/couchbaselabs/gocb/v2"]
12+
- addsTo:
13+
pack: codeql/go-all
14+
extensible: sourceModel
15+
data:
16+
- ["group:gocb1", "Cluster", True, "ExecuteAnalyticsQuery", "", "", "ReturnValue[0]", "database", "manual"]
17+
- ["group:gocb1", "Cluster", True, "ExecuteN1qlQuery", "", "", "ReturnValue[0]", "database", "manual"]
18+
- ["group:gocb1", "Cluster", True, "ExecuteSearchQuery", "", "", "ReturnValue[0]", "database", "manual"]
19+
- ["group:gocb2", "Cluster", True, "AnalyticsQuery", "", "", "ReturnValue[0]", "database", "manual"]
20+
- ["group:gocb2", "Cluster", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
21+
- ["group:gocb2", "Collection", True, "Get", "", "", "ReturnValue[0]", "database", "manual"]
22+
- ["group:gocb2", "Collection", True, "GetAndLock", "", "", "ReturnValue[0]", "database", "manual"]
23+
- ["group:gocb2", "Collection", True, "GetAndTouch", "", "", "ReturnValue[0]", "database", "manual"]
24+
- ["group:gocb2", "Collection", True, "GetAnyReplica", "", "", "ReturnValue[0]", "database", "manual"]
25+
- ["group:gocb2", "Collection", True, "LookupIn", "", "", "ReturnValue[0]", "database", "manual"]
26+
- ["group:gocb2", "Collection", True, "LookupInAllReplicas", "", "", "ReturnValue[0]", "database", "manual"]
27+
- ["group:gocb2", "Collection", True, "LookupInAnyReplica", "", "", "ReturnValue[0]", "database", "manual"]
28+
- ["group:gocb2", "Collection", True, "Scan", "", "", "ReturnValue[0]", "database", "manual"]
29+
- ["group:gocb2", "Scope", True, "AnalyticsQuery", "", "", "ReturnValue[0]", "database", "manual"]
30+
- ["group:gocb2", "Scope", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
31+
- ["group:gocb2", "TransactionAttemptContext", True, "Get", "", "", "ReturnValue[0]", "database", "manual"]
32+
- ["group:gocb2", "TransactionAttemptContext", True, "GetReplicaFromPreferredServerGroup", "", "", "ReturnValue[0]", "database", "manual"]
33+
- ["group:gocb2", "TransactionAttemptContext", True, "Insert", "", "", "ReturnValue[0]", "database", "manual"]
34+
- ["group:gocb2", "TransactionAttemptContext", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
35+
- ["group:gocb2", "TransactionAttemptContext", True, "Replace", "", "", "ReturnValue[0]", "database", "manual"]
36+
- ["group:gocb2", "ViewIndexManager", True, "GetAllDesignDocuments", "", "", "ReturnValue[0]", "database", "manual"]
37+
- ["group:gocb2", "ViewIndexManager", True, "GetDesignDocument", "", "", "ReturnValue[0]", "database", "manual"]
1238
- addsTo:
1339
pack: codeql/go-all
1440
extensible: sinkModel
@@ -27,6 +53,9 @@ extensions:
2753
data:
2854
- ["group:gocb1", "", False, "NewAnalyticsQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
2955
- ["group:gocb1", "", False, "NewN1qlQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
56+
- ["group:gocb1", "AnalyticsResults", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
57+
- ["group:gocb1", "AnalyticsResults", True, "Next", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
58+
- ["group:gocb1", "AnalyticsResults", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
3059
- ["group:gocb1", "AnalyticsQuery", True, "ContextId", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
3160
- ["group:gocb1", "AnalyticsQuery", True, "Deferred", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
3261
- ["group:gocb1", "AnalyticsQuery", True, "Pretty", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
@@ -43,3 +72,30 @@ extensions:
4372
- ["group:gocb1", "N1qlQuery", True, "ReadOnly", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
4473
- ["group:gocb1", "N1qlQuery", True, "ScanCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
4574
- ["group:gocb1", "N1qlQuery", True, "Timeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
75+
- ["group:gocb1", "QueryResults", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
76+
- ["group:gocb1", "QueryResults", True, "Next", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
77+
- ["group:gocb1", "QueryResults", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
78+
- ["group:gocb1", "SearchResults", True, "Hits", "", "", "Argument[receiver]", "ReturnValue.ArrayElement", "taint", "manual"]
79+
- ["group:gocb2", "AnalyticsResult", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
80+
- ["group:gocb2", "AnalyticsResult", True, "Raw", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
81+
- ["group:gocb2", "AnalyticsResult", True, "Row", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
82+
- ["group:gocb2", "AnalyticsResultRaw", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
83+
- ["group:gocb2", "GetResult", True, "Content", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
84+
- ["group:gocb2", "LookupInAllReplicasResult", True, "Next", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
85+
- ["group:gocb2", "LookupInResult", True, "ContentAt", "", "", "Argument[receiver]", "Argument[1]", "taint", "manual"]
86+
- ["group:gocb2", "MutateInResult", True, "ContentAt", "", "", "Argument[receiver]", "Argument[1]", "taint", "manual"]
87+
- ["group:gocb2", "QueryResult", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
88+
- ["group:gocb2", "QueryResult", True, "Raw", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
89+
- ["group:gocb2", "QueryResult", True, "Row", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
90+
- ["group:gocb2", "QueryResultRaw", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
91+
- ["group:gocb2", "ScanResult", True, "Next", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
92+
- ["group:gocb2", "ScanResultItem", True, "Content", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
93+
- ["group:gocb2", "SearchResult", True, "Raw", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
94+
- ["group:gocb2", "SearchResult", True, "Row", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
95+
- ["group:gocb2", "SearchResultRaw", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
96+
- ["group:gocb2", "TransactionGetResult", True, "Content", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
97+
- ["group:gocb2", "TransactionQueryResult", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
98+
- ["group:gocb2", "TransactionQueryResult", True, "Row", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
99+
- ["group:gocb2", "ViewResult", True, "Raw", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
100+
- ["group:gocb2", "ViewResult", True, "Row", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
101+
- ["group:gocb2", "ViewResultRaw", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]

