Use stubber for CWE-089 tests

ql/test/query-tests/Security/CWE-089/SqlInjection.expected

@@ -1,9 +1,9 @@
 edges
 | SqlInjection.go:11:3:11:9 | selection of URL : pointer type | SqlInjection.go:12:11:12:11 | q |
-| issue48.go:22:25:22:32 | selection of Body : ReadCloser | issue48.go:27:11:27:12 | q3 |
-| issue48.go:32:26:32:33 | selection of Body : ReadCloser | issue48.go:37:11:37:12 | q4 |
-| issue48.go:42:17:42:50 | type conversion : slice type | issue48.go:46:11:46:12 | q5 |
-| issue48.go:42:24:42:30 | selection of URL : pointer type | issue48.go:42:17:42:50 | type conversion : slice type |
+| issue48.go:17:25:17:32 | selection of Body : ReadCloser | issue48.go:22:11:22:12 | q3 |
+| issue48.go:27:26:27:33 | selection of Body : ReadCloser | issue48.go:32:11:32:12 | q4 |
+| issue48.go:37:17:37:50 | type conversion : slice type | issue48.go:41:11:41:12 | q5 |
+| issue48.go:37:24:37:30 | selection of URL : pointer type | issue48.go:37:17:37:50 | type conversion : slice type |
 | main.go:10:11:10:16 | selection of Form : Values | main.go:10:11:10:28 | index expression |
 | main.go:14:63:14:67 | selection of URL : pointer type | main.go:14:11:14:84 | call to Sprintf |
 | main.go:15:63:15:70 | selection of Header : Header | main.go:15:11:15:85 | call to Sprintf |
@@ -44,13 +44,13 @@ edges
 nodes
 | SqlInjection.go:11:3:11:9 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
 | SqlInjection.go:12:11:12:11 | q | semmle.label | q |
-| issue48.go:22:25:22:32 | selection of Body : ReadCloser | semmle.label | selection of Body : ReadCloser |
-| issue48.go:27:11:27:12 | q3 | semmle.label | q3 |
-| issue48.go:32:26:32:33 | selection of Body : ReadCloser | semmle.label | selection of Body : ReadCloser |
-| issue48.go:37:11:37:12 | q4 | semmle.label | q4 |
-| issue48.go:42:17:42:50 | type conversion : slice type | semmle.label | type conversion : slice type |
-| issue48.go:42:24:42:30 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
-| issue48.go:46:11:46:12 | q5 | semmle.label | q5 |
+| issue48.go:17:25:17:32 | selection of Body : ReadCloser | semmle.label | selection of Body : ReadCloser |
+| issue48.go:22:11:22:12 | q3 | semmle.label | q3 |
+| issue48.go:27:26:27:33 | selection of Body : ReadCloser | semmle.label | selection of Body : ReadCloser |
+| issue48.go:32:11:32:12 | q4 | semmle.label | q4 |
+| issue48.go:37:17:37:50 | type conversion : slice type | semmle.label | type conversion : slice type |
+| issue48.go:37:24:37:30 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
+| issue48.go:41:11:41:12 | q5 | semmle.label | q5 |
 | main.go:10:11:10:16 | selection of Form : Values | semmle.label | selection of Form : Values |
 | main.go:10:11:10:28 | index expression | semmle.label | index expression |
 | main.go:14:11:14:84 | call to Sprintf | semmle.label | call to Sprintf |
@@ -94,9 +94,9 @@ nodes
 | main.go:61:11:61:11 | q | semmle.label | q |
 #select
 | SqlInjection.go:12:11:12:11 | q | SqlInjection.go:11:3:11:9 | selection of URL : pointer type | SqlInjection.go:12:11:12:11 | q | This query depends on $@. | SqlInjection.go:11:3:11:9 | selection of URL | a user-provided value |
-| issue48.go:27:11:27:12 | q3 | issue48.go:22:25:22:32 | selection of Body : ReadCloser | issue48.go:27:11:27:12 | q3 | This query depends on $@. | issue48.go:22:25:22:32 | selection of Body | a user-provided value |
-| issue48.go:37:11:37:12 | q4 | issue48.go:32:26:32:33 | selection of Body : ReadCloser | issue48.go:37:11:37:12 | q4 | This query depends on $@. | issue48.go:32:26:32:33 | selection of Body | a user-provided value |
-| issue48.go:46:11:46:12 | q5 | issue48.go:42:24:42:30 | selection of URL : pointer type | issue48.go:46:11:46:12 | q5 | This query depends on $@. | issue48.go:42:24:42:30 | selection of URL | a user-provided value |
+| issue48.go:22:11:22:12 | q3 | issue48.go:17:25:17:32 | selection of Body : ReadCloser | issue48.go:22:11:22:12 | q3 | This query depends on $@. | issue48.go:17:25:17:32 | selection of Body | a user-provided value |
+| issue48.go:32:11:32:12 | q4 | issue48.go:27:26:27:33 | selection of Body : ReadCloser | issue48.go:32:11:32:12 | q4 | This query depends on $@. | issue48.go:27:26:27:33 | selection of Body | a user-provided value |
+| issue48.go:41:11:41:12 | q5 | issue48.go:37:24:37:30 | selection of URL : pointer type | issue48.go:41:11:41:12 | q5 | This query depends on $@. | issue48.go:37:24:37:30 | selection of URL | a user-provided value |
 | main.go:10:11:10:28 | index expression | main.go:10:11:10:16 | selection of Form : Values | main.go:10:11:10:28 | index expression | This query depends on $@. | main.go:10:11:10:16 | selection of Form | a user-provided value |
 | main.go:14:11:14:84 | call to Sprintf | main.go:14:63:14:67 | selection of URL : pointer type | main.go:14:11:14:84 | call to Sprintf | This query depends on $@. | main.go:14:63:14:67 | selection of URL | a user-provided value |
 | main.go:15:11:15:85 | call to Sprintf | main.go:15:63:15:70 | selection of Header : Header | main.go:15:11:15:85 | call to Sprintf | This query depends on $@. | main.go:15:63:15:70 | selection of Header | a user-provided value |

