Add Log Injection query

change-notes/2021-11-19-log-injection-query.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* A new query "Log entries created from user input" (`go/log-injection`) has been added. The query reports user-provided data reaching calls to logging methods.

ql/lib/semmle/go/frameworks/Glog.qll

@@ -14,7 +14,7 @@ module Glog {
     GlogCall() {
       exists(string pkg, Function f, string fn |
         pkg = package(["github.com/golang/glog", "gopkg.in/glog", "k8s.io/klog"], "") and
-        fn.regexpMatch("(Error|Exit|Fatal|Info|Warning)(|f|ln)") and
+        fn.regexpMatch("(Error|Exit|Fatal|Info|Warning)(|f|ln|Depth)") and
         this = f.getACall()
       |
         f.hasQualifiedName(pkg, fn)

ql/lib/semmle/go/frameworks/Logrus.qll

@@ -11,7 +11,7 @@ module Logrus {
 
   bindingset[result]
   private string getALogResultName() {
-    result.matches(["Debug%", "Error%", "Fatal%", "Info%", "Panic%", "Print%", "Trace%", "Warn%"])
+    result.matches(["Debug%", "Error%", "Fatal%", "Info%", "Log%", "Panic%", "Print%", "Trace%", "Warn%"])
   }
 
   bindingset[result]
@@ -23,7 +23,7 @@ module Logrus {
     LogCall() {
       exists(string name | name = getALogResultName() or name = getAnEntryUpdatingMethodName() |
         this.getTarget().hasQualifiedName(packagePath(), name) or
-        this.getTarget().(Method).hasQualifiedName(packagePath(), "Entry", name)
+        this.getTarget().(Method).hasQualifiedName(packagePath(), ["Entry", "Logger"], name)
       )
     }
 

ql/lib/semmle/go/frameworks/stdlib/Log.qll

@@ -8,13 +8,7 @@ import go
 module Log {
   private class LogCall extends LoggerCall::Range, DataFlow::CallNode {
     LogCall() {
-      exists(string fn |
-        fn.matches("Fatal%")
-        or
-        fn.matches("Panic%")
-        or
-        fn.matches("Print%")
-      |
+      exists(string fn | fn.matches(["Fatal%", "Panic%", "Print%"]) |
         this.getTarget().hasQualifiedName("log", fn)
         or
         this.getTarget().(Method).hasQualifiedName("log", "Logger", fn)

ql/lib/semmle/go/security/LogInjection.qll

@@ -0,0 +1,33 @@
+/**
+ * Provides a taint tracking configuration for reasoning about log injection vulnerabilities.
+ *
+ * Note: for performance reasons, only import this file if `LogInjection::Configuration` is needed,
+ * otherwise `LogInjectionCustomizations` should be imported instead.
+ */
+
+import go
+
+/**
+ * Provides a taint-tracking configuration for reasoning about
+ * log injection vulnerabilities.
+ */
+module LogInjection {
+  import LogInjectionCustomizations::LogInjection
+
+  /**
+   * A taint-tracking configuration for reasoning about log injection vulnerabilities.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "LogInjection" }
+
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    override predicate isSanitizer(DataFlow::Node sanitizer) { sanitizer instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
+  }
+}

ql/lib/semmle/go/security/LogInjectionCustomizations.qll

@@ -0,0 +1,42 @@
+/**
+ * Provides default sources, sinks, and sanitizers for reasoning about
+ * log injection vulnerabilities, as well as extension points for adding your own.
+ */
+
+import go
+
+/**
+ * Provides extension points for customizing the data-flow tracking configuration for reasoning
+ * about log injection.
+ */
+module LogInjection {
+  /**
+   * A data flow source for log injection vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for log injection vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for log injection vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for log injection vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /** A source of untrusted data, considered as a taint source for log injection. */
+  class UntrustedFlowAsSource extends Source {
+    UntrustedFlowAsSource() { this instanceof UntrustedFlowSource }
+  }
+
+  /** An argument to a logging mechanism. */
+  class LoggerSink extends Sink {
+    LoggerSink() { this = any(LoggerCall log).getAMessageComponent() }
+  }
+}

