hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Rust: Fix a couple more gaps.

Browse Source
This commit is contained in:
Geoffrey White
2025-08-11 19:22:24 +01:00
parent 0544ea8728
commit 398d2ac930
3 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
rust/ql/lib/codeql/rust/frameworks/postgres.model.yml
View File

@@ -13,6 +13,7 @@ extensions:
- ["<postgres::client::Client>::query_raw", "Argument[0]", "sql-injection", "manual"]
- ["<postgres::client::Client>::query_typed", "Argument[0]", "sql-injection", "manual"]
- ["<postgres::client::Client>::query_typed_raw", "Argument[0]", "sql-injection", "manual"]
- ["<postgres::client::Client>::simple_query", "Argument[0]", "sql-injection", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sourceModel

1
rust/ql/lib/codeql/rust/frameworks/tokio-postgres.model.yml
View File

@@ -9,6 +9,7 @@ extensions:
- ["<tokio_postgres::client::Client>::prepare", "Argument[0]", "sql-injection", "manual"]
- ["<tokio_postgres::client::Client>::prepare_typed", "Argument[0]", "sql-injection", "manual"]
- ["<tokio_postgres::client::Client>::query", "Argument[0]", "sql-injection", "manual"]
- ["<tokio_postgres::client::Client>::query_one", "Argument[0]", "sql-injection", "manual"]
- ["<tokio_postgres::client::Client>::query_opt", "Argument[0]", "sql-injection", "manual"]
- ["<tokio_postgres::client::Client>::query_raw", "Argument[0]", "sql-injection", "manual"]
- ["<tokio_postgres::client::Client>::query_typed", "Argument[0]", "sql-injection", "manual"]

2
rust/ql/test/library-tests/frameworks/postgres/main.rs
View File

@@ -41,7 +41,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
println!("found person: {} {} {}", id, name, age);
}
for message in &conn.simple_query("SELECT id, name, age FROM person")? { // $ MISSING: sql-sink
for message in &conn.simple_query("SELECT id, name, age FROM person")? { // $ sql-sink
if let postgres::SimpleQueryMessage::Row(row) = message {
let id: i32 = row.get(0).unwrap().parse().unwrap(); // $ database-read
let name: &str = row.get(1).unwrap(); // $ database-read