From 044c75968264b1433527d8330bf8aef45c4f1e1e Mon Sep 17 00:00:00 2001
From: Max Schaefer <max-schaefer@github.com>
Date: Wed, 21 Jul 2021 11:28:53 +0100
Subject: [PATCH] Revert "JavaScript: Model chaining calls in sqlite3."

This reverts commit 8f91e9eba0d50cb0dc142f35a78b922629dca64c.
---
 .../change-notes/2021-05-10-sqlite3-chaining.md    |  3 ---
 .../ql/src/semmle/javascript/frameworks/SQL.qll    | 14 ++------------
 .../frameworks/SQL/SqlString.expected              |  1 -
 .../ql/test/library-tests/frameworks/SQL/sqlite.js |  3 +--
 4 files changed, 3 insertions(+), 18 deletions(-)
 delete mode 100644 javascript/change-notes/2021-05-10-sqlite3-chaining.md

diff --git a/javascript/change-notes/2021-05-10-sqlite3-chaining.md b/javascript/change-notes/2021-05-10-sqlite3-chaining.md
deleted file mode 100644
index 2b541440308..00000000000
--- a/javascript/change-notes/2021-05-10-sqlite3-chaining.md
+++ /dev/null
@@ -1,3 +0,0 @@
-lgtm,codescanning
-* Modelling of chaining methods in the `sqlite3` package has improved, which may lead to
-  additional results from the `js/sql-injection` query.
diff --git a/javascript/ql/src/semmle/javascript/frameworks/SQL.qll b/javascript/ql/src/semmle/javascript/frameworks/SQL.qll
index 4d345142eb4..ce702decc96 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/SQL.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/SQL.qll
@@ -341,28 +341,18 @@ private module Sqlite {
     result = sqlite().getMember("verbose").getReturn()
   }
 
-  /** Gets an expression that constructs or returns a Sqlite database instance. */
+  /** Gets an expression that constructs a Sqlite database instance. */
   API::Node database() {
     // new require('sqlite3').Database()
     result = sqlite().getMember("Database").getInstance()
     or
-    // chained call
-    result = getAChainingQueryCall()
-    or
     result = API::Node::ofType("sqlite3", "Database")
   }
 
-  /** A call to a query method on a Sqlite database instance that returns the same instance. */
-  private API::Node getAChainingQueryCall() {
-    result = database().getMember(["all", "each", "exec", "get", "run"]).getReturn()
-  }
-
   /** A call to a Sqlite query method. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
     QueryCall() {
-      this = getAChainingQueryCall().getAnImmediateUse()
-      or
-      this = database().getMember("prepare").getACall()
+      this = database().getMember(["all", "each", "exec", "get", "prepare", "run"]).getACall()
     }
 
     override DataFlow::Node getAQueryArgument() { result = getArgument(0) }
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected b/javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected
index cf9470ce355..81338e00140 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected
+++ b/javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected
@@ -66,6 +66,5 @@
 | spannerImport.js:4:8:4:17 | "SQL code" |
 | sqlite-types.ts:4:12:4:49 | "UPDATE ... id = ?" |
 | sqlite.js:7:8:7:45 | "UPDATE ... id = ?" |
-| sqlite.js:8:8:8:45 | "UPDATE ... id = ?" |
 | sqliteArray.js:6:12:6:49 | "UPDATE ... id = ?" |
 | sqliteImport.js:2:8:2:44 | "UPDATE ... id = ?" |
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/sqlite.js b/javascript/ql/test/library-tests/frameworks/SQL/sqlite.js
index da03517c839..e2f072902d0 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/sqlite.js
+++ b/javascript/ql/test/library-tests/frameworks/SQL/sqlite.js
@@ -4,7 +4,6 @@
 var sqlite = require('sqlite3');
 
 var db = new sqlite.Database(":memory:");
-db.run("UPDATE tbl SET name = ? WHERE id = ?", "bar", 2)
-  .run("UPDATE tbl SET name = ? WHERE id = ?", "foo", 3);
+db.run("UPDATE tbl SET name = ? WHERE id = ?", "bar", 2);
 
 exports.db = db;