ql/src/Security/CWE-117/LogInjection.go

@@ -0,0 +1,12 @@
+package main
+
+import (
+	"log"
+	"net/http"
+)
+
+// BAD: A user-provided value is written directly to a log.
+func handler(req *http.Request) {
+	username := req.URL.Query()["username"][0]
+	log.Printf("user %s logged in.\n", username)
+}

ql/src/Security/CWE-117/LogInjection.qhelp

@@ -0,0 +1,46 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>If unsanitized user input is written to a log entry, a malicious user may
+be able to forge new log entries.</p>
+
+<p>Forgery can occur if a user provides some input with characters that are interpreted
+when the log output is displayed. If the log is displayed as a plain text file, then new
+line characters can be used by a malicious user. If the log is displayed as HTML, then
+arbitrary HTML may be include to spoof log entries.</p>
+</overview>
+
+<recommendation>
+<p>
+User input should be suitably encoded before it is logged.
+</p>
+<p>
+If the log entries are plain text then line breaks should be removed from user input, using
+<code>strings.Replace</code> or similar. Care should also be taken that user input is clearly marked
+in log entries, and that a malicious user cannot cause confusion in other ways.
+</p>
+<p>
+For log entries that will be displayed in HTML, user input should be HTML encoded using
+<code>html.EscapeString</code> or similar before being logged, to prevent forgery and
+other forms of HTML injection.
+</p>
+
+</recommendation>
+
+<example>
+<p>
+In the following example, a user name, provided by the user, is logged using a logging framework without any sanitization.
+</p>
+<sample src="LogInjection.go" />
+<p>
+In the next example, <code>strings.Replace</code> is used to ensure no line endings are present in the user input.
+</p>
+<sample src="LogInjectionGood.go" />
+</example>
+
+<references>
+<li>OWASP: <a href="https://www.owasp.org/index.php/Log_Injection">Log Injection</a>.</li>
+</references>
+</qhelp>

ql/src/Security/CWE-117/LogInjection.ql

@@ -0,0 +1,21 @@
+/**
+ * @name Log entries created from user input
+ * @description Building log entries from user-controlled sources is vulnerable to
+ *              insertion of forged log entries by a malicious user.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id go/log-injection
+ * @tags security
+ *       external/cwe/cwe-117
+ */
+
+import go
+import semmle.go.security.LogInjection
+import DataFlow::PathGraph
+
+from LogInjection::Configuration c, DataFlow::PathNode source, DataFlow::PathNode sink
+where c.hasFlowPath(source, sink)
+select sink, source, sink, "This log write receives unsanitized user input from $@.",
+  source.getNode(), "here"

ql/src/Security/CWE-117/LogInjectionGood.go

@@ -0,0 +1,15 @@
+package main
+
+import (
+	"log"
+	"net/http"
+	"strings"
+)
+
+// GOOD: The user-provided value is escaped before being written to the log.
+func handlerGood(req *http.Request) {
+	username := req.URL.Query()["username"][0]
+	escapedUsername := strings.Replace(username, "\n", "", -1)
+	escapedUsername = strings.Replace(escapedUsername, "\r", "", -1)
+	log.Printf("user %s logged in.\n", escapedUsername)
+}