‎go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/go.mod‎

Lines changed: 51 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,57 @@
11
module test
22

3-
go 1.22.5
3+
go 1.24
44

55
require (
6-
gorm.io/gorm v1.23.0
6+
github.com/astaxie/beego v1.12.3
7+
github.com/beego/beego/v2 v2.3.5
8+
github.com/couchbase/gocb v1.6.7
9+
github.com/couchbase/gocb/v2 v2.9.4
710
github.com/jmoiron/sqlx v1.4.0
8-
go.mongodb.org/mongo-driver/mongo v1.17.2
11+
github.com/rqlite/gorqlite v0.0.0-20250128004930-114c7828b55a
12+
go.mongodb.org/mongo-driver v1.17.3
13+
gorm.io/gorm v1.25.12
14+
)
15+
16+
require (
17+
github.com/couchbase/gocbcore/v10 v10.5.4 // indirect
18+
github.com/couchbase/gocbcoreps v0.1.3 // indirect
19+
github.com/couchbase/goprotostellar v1.0.2 // indirect
20+
github.com/couchbaselabs/gocbconnstr/v2 v2.0.0-20240607131231-fb385523de28 // indirect
21+
github.com/go-logr/logr v1.4.1 // indirect
22+
github.com/go-logr/stdr v1.2.2 // indirect
23+
github.com/golang/snappy v0.0.4 // indirect
24+
github.com/google/uuid v1.6.0 // indirect
25+
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
26+
github.com/hashicorp/golang-lru v0.5.4 // indirect
27+
github.com/jinzhu/inflection v1.0.0 // indirect
28+
github.com/jinzhu/now v1.1.5 // indirect
29+
github.com/klauspost/compress v1.16.7 // indirect
30+
github.com/montanaflynn/stats v0.7.1 // indirect
31+
github.com/opentracing/opentracing-go v1.2.0 // indirect
32+
github.com/pkg/errors v0.9.1 // indirect
33+
github.com/shiena/ansicolor v0.0.0-20200904210342-c7312218db18 // indirect
34+
github.com/valyala/bytebufferpool v1.0.0 // indirect
35+
github.com/xdg-go/pbkdf2 v1.0.0 // indirect
36+
github.com/xdg-go/scram v1.1.2 // indirect
37+
github.com/xdg-go/stringprep v1.0.4 // indirect
38+
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
39+
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
40+
go.opentelemetry.io/otel v1.24.0 // indirect
41+
go.opentelemetry.io/otel/metric v1.24.0 // indirect
42+
go.opentelemetry.io/otel/trace v1.24.0 // indirect
43+
go.uber.org/multierr v1.11.0 // indirect
44+
go.uber.org/zap v1.27.0 // indirect
45+
golang.org/x/crypto v0.26.0 // indirect
46+
golang.org/x/net v0.24.0 // indirect
47+
golang.org/x/sync v0.8.0 // indirect
48+
golang.org/x/sys v0.23.0 // indirect
49+
golang.org/x/text v0.17.0 // indirect
50+
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
51+
google.golang.org/grpc v1.63.2 // indirect
52+
google.golang.org/protobuf v1.34.2 // indirect
53+
gopkg.in/couchbase/gocbcore.v7 v7.1.18 // indirect
54+
gopkg.in/couchbaselabs/gocbconnstr.v1 v1.0.4 // indirect
55+
gopkg.in/couchbaselabs/gojcbmock.v1 v1.0.4 // indirect
56+
gopkg.in/couchbaselabs/jsonx.v1 v1.0.1 // indirect
957
)