ql/test/query-tests/Security/CWE-089/go.mod

@@ -1,5 +1,11 @@
 module Security.CWE-089
 
-go 1.13
+go 1.14
 
-require github.com/Masterminds/squirrel v1.1.0
+require (
+	github.com/Masterminds/squirrel v1.1.0
+	github.com/github/depstubber v0.0.0-20200414023404-c355b630c381 // indirect
+	github.com/go-sql-driver/mysql v1.5.0 // indirect
+	github.com/lib/pq v1.3.0 // indirect
+	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
+)

ql/test/query-tests/Security/CWE-089/issue48.go

@@ -10,12 +10,7 @@ import (
 	"net/http"
 )
 
-type RequestStruct struct {
-	Id       int64    `db:"id"`
-	Category []string `db:"category"`
-}
-
-func handler(db *sql.DB, req *http.Request) {
+func handler1(db *sql.DB, req *http.Request) {
 	// read data from request body and unmarshal to a indeterminacy struct
 	// POST: {"a": "b", "category": "test"}
 	var RequestDataFromJson map[string]interface{}

ql/test/query-tests/Security/CWE-089/tst.go

@@ -1,5 +1,7 @@
 package main
 
+//go:generate depstubber -vendor github.com/Masterminds/squirrel "" Expr,StatementBuilder
+
 import (
 	"encoding/json"
 	"fmt"

ql/test/query-tests/Security/CWE-089/vendor/github.com/Masterminds/squirrel/LICENSE

@@ -1,23 +0,0 @@
-Squirrel
-The Masterminds
-Copyright (C) 2014-2015, Lann Martin
-Copyright (C) 2015-2016, Google
-Copyright (C) 2015, Matt Farina and Matt Butcher
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

ql/test/query-tests/Security/CWE-089/vendor/github.com/Masterminds/squirrel/README.md

@@ -1,3 +0,0 @@
-This is a simple stub for https://github.com/Masterminds/squirrel, strictly for use in query testing.
-
-See the LICENSE file in this folder for information about the licensing of the original library.

ql/test/query-tests/Security/CWE-089/vendor/github.com/Masterminds/squirrel/go.mod

@@ -1 +0,0 @@
-module github.com/Masterminds/squirrel

ql/test/query-tests/Security/CWE-089/vendor/github.com/Masterminds/squirrel/squirrel.go

@@ -1,24 +0,0 @@
-package squirrel
-
-type StatementBuilderType struct{}
-
-func Expr(e string, args ...interface{}) string {
-	return Expr(e, args...)
-}
-
-var StatementBuilder = &StatementBuilderType{}
-
-func (b *StatementBuilderType) Insert(table string) *StatementBuilderType {
-	return b
-}
-
-func (b *StatementBuilderType) Columns(columns ...string) *StatementBuilderType {
-	return b
-}
-
-func (b *StatementBuilderType) Values(strings ...string) *StatementBuilderType {
-	return b
-}
-
-func (b *StatementBuilderType) Exec() {
-}

ql/test/query-tests/Security/CWE-089/vendor/github.com/Masterminds/squirrel/stub.go