ql/test/query-tests/Security/CWE-117/LogInjection.go

@@ -0,0 +1,366 @@
+package main
+
+//go:generate depstubber -vendor k8s.io/klog Verbose Info,Infof,Infoln,Error,Errorf,Errorln,Fatal,Fatalf,Fatalln,Exit,Exitf,Exitln
+//go:generate depstubber -vendor github.com/astaxie/beego "" Alert,Critical,Debug,Emergency,Error,Info,Informational,Notice,Trace,Warn,Warning
+//go:generate depstubber -vendor github.com/astaxie/beego/logs "" NewLogger,Alert,Critical,Debug,Emergency,Error,Info,Informational,Notice,Trace,Warn,Warning
+//go:generate depstubber -vendor github.com/astaxie/beego/utils "" Display
+//go:generate depstubber -vendor github.com/davecgh/go-spew/spew "" Dump,Errorf,Print,Printf,Println,Fdump,Fprint,Fprintf,Fprintln
+//go:generate depstubber -vendor github.com/elazarl/goproxy ProxyCtx ""
+//go:generate depstubber -vendor github.com/golang/glog Level,Verbose Info,InfoDepth,Infof,Infoln,Error,ErrorDepth,Errorf,Errorln,Fatal,FatalDepth,Fatalf,Fatalln,Exit,ExitDepth,Exitf,Exitln,V
+//go:generate depstubber -vendor github.com/sirupsen/logrus Fields,Entry,Logger,Level Debug,Debugf,Debugln,Error,Errorf,Errorln,Fatal,Fatalf,Fatalln,Info,Infof,Infoln,Panic,Panicf,Panicln,Print,Printf,Println,Trace,Tracef,Traceln,Warn,Warnf,Warnln,Warning,Warningf,Warningln,WithFields,WithField
+//go:generate depstubber -vendor go.uber.org/zap Logger,SugaredLogger NewProduction
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+
+	"github.com/astaxie/beego"
+	"github.com/astaxie/beego/logs"
+	"github.com/astaxie/beego/utils"
+	"github.com/davecgh/go-spew/spew"
+	"github.com/elazarl/goproxy"
+	"github.com/golang/glog"
+	"github.com/sirupsen/logrus"
+	"go.uber.org/zap"
+	"k8s.io/klog"
+)
+
+func handler(req *http.Request, ctx *goproxy.ProxyCtx) {
+	username := req.URL.Query()["username"][0]
+	testFlag := req.URL.Query()["testFlag"][0]
+
+	{
+		fmt.Print(username)         // $ hasTaintFlow="username"
+		fmt.Printf(username)        // $ hasTaintFlow="username"
+		fmt.Println(username)       // $ hasTaintFlow="username"
+		fmt.Fprint(nil, username)   // $ hasTaintFlow="username"
+		fmt.Fprintf(nil, username)  // $ hasTaintFlow="username"
+		fmt.Fprintln(nil, username) // $ hasTaintFlow="username"
+	}
+	// log
+	{
+		log.Print("user %s logged in.\n", username)   // $ hasTaintFlow="username"
+		log.Printf("user %s logged in.\n", username)  // $ hasTaintFlow="username"
+		log.Println("user %s logged in.\n", username) // $ hasTaintFlow="username"
+
+		if testFlag == "true" {
+			log.Fatal("user %s logged in.\n", username) // $ hasTaintFlow="username"
+		}
+		if testFlag == "true" {
+			log.Fatalf("user %s logged in.\n", username) // $ hasTaintFlow="username"
+		}
+		if testFlag == "true" {
+			log.Fatalln("user %s logged in.\n", username) // $ hasTaintFlow="username"
+		}
+		if testFlag == "true" {
+			log.Panic("user %s logged in.\n", username) // $ hasTaintFlow="username"
+		}
+		if testFlag == "true" {
+			log.Panicf("user %s logged in.\n", username) // $ hasTaintFlow="username"
+		}
+		if testFlag == "true" {
+			log.Panicln("user %s logged in.\n", username) // $ hasTaintFlow="username"
+		}
+
+		logger := log.Default()
+		logger.Print("user %s logged in.\n", username)   // $ hasTaintFlow="username"
+		logger.Printf("user %s logged in.\n", username)  // $ hasTaintFlow="username"
+		logger.Println("user %s logged in.\n", username) // $ hasTaintFlow="username"
+		logger.Fatal("user %s logged in.\n", username)   // $ hasTaintFlow="username"
+		logger.Fatalf("user %s logged in.\n", username)  // $ hasTaintFlow="username"
+		logger.Fatalln("user %s logged in.\n", username) // $ hasTaintFlow="username"
+		logger.Panic("user %s logged in.\n", username)   // $ hasTaintFlow="username"
+		logger.Panicf("user %s logged in.\n", username)  // $ hasTaintFlow="username"
+		logger.Panicln("user %s logged in.\n", username) // $ hasTaintFlow="username"
+	}
+	// k8s.io/klog
+	{
