hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Make NumericOrBooleanSanitizer easier to access and rename it

Browse Source
This commit is contained in:
Owen Mansel-Chan
2025-10-09 11:34:14 +01:00
parent 2918d30697
commit 0c9cd09140
2 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
go/ql/lib/semmle/go/security/Sanitizers.qll Normal file
View File

@@ -0,0 +1,16 @@
/**
* Classes to represent sanitizers commonly used in dataflow and taint tracking
* configurations.
*/
import go
/**
* A node whose type is a simple type unlikely to carry taint, such as a
* numeric or boolean type.
*/
class SimpleTypeSanitizer extends DataFlow::Node {
SimpleTypeSanitizer() {
this.getType() instanceof NumericType or this.getType() instanceof BoolType
}
}

10
go/ql/lib/semmle/go/security/SqlInjectionCustomizations.qll
View File

@@ -4,6 +4,7 @@
*/
import go
private import semmle.go.security.Sanitizers
/**
* Provides extension points for customizing the taint tracking configuration for reasoning about
@@ -39,12 +40,11 @@ module SqlInjection {
/** A NoSql query, considered as a taint sink for SQL injection. */
class NoSqlQueryAsSink extends Sink instanceof NoSql::Query { }
/** DEPRECATED: Use `SimpleTypeSanitizer` from semmle.go.security.Sanitizers instead. */
deprecated class NumericOrBooleanSanitizer = SimpleTypeSanitizer;
/**
* A numeric- or boolean-typed node, considered a sanitizer for sql injection.
*/
class NumericOrBooleanSanitizer extends Sanitizer {
NumericOrBooleanSanitizer() {
this.getType() instanceof NumericType or this.getType() instanceof BoolType
}
}
private class DefaultSanitizer extends Sanitizer instanceof SimpleTypeSanitizer { }
}