@@ -0,0 +1,455 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for github.com/Masterminds/squirrel, strictly for use in testing.
+
+// Source: github.com/Masterminds/squirrel (exports: ; functions: Expr,StatementBuilder)
+
+// Package squirrel is a stub of github.com/Masterminds/squirrel, generated by depstubber.
+package squirrel
+
+import (
+	context "context"
+	sql "database/sql"
+)
+
+type BaseRunner interface {
+	Exec(_ string, _ ...interface{}) (sql.Result, interface {
+		Error() string
+	})
+	Query(_ string, _ ...interface{}) (*sql.Rows, interface {
+		Error() string
+	})
+}
+
+type DeleteBuilder struct{}
+
+func (_ DeleteBuilder) Exec() (sql.Result, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ DeleteBuilder) ExecContext(_ context.Context) (sql.Result, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ DeleteBuilder) From(_ string) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func (_ DeleteBuilder) Limit(_ uint64) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func (_ DeleteBuilder) Offset(_ uint64) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func (_ DeleteBuilder) OrderBy(_ ...string) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func (_ DeleteBuilder) PlaceholderFormat(_ PlaceholderFormat) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func (_ DeleteBuilder) Prefix(_ string, _ ...interface{}) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func (_ DeleteBuilder) Query() (*sql.Rows, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ DeleteBuilder) RunWith(_ BaseRunner) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func (_ DeleteBuilder) Suffix(_ string, _ ...interface{}) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func (_ DeleteBuilder) ToSql() (string, []interface{}, interface {
+	Error() string
+}) {
+	return "", nil, nil
+}
+
+func (_ DeleteBuilder) Where(_ interface{}, _ ...interface{}) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func Expr(_ string, _ ...interface{}) interface{} {
+	return nil
+}
+
+type InsertBuilder struct{}
+
+func (_ InsertBuilder) Columns(_ ...string) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ InsertBuilder) Exec() (sql.Result, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ InsertBuilder) ExecContext(_ context.Context) (sql.Result, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ InsertBuilder) Into(_ string) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ InsertBuilder) Options(_ ...string) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ InsertBuilder) PlaceholderFormat(_ PlaceholderFormat) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ InsertBuilder) Prefix(_ string, _ ...interface{}) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ InsertBuilder) Query() (*sql.Rows, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ InsertBuilder) QueryContext(_ context.Context) (*sql.Rows, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ InsertBuilder) QueryRow() RowScanner {
+	return nil
+}
+
+func (_ InsertBuilder) QueryRowContext(_ context.Context) RowScanner {
+	return nil
+}
+
+func (_ InsertBuilder) RunWith(_ BaseRunner) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ InsertBuilder) Scan(_ ...interface{}) interface {
+	Error() string
+} {
+	return nil
+}
+
+func (_ InsertBuilder) ScanContext(_ context.Context, _ ...interface{}) interface {
+	Error() string
+} {
+	return nil
+}
+
+func (_ InsertBuilder) Select(_ SelectBuilder) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ InsertBuilder) SetMap(_ map[string]interface{}) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ InsertBuilder) Suffix(_ string, _ ...interface{}) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ InsertBuilder) ToSql() (string, []interface{}, interface {
+	Error() string
+}) {
+	return "", nil, nil
+}
+
+func (_ InsertBuilder) Values(_ ...interface{}) InsertBuilder {
+	return InsertBuilder{}
+}
+
+type PlaceholderFormat interface {
+	ReplacePlaceholders(_ string) (string, interface {
+		Error() string
+	})
+}
+
+type RowScanner interface {
+	Scan(_ ...interface{}) interface {
+		Error() string
+	}
+}
+
+type SelectBuilder struct{}
+
+func (_ SelectBuilder) Column(_ interface{}, _ ...interface{}) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Columns(_ ...string) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Distinct() SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Exec() (sql.Result, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ SelectBuilder) ExecContext(_ context.Context) (sql.Result, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ SelectBuilder) From(_ string) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) FromSelect(_ SelectBuilder, _ string) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) GroupBy(_ ...string) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Having(_ interface{}, _ ...interface{}) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Join(_ string, _ ...interface{}) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) JoinClause(_ interface{}, _ ...interface{}) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) LeftJoin(_ string, _ ...interface{}) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Limit(_ uint64) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) MustSql() (string, []interface{}) {