+		verbose := klog.V(0)
+		verbose.Info(username)    // $ hasTaintFlow="username"
+		verbose.Infof(username)   // $ hasTaintFlow="username"
+		verbose.Infoln(username)  // $ hasTaintFlow="username"
+		klog.Info(username)       // $ hasTaintFlow="username"
+		klog.InfoDepth(username)  // $ hasTaintFlow="username"
+		klog.Infof(username)      // $ hasTaintFlow="username"
+		klog.Infoln(username)     // $ hasTaintFlow="username"
+		klog.Error(username)      // $ hasTaintFlow="username"
+		klog.ErrorDepth(username) // $ hasTaintFlow="username"
+		klog.Errorf(username)     // $ hasTaintFlow="username"
+		klog.Errorln(username)    // $ hasTaintFlow="username"
+		klog.Fatal(username)      // $ hasTaintFlow="username"
+		klog.FatalDepth(username) // $ hasTaintFlow="username"
+		klog.Fatalf(username)     // $ hasTaintFlow="username"
+		klog.Fatalln(username)    // $ hasTaintFlow="username"
+		klog.Exit(username)       // $ hasTaintFlow="username"
+		klog.ExitDepth(username)  // $ hasTaintFlow="username"
+		klog.Exitf(username)      // $ hasTaintFlow="username"
+		klog.Exitln(username)     // $ hasTaintFlow="username"
+	}
+	// astaxie/beego
+	{
+		beego.Alert(username)         // $ hasTaintFlow="username"
+		beego.Critical(username)      // $ hasTaintFlow="username"
+		beego.Debug(username)         // $ hasTaintFlow="username"
+		beego.Emergency(username)     // $ hasTaintFlow="username"
+		beego.Error(username)         // $ hasTaintFlow="username"
+		beego.Info(username)          // $ hasTaintFlow="username"
+		beego.Informational(username) // $ hasTaintFlow="username"
+		beego.Notice(username)        // $ hasTaintFlow="username"
+		beego.Trace(username)         // $ hasTaintFlow="username"
+		beego.Warn(username)          // $ hasTaintFlow="username"
+		beego.Warning(username)       // $ hasTaintFlow="username"
+
+		logs.Alert(username)         // $ hasTaintFlow="username"
+		logs.Critical(username)      // $ hasTaintFlow="username"
+		logs.Debug(username)         // $ hasTaintFlow="username"
+		logs.Emergency(username)     // $ hasTaintFlow="username"
+		logs.Error(username)         // $ hasTaintFlow="username"
+		logs.Info(username)          // $ hasTaintFlow="username"
+		logs.Informational(username) // $ hasTaintFlow="username"
+		logs.Notice(username)        // $ hasTaintFlow="username"
+		logs.Trace(username)         // $ hasTaintFlow="username"
+		logs.Warn(username)          // $ hasTaintFlow="username"
+		logs.Warning(username)       // $ hasTaintFlow="username"
+
+		log := logs.NewLogger(10000)
+		log.Alert(username)         // $ hasTaintFlow="username"
+		log.Critical(username)      // $ hasTaintFlow="username"
+		log.Debug(username)         // $ hasTaintFlow="username"
+		log.Emergency(username)     // $ hasTaintFlow="username"
+		log.Error(username)         // $ hasTaintFlow="username"
+		log.Info(username)          // $ hasTaintFlow="username"
+		log.Informational(username) // $ hasTaintFlow="username"
+		log.Notice(username)        // $ hasTaintFlow="username"
+		log.Trace(username)         // $ hasTaintFlow="username"
+		log.Warn(username)          // $ hasTaintFlow="username"
+		log.Warning(username)       // $ hasTaintFlow="username"
+
+		utils.Display(username) // $ hasTaintFlow="username"
+	}
+	// elazarl/goproxy
+	{
+		ctx.Logf(username)        // $ hasTaintFlow="username"
+		ctx.Logf("%s", username)  // $ hasTaintFlow="username"
+		ctx.Warnf(username)       // $ hasTaintFlow="username"
+		ctx.Warnf("%s", username) // $ hasTaintFlow="username"
+	}
+	// golang/glog
+	{
+		verbose := glog.V(0)
+		verbose.Info(username)   // $ hasTaintFlow="username"
+		verbose.Infof(username)  // $ hasTaintFlow="username"
+		verbose.Infoln(username) // $ hasTaintFlow="username"
+
+		glog.Info(username)       // $ hasTaintFlow="username"
+		glog.InfoDepth(username)  // $ hasTaintFlow="username"
+		glog.Infof(username)      // $ hasTaintFlow="username"