‎go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_beego_orm.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
package test
22

3+
//go:generate depstubber -vendor github.com/astaxie/beego/orm Ormer NewOrm
4+
//go:generate depstubber -vendor github.com/beego/beego/v2/client/orm DB,DQL,Ormer NewOrm
5+
36
import (
47
oldOrm "github.com/astaxie/beego/orm"
58
"github.com/beego/beego/v2/client/orm"

‎go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/test_couchbase_gocb_v1.go‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
package test
2+
3+
//go:generate depstubber -vendor github.com/couchbase/gocb Cluster,AnalyticsResults,QueryResults,SearchResults
4+
5+
import "github.com/couchbase/gocb"
6+
7+
func test_couchbase_gocb_v1_Cluster(cluster *gocb.Cluster, aq *gocb.AnalyticsQuery, n1ql *gocb.N1qlQuery, sq *gocb.SearchQuery) {
8+
// Analytics
9+
r1, err := cluster.ExecuteAnalyticsQuery(aq, nil) // $ source
10+
11+
if err != nil {
12+
return
13+
}
14+
15+
var user1, user2 User
16+
17+
r1.One(&user1)
18+
sink(user1) // $ hasTaintFlow="user1"
19+
20+
for r1.Next(user2) {
21+
sink(user2) // $ hasTaintFlow="user2"
22+
}
23+
24+
var b1 []byte
25+
b1 = r1.NextBytes()
26+
sink(b1) // $ hasTaintFlow="b1"
27+
28+
// N1QL
29+
r2, err := cluster.ExecuteN1qlQuery(n1ql, nil) // $ source
30+
31+
if err != nil {
32+
return
33+
}
34+
35+
var user3, user4 User
36+
37+
r2.One(&user3)
38+
sink(user3) // $ hasTaintFlow="user3"
39+
40+
for r2.Next(user4) {
41+
sink(user4) // $ hasTaintFlow="user4"
42+
}
43+
44+
var b2 []byte
45+
b2 = r2.NextBytes()
46+
sink(b2) // $ hasTaintFlow="b2"
47+
48+
// Search
49+
r3, err := cluster.ExecuteSearchQuery(sq) // $ source
50+
51+
if err != nil {
52+
return
53+
}
54+
55+
hit := r3.Hits()[0]
56+
sink(hit) // $ hasTaintFlow="hit"
57+
}

0 commit comments

Comments
 (0)