+	return "", nil
+}
+
+func (_ SelectBuilder) Offset(_ uint64) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Options(_ ...string) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) OrderBy(_ ...string) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) PlaceholderFormat(_ PlaceholderFormat) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Prefix(_ string, _ ...interface{}) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Query() (*sql.Rows, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ SelectBuilder) QueryContext(_ context.Context) (*sql.Rows, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ SelectBuilder) QueryRow() RowScanner {
+	return nil
+}
+
+func (_ SelectBuilder) QueryRowContext(_ context.Context) RowScanner {
+	return nil
+}
+
+func (_ SelectBuilder) RemoveLimit() SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) RightJoin(_ string, _ ...interface{}) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) RunWith(_ BaseRunner) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) Scan(_ ...interface{}) interface {
+	Error() string
+} {
+	return nil
+}
+
+func (_ SelectBuilder) ScanContext(_ context.Context, _ ...interface{}) interface {
+	Error() string
+} {
+	return nil
+}
+
+func (_ SelectBuilder) Suffix(_ string, _ ...interface{}) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ SelectBuilder) ToSql() (string, []interface{}, interface {
+	Error() string
+}) {
+	return "", nil, nil
+}
+
+func (_ SelectBuilder) Where(_ interface{}, _ ...interface{}) SelectBuilder {
+	return SelectBuilder{}
+}
+
+var StatementBuilder StatementBuilderType = StatementBuilderType{}
+
+type StatementBuilderType struct{}
+
+func (_ StatementBuilderType) Delete(_ string) DeleteBuilder {
+	return DeleteBuilder{}
+}
+
+func (_ StatementBuilderType) Insert(_ string) InsertBuilder {
+	return InsertBuilder{}
+}
+
+func (_ StatementBuilderType) PlaceholderFormat(_ PlaceholderFormat) StatementBuilderType {
+	return StatementBuilderType{}
+}
+
+func (_ StatementBuilderType) RunWith(_ BaseRunner) StatementBuilderType {
+	return StatementBuilderType{}
+}
+
+func (_ StatementBuilderType) Select(_ ...string) SelectBuilder {
+	return SelectBuilder{}
+}
+
+func (_ StatementBuilderType) Update(_ string) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+type UpdateBuilder struct{}
+
+func (_ UpdateBuilder) Exec() (sql.Result, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ UpdateBuilder) ExecContext(_ context.Context) (sql.Result, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ UpdateBuilder) Limit(_ uint64) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) Offset(_ uint64) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) OrderBy(_ ...string) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) PlaceholderFormat(_ PlaceholderFormat) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) Prefix(_ string, _ ...interface{}) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) Query() (*sql.Rows, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ UpdateBuilder) QueryContext(_ context.Context) (*sql.Rows, interface {
+	Error() string
+}) {
+	return nil, nil
+}
+
+func (_ UpdateBuilder) QueryRow() RowScanner {
+	return nil
+}
+
+func (_ UpdateBuilder) QueryRowContext(_ context.Context) RowScanner {
+	return nil
+}
+
+func (_ UpdateBuilder) RunWith(_ BaseRunner) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) Scan(_ ...interface{}) interface {
+	Error() string
+} {
+	return nil
+}
+
+func (_ UpdateBuilder) ScanContext(_ context.Context, _ ...interface{}) interface {
+	Error() string
+} {
+	return nil
+}
+
+func (_ UpdateBuilder) Set(_ string, _ interface{}) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) SetMap(_ map[string]interface{}) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) Suffix(_ string, _ ...interface{}) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) Table(_ string) UpdateBuilder {
+	return UpdateBuilder{}
+}
+
+func (_ UpdateBuilder) ToSql() (string, []interface{}, interface {
+	Error() string
+}) {
+	return "", nil, nil
+}
+
+func (_ UpdateBuilder) Where(_ interface{}, _ ...interface{}) UpdateBuilder {
+	return UpdateBuilder{}
+}

ql/test/query-tests/Security/CWE-089/vendor/modules.txt

@@ -1,2 +1,15 @@
 # github.com/Masterminds/squirrel v1.1.0
+## explicit
 github.com/Masterminds/squirrel
+# github.com/github/depstubber v0.0.0-20200414023404-c355b630c381
+## explicit
+github.com/github/depstubber
+# github.com/go-sql-driver/mysql v1.5.0
+## explicit
+github.com/go-sql-driver/mysql
+# github.com/lib/pq v1.3.0
+## explicit
+github.com/lib/pq
+# github.com/mattn/go-sqlite3 v2.0.3+incompatible
+## explicit
+github.com/mattn/go-sqlite3