Skip to content

Commit 75a34a4

Browse files
geoffw0geoffw0
authored
Merge pull request #20631 from geoffw0/mysql
Rust: Model mysql and mysql_async query sinks
2 parents 1936aba + 072eca2 commit 75a34a4

File tree

9 files changed

+1250
-147
lines changed

9 files changed

+1250
-147
lines changed

‎docs/codeql/reusables/supported-frameworks.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -336,6 +336,8 @@ and the CodeQL library pack ``codeql/rust-all`` (`changelog <https://github.com/
336336
`log <https://crates.io/crates/log>`__, Logging library
337337
`md5 <https://crates.io/crates/md5>`__, Utility library
338338
`memchr <https://crates.io/crates/memchr>`__, Utility library
339+
`mysql <https://crates.io/crates/mysql>`__, Database
340+
`mysql_async <https://crates.io/crates/mysql_async>`__, Database
339341
`once_cell <https://crates.io/crates/once_cell>`__, Utility library
340342
`poem <https://crates.io/crates/poem>`__, Web framework
341343
`postgres <https://crates.io/crates/postgres>`__, Database

‎rust/ql/lib/change-notes/2025-10-10-mysql.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added models for the `mysql` and `mysql_async` libraries.

‎rust/ql/lib/codeql/rust/frameworks/mysql-async.model.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sinkModel
5+
data:
6+
- ["<_ as mysql_async::queryable::Queryable>::query", "Argument[0]", "sql-injection", "manual"]
7+
- ["<_ as mysql_async::queryable::Queryable>::query_drop", "Argument[0]", "sql-injection", "manual"]
8+
- ["<_ as mysql_async::queryable::Queryable>::query_first", "Argument[0]", "sql-injection", "manual"]
9+
- ["<_ as mysql_async::queryable::Queryable>::query_fold", "Argument[0]", "sql-injection", "manual"]
10+
- ["<_ as mysql_async::queryable::Queryable>::query_stream", "Argument[0]", "sql-injection", "manual"]
11+
- ["<_ as mysql_async::queryable::Queryable>::query_map", "Argument[0]", "sql-injection", "manual"]
12+
- ["<mysql_async::conn::Conn as mysql_async::queryable::Queryable>::query_iter", "Argument[0]", "sql-injection", "manual"]
13+
- ["<mysql_async::conn::Conn as mysql_async::queryable::Queryable>::prep", "Argument[0]", "sql-injection", "manual"]

‎rust/ql/lib/codeql/rust/frameworks/mysql.model.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sinkModel
5+
data:
6+
- ["<_ as mysql::conn::queryable::Queryable>::query", "Argument[0]", "sql-injection", "manual"]
7+
- ["<_ as mysql::conn::queryable::Queryable>::query_opt", "Argument[0]", "sql-injection", "manual"]
8+
- ["<_ as mysql::conn::queryable::Queryable>::query_drop", "Argument[0]", "sql-injection", "manual"]
9+
- ["<_ as mysql::conn::queryable::Queryable>::query_first", "Argument[0]", "sql-injection", "manual"]
10+
- ["<_ as mysql::conn::queryable::Queryable>::query_first_opt", "Argument[0]", "sql-injection", "manual"]
11+
- ["<_ as mysql::conn::queryable::Queryable>::query_fold", "Argument[0]", "sql-injection", "manual"]
12+
- ["<_ as mysql::conn::queryable::Queryable>::query_fold_opt", "Argument[0]", "sql-injection", "manual"]
13+
- ["<mysql::conn::pool::PooledConn as mysql::conn::queryable::Queryable>::query_iter", "Argument[0]", "sql-injection", "manual"]
14+
- ["<_ as mysql::conn::queryable::Queryable>::query_map", "Argument[0]", "sql-injection", "manual"]
15+
- ["<_ as mysql::conn::queryable::Queryable>::query_map_opt", "Argument[0]", "sql-injection", "manual"]
16+
- ["<mysql::conn::pool::PooledConn as mysql::conn::queryable::Queryable>::prep", "Argument[0]", "sql-injection", "manual"]