+		glog.Infoln(username)     // $ hasTaintFlow="username"
+		glog.Error(username)      // $ hasTaintFlow="username"
+		glog.ErrorDepth(username) // $ hasTaintFlow="username"
+		glog.Errorf(username)     // $ hasTaintFlow="username"
+		glog.Errorln(username)    // $ hasTaintFlow="username"
+		glog.Fatal(username)      // $ hasTaintFlow="username"
+		glog.FatalDepth(username) // $ hasTaintFlow="username"
+		glog.Fatalf(username)     // $ hasTaintFlow="username"
+		glog.Fatalln(username)    // $ hasTaintFlow="username"
+		glog.Exit(username)       // $ hasTaintFlow="username"
+		glog.ExitDepth(username)  // $ hasTaintFlow="username"
+		glog.Exitf(username)      // $ hasTaintFlow="username"
+		glog.Exitln(username)     // $ hasTaintFlow="username"
+
+	}
+	// sirupsen/logrus
+	{
+		logrus.Debug(username)        // $ hasTaintFlow="username"
+		logrus.Debugf(username, "")   // $ hasTaintFlow="username"
+		logrus.Debugf("", username)   // $ hasTaintFlow="username"
+		logrus.Debugln(username)      // $ hasTaintFlow="username"
+		logrus.Error(username)        // $ hasTaintFlow="username"
+		logrus.Errorf(username, "")   // $ hasTaintFlow="username"
+		logrus.Errorf("", username)   // $ hasTaintFlow="username"
+		logrus.Errorln(username)      // $ hasTaintFlow="username"
+		logrus.Fatal(username)        // $ hasTaintFlow="username"
+		logrus.Fatalf(username, "")   // $ hasTaintFlow="username"
+		logrus.Fatalf("", username)   // $ hasTaintFlow="username"
+		logrus.Fatalln(username)      // $ hasTaintFlow="username"
+		logrus.Info(username)         // $ hasTaintFlow="username"
+		logrus.Infof(username, "")    // $ hasTaintFlow="username"
+		logrus.Infof("", username)    // $ hasTaintFlow="username"
+		logrus.Infoln(username)       // $ hasTaintFlow="username"
+		logrus.Panic(username)        // $ hasTaintFlow="username"
+		logrus.Panicf(username, "")   // $ hasTaintFlow="username"
+		logrus.Panicf("", username)   // $ hasTaintFlow="username"
+		logrus.Panicln(username)      // $ hasTaintFlow="username"
+		logrus.Print(username)        // $ hasTaintFlow="username"
+		logrus.Printf(username, "")   // $ hasTaintFlow="username"
+		logrus.Printf("", username)   // $ hasTaintFlow="username"
+		logrus.Println(username)      // $ hasTaintFlow="username"
+		logrus.Trace(username)        // $ hasTaintFlow="username"
+		logrus.Tracef(username, "")   // $ hasTaintFlow="username"
+		logrus.Tracef("", username)   // $ hasTaintFlow="username"
+		logrus.Traceln(username)      // $ hasTaintFlow="username"
+		logrus.Warn(username)         // $ hasTaintFlow="username"
+		logrus.Warnf(username, "")    // $ hasTaintFlow="username"
+		logrus.Warnf("", username)    // $ hasTaintFlow="username"
+		logrus.Warnln(username)       // $ hasTaintFlow="username"
+		logrus.Warning(username)      // $ hasTaintFlow="username"
+		logrus.Warningf(username, "") // $ hasTaintFlow="username"
+		logrus.Warningf("", username) // $ hasTaintFlow="username"
+		logrus.Warningln(username)    // $ hasTaintFlow="username"
+
+		fields := make(logrus.Fields)
+		fields["username"] = username
+		entry := logrus.WithFields(fields)             // $ hasTaintFlow="fields"
+		entry = logrus.WithField("username", username) // $ hasTaintFlow="username"
+		entry.Debug(username)                          // $ hasTaintFlow="username"
+		entry.Debugf(username, "")                     // $ hasTaintFlow="username"
+		entry.Debugf("", username)                     // $ hasTaintFlow="username"
+		entry.Debugln(username)                        // $ hasTaintFlow="username"
+		entry.Error(username)                          // $ hasTaintFlow="username"
+		entry.Errorf(username, "")                     // $ hasTaintFlow="username"
+		entry.Errorf("", username)                     // $ hasTaintFlow="username"
+		entry.Errorln(username)                        // $ hasTaintFlow="username"
+		entry.Fatal(username)                          // $ hasTaintFlow="username"
+		entry.Fatalf(username, "")                     // $ hasTaintFlow="username"
+		entry.Fatalf("", username)                     // $ hasTaintFlow="username"
+		entry.Fatalln(username)                        // $ hasTaintFlow="username"
+		entry.Info(username)                           // $ hasTaintFlow="username"
+		entry.Infof(username, "")                      // $ hasTaintFlow="username"
+		entry.Infof("", username)                      // $ hasTaintFlow="username"
+		entry.Infoln(username)                         // $ hasTaintFlow="username"
+		entry.Log(0, username)                         // $ hasTaintFlow="username"
+		entry.Logf(0, username, "")                    // $ hasTaintFlow="username"
+		entry.Logf(0, "", username)                    // $ hasTaintFlow="username"
+		entry.Logln(0, username)                       // $ hasTaintFlow="username"
+		entry.Panic(username)                          // $ hasTaintFlow="username"
+		entry.Panicf(username, "")                     // $ hasTaintFlow="username"
+		entry.Panicf("", username)                     // $ hasTaintFlow="username"
+		entry.Panicln(username)                        // $ hasTaintFlow="username"
+		entry.Print(username)                          // $ hasTaintFlow="username"
+		entry.Printf(username, "")                     // $ hasTaintFlow="username"
+		entry.Printf("", username)                     // $ hasTaintFlow="username"
+		entry.Println(username)                        // $ hasTaintFlow="username"
+		entry.Trace(username)                          // $ hasTaintFlow="username"
+		entry.Tracef(username, "")                     // $ hasTaintFlow="username"
+		entry.Tracef("", username)                     // $ hasTaintFlow="username"
+		entry.Traceln(username)                        // $ hasTaintFlow="username"
+		entry.Warn(username)                           // $ hasTaintFlow="username"
+		entry.Warnf(username, "")                      // $ hasTaintFlow="username"
+		entry.Warnf("", username)                      // $ hasTaintFlow="username"
+		entry.Warnln(username)                         // $ hasTaintFlow="username"
+		entry.Warning(username)                        // $ hasTaintFlow="username"
+		entry.Warningf(username, "")                   // $ hasTaintFlow="username"
+		entry.Warningf("", username)                   // $ hasTaintFlow="username"
+		entry.Warningln(username)                      // $ hasTaintFlow="username"
+
+		logger := entry.Logger
+		logger.Debug(username)        // $ hasTaintFlow="username"
+		logger.Debugf(username, "")   // $ hasTaintFlow="username"
+		logger.Debugf("", username)   // $ hasTaintFlow="username"
+		logger.Debugln(username)      // $ hasTaintFlow="username"
+		logger.Error(username)        // $ hasTaintFlow="username"
+		logger.Errorf(username, "")   // $ hasTaintFlow="username"
+		logger.Errorf("", username)   // $ hasTaintFlow="username"
+		logger.Errorln(username)      // $ hasTaintFlow="username"
+		logger.Fatal(username)        // $ hasTaintFlow="username"
+		logger.Fatalf(username, "")   // $ hasTaintFlow="username"
+		logger.Fatalf("", username)   // $ hasTaintFlow="username"
+		logger.Fatalln(username)      // $ hasTaintFlow="username"
+		logger.Info(username)         // $ hasTaintFlow="username"
+		logger.Infof(username, "")    // $ hasTaintFlow="username"
+		logger.Infof("", username)    // $ hasTaintFlow="username"
+		logger.Infoln(username)       // $ hasTaintFlow="username"
+		logger.Log(0, username)       // $ hasTaintFlow="username"
+		logger.Logf(0, username, "")  // $ hasTaintFlow="username"
+		logger.Logf(0, "", username)  // $ hasTaintFlow="username"
+		logger.Logln(0, username)     // $ hasTaintFlow="username"
+		logger.Panic(username)        // $ hasTaintFlow="username"
+		logger.Panicf(username, "")   // $ hasTaintFlow="username"
+		logger.Panicf("", username)   // $ hasTaintFlow="username"
+		logger.Panicln(username)      // $ hasTaintFlow="username"
+		logger.Print(username)        // $ hasTaintFlow="username"
+		logger.Printf(username, "")   // $ hasTaintFlow="username"
+		logger.Printf("", username)   // $ hasTaintFlow="username"
+		logger.Println(username)      // $ hasTaintFlow="username"
+		logger.Trace(username)        // $ hasTaintFlow="username"
+		logger.Tracef(username, "")   // $ hasTaintFlow="username"
+		logger.Tracef("", username)   // $ hasTaintFlow="username"
+		logger.Traceln(username)      // $ hasTaintFlow="username"
+		logger.Warn(username)         // $ hasTaintFlow="username"
+		logger.Warnf(username, "")    // $ hasTaintFlow="username"
+		logger.Warnf("", username)    // $ hasTaintFlow="username"
+		logger.Warnln(username)       // $ hasTaintFlow="username"
+		logger.Warning(username)      // $ hasTaintFlow="username"
+		logger.Warningf(username, "") // $ hasTaintFlow="username"
+		logger.Warningf("", username) // $ hasTaintFlow="username"
+		logger.Warningln(username)    // $ hasTaintFlow="username"
+	}
+	// davecgh/go-spew/spew
+	{
+		spew.Dump(username)          // $ hasTaintFlow="username"
+		spew.Errorf(username)        // $ hasTaintFlow="username"
+		spew.Print(username)         // $ hasTaintFlow="username"
+		spew.Printf(username)        // $ hasTaintFlow="username"
+		spew.Println(username)       // $ hasTaintFlow="username"
+		spew.Fdump(nil, username)    // $ hasTaintFlow="username"
+		spew.Fprint(nil, username)   // $ hasTaintFlow="username"
+		spew.Fprintf(nil, username)  // $ hasTaintFlow="username"
+		spew.Fprintln(nil, username) // $ hasTaintFlow="username"
+	}
+	// zap
+	{
+		logger, _ := zap.NewProduction()
+		logger.DPanic(username) // $ hasTaintFlow="username"
+		logger.Debug(username)  // $ hasTaintFlow="username"
+		logger.Error(username)  // $ hasTaintFlow="username"
+		if testFlag == " true" {
+			logger.Fatal(username) // $ hasTaintFlow="username"
+		}
+		logger.Info(username) // $ hasTaintFlow="username"
+		if testFlag == " true" {
+			logger.Panic(username) // $ hasTaintFlow="username"
+		}
+		logger.Warn(username)        // $ hasTaintFlow="username"
+		logger.Named(username)       // $ hasTaintFlow="username"
+		logger.With(username)        // $ hasTaintFlow="username"
+		logger.WithOptions(username) // $ hasTaintFlow="username"
+
+		sLogger := logger.Sugar()
+		sLogger.DPanic(username) // $ hasTaintFlow="username"
+		sLogger.Debug(username)  // $ hasTaintFlow="username"
+		sLogger.Error(username)  // $ hasTaintFlow="username"
+		if testFlag == " true" {
+			sLogger.Fatal(username) // $ hasTaintFlow="username"
+		}
+		sLogger.Info(username) // $ hasTaintFlow="username"
+		if testFlag == " true" {
+			sLogger.Panic(username) // $ hasTaintFlow="username"
+		}
+		sLogger.Warn(username)    // $ hasTaintFlow="username"
+		sLogger.DPanicf(username) // $ hasTaintFlow="username"
+		sLogger.Debugf(username)  // $ hasTaintFlow="username"
+		sLogger.Errorf(username)  // $ hasTaintFlow="username"
+		if testFlag == " true" {
+			sLogger.Fatalf(username) // $ hasTaintFlow="username"
+		}
+		sLogger.Infof(username) // $ hasTaintFlow="username"
+		if testFlag == " true" {
+			sLogger.Panicf(username) // $ hasTaintFlow="username"
+		}
+		sLogger.Warnf(username)   // $ hasTaintFlow="username"
+		sLogger.DPanicw(username) // $ hasTaintFlow="username"
+		sLogger.Debugw(username)  // $ hasTaintFlow="username"
+		sLogger.Errorw(username)  // $ hasTaintFlow="username"
+		if testFlag == " true" {
+			sLogger.Fatalw(username) // $ hasTaintFlow="username"
+		}
+		sLogger.Infow(username) // $ hasTaintFlow="username"
+		if testFlag == " true" {
+			sLogger.Panicw(username) // $ hasTaintFlow="username"
+		}
+		sLogger.Warnw(username) // $ hasTaintFlow="username"
+		sLogger.Named(username) // $ hasTaintFlow="username"
+		sLogger.With(username)  // $ hasTaintFlow="username"
+	}
+}

ql/test/query-tests/Security/CWE-117/LogInjectionTest.ql

@@ -0,0 +1,11 @@
+import go
+import TestUtilities.InlineFlowTest
+import semmle.go.security.LogInjection
+
+class LogInjectionTest extends InlineFlowTest {
+  override DataFlow::Configuration getTaintFlowConfig() {
+    result = any(LogInjection::Configuration config)
+  }
+
+  override DataFlow::Configuration getValueFlowConfig() { none() }
+}

ql/test/query-tests/Security/CWE-117/go.mod

@@ -0,0 +1,14 @@
+module main
+
+go 1.14
+
+require (
+	github.com/astaxie/beego v1.12.3
+	github.com/elazarl/goproxy v0.0.0-20211114080932-d06c3be7c11b
+	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
+	github.com/kr/text v0.2.0 // indirect
+	github.com/sirupsen/logrus v1.8.1
+	github.com/stretchr/testify v1.6.0 // indirect
+	golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f // indirect
+	k8s.io/klog v1.0.0
+)

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/.gitignore

@@ -0,0 +1,6 @@
+.idea
+.vscode
+.DS_Store
+*.swp
+*.swo
+beego.iml

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/.travis.yml

@@ -0,0 +1,73 @@
+language: go
+
+go:
+  - "1.13.x"
+services:
+  - redis-server
+  - mysql
+  - postgresql
+  - memcached
+env:
+  global:
+    - GO_REPO_FULLNAME="github.com