mirror of
https://github.com/github/codeql.git
synced 2026-04-26 01:05:15 +02:00
Add QLdocs for gqlgen.qll
This commit is contained in:
@@ -4,7 +4,8 @@ import go
|
||||
|
||||
/** Provides models of commonly used functions and types in the gqlgen packages. */
|
||||
module Gqlgen {
|
||||
class GqlgenGeneratedFile extends File {
|
||||
/** An autogenerated file containing gqlgen code. */
|
||||
private class GqlgenGeneratedFile extends File {
|
||||
GqlgenGeneratedFile() {
|
||||
exists(DataFlow::CallNode call |
|
||||
call.getReceiver().getType().hasQualifiedName("github.com/99designs/gqlgen/graphql", _) and
|
||||
@@ -13,22 +14,23 @@ module Gqlgen {
|
||||
}
|
||||
}
|
||||
|
||||
class ResolverInterface extends Type {
|
||||
/** A resolver interface. */
|
||||
private class ResolverInterface extends Type {
|
||||
ResolverInterface() {
|
||||
this.getQualifiedName().matches("%Resolver") and
|
||||
this.getEntity().getDeclaration().getFile() instanceof GqlgenGeneratedFile
|
||||
}
|
||||
}
|
||||
|
||||
class ResolverInterfaceMethod extends Method {
|
||||
ResolverInterfaceMethod() {
|
||||
this.getReceiver().getType() instanceof ResolverInterface
|
||||
}
|
||||
/** A resolver implementation. */
|
||||
private class ResolverInterfaceMethod extends Method {
|
||||
ResolverInterfaceMethod() { this.getReceiver().getType() instanceof ResolverInterface }
|
||||
}
|
||||
|
||||
class ResolverImplementationMethod extends Method {
|
||||
/** A resolver method which is exposed as a Graphql endpoint */
|
||||
private class ResolverImplementationMethod extends Method {
|
||||
ResolverImplementationMethod() { this.implements(any(ResolverInterfaceMethod r)) }
|
||||
|
||||
|
||||
Parameter getAnUntrustedParameter() {
|
||||
result.getFunction() = this.getFuncDecl() and
|
||||
not result.getType().hasQualifiedName("context", "Context") and
|
||||
@@ -36,6 +38,7 @@ module Gqlgen {
|
||||
}
|
||||
}
|
||||
|
||||
/** A parameter of a resolver method which receives untrusted input. */
|
||||
class ResolverParameter extends UntrustedFlowSource::Range instanceof DataFlow::ParameterNode {
|
||||
ResolverParameter() {
|
||||
this.asParameter() = any(ResolverImplementationMethod h).getAnUntrustedParameter()
|
||||
|
||||
Reference in New Issue
Block a user