‎rust/ql/test/query-tests/security/CWE-089/CONSISTENCY/PathResolutionConsistency.expected‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,57 @@
11
multipleCallTargets
2+
| mysql.rs:15:24:15:39 | ...::from(...) |
3+
| mysql.rs:16:26:16:85 | ...::from(...) |
4+
| mysql.rs:18:13:18:66 | ...::from(...) |
5+
| mysql.rs:19:30:19:83 | ...::from(...) |
6+
| mysql.rs:22:38:22:56 | safe_query.as_str() |
7+
| mysql.rs:25:38:25:58 | unsafe_query.as_str() |
8+
| mysql.rs:26:64:26:84 | unsafe_query.as_str() |
9+
| mysql.rs:27:25:27:45 | unsafe_query.as_str() |
10+
| mysql.rs:28:39:28:59 | unsafe_query.as_str() |
11+
| mysql.rs:29:65:29:85 | unsafe_query.as_str() |
12+
| mysql.rs:30:33:30:53 | unsafe_query.as_str() |
13+
| mysql.rs:32:13:32:33 | unsafe_query.as_str() |
14+
| mysql.rs:36:33:36:53 | unsafe_query.as_str() |
15+
| mysql.rs:37:32:37:52 | unsafe_query.as_str() |
16+
| mysql.rs:39:13:39:33 | unsafe_query.as_str() |
17+
| mysql.rs:42:39:42:59 | unsafe_query.as_str() |
18+
| mysql.rs:45:30:45:52 | prepared_query.as_str() |
19+
| mysql.rs:46:45:46:66 | remote_string.as_str() |
20+
| mysql.rs:47:71:47:92 | remote_string.as_str() |
21+
| mysql.rs:48:46:48:67 | remote_string.as_str() |
22+
| mysql.rs:49:33:49:54 | remote_string.as_str() |
23+
| mysql.rs:50:46:50:67 | remote_string.as_str() |
24+
| mysql.rs:52:37:52:58 | remote_string.as_str() |
25+
| mysql.rs:56:14:56:35 | remote_string.as_str() |
26+
| mysql.rs:62:14:62:35 | remote_string.as_str() |
27+
| mysql.rs:66:40:66:61 | remote_string.as_str() |
28+
| mysql.rs:67:39:67:60 | remote_string.as_str() |
29+
| mysql.rs:70:14:70:35 | remote_string.as_str() |
30+
| mysql.rs:75:31:75:51 | unsafe_query.as_str() |
31+
| mysql.rs:80:26:80:46 | unsafe_query.as_str() |
32+
| mysql.rs:100:24:100:39 | ...::from(...) |
33+
| mysql.rs:101:26:101:85 | ...::from(...) |
34+
| mysql.rs:103:13:103:66 | ...::from(...) |
35+
| mysql.rs:104:30:104:83 | ...::from(...) |
36+
| mysql.rs:107:38:107:56 | safe_query.as_str() |
37+
| mysql.rs:110:38:110:58 | unsafe_query.as_str() |
38+
| mysql.rs:111:25:111:45 | unsafe_query.as_str() |
39+
| mysql.rs:112:47:112:67 | unsafe_query.as_str() |
40+
| mysql.rs:114:25:114:45 | unsafe_query.as_str() |
41+
| mysql.rs:116:33:116:53 | unsafe_query.as_str() |
42+
| mysql.rs:118:40:118:60 | unsafe_query.as_str() |
43+
| mysql.rs:121:24:121:44 | unsafe_query.as_str() |
44+
| mysql.rs:125:30:125:52 | prepared_query.as_str() |
45+
| mysql.rs:126:45:126:66 | remote_string.as_str() |
46+
| mysql.rs:128:38:128:59 | remote_string.as_str() |
47+
| mysql.rs:130:33:130:54 | remote_string.as_str() |
48+
| mysql.rs:131:54:131:75 | remote_string.as_str() |
49+
| mysql.rs:135:18:135:39 | remote_string.as_str() |
50+
| mysql.rs:140:40:140:61 | remote_string.as_str() |
51+
| mysql.rs:142:62:142:83 | remote_string.as_str() |
52+
| mysql.rs:145:31:145:52 | remote_string.as_str() |
53+
| mysql.rs:149:31:149:51 | unsafe_query.as_str() |
54+
| mysql.rs:154:26:154:46 | unsafe_query.as_str() |
255
| sqlx.rs:46:24:46:44 | ...::from(...) |
356
| sqlx.rs:47:56:47:76 | ...::from(...) |
457
| sqlx.rs:48:97:48:117 | ...::from(...) |
@@ -65,3 +118,14 @@ multipleCallTargets
65118
| sqlx.rs:188:29:188:51 | unsafe_query_1.as_str() |
66119
| sqlx.rs:189:29:189:53 | prepared_query_1.as_str() |
67120
| sqlx.rs:202:57:202:85 | ...::from(...) |
121+
multiplePathResolutions
122+
| mysql.rs:5:37:5:74 | Result::<...> |
123+
| mysql.rs:26:20:26:44 | Result::<...> |
124+
| mysql.rs:29:16:29:40 | Result::<...> |
125+
| mysql.rs:34:25:34:49 | Result::<...> |
126+
| mysql.rs:40:17:40:41 | Result::<...> |
127+
| mysql.rs:47:20:47:44 | Result::<...> |
128+
| mysql.rs:51:16:51:40 | Result::<...> |
129+
| mysql.rs:64:25:64:49 | Result::<...> |
130+
| mysql.rs:71:17:71:41 | Result::<...> |
131+
| mysql.rs:91:49:91:58 | Result::<...> |

0 commit comments

Comments
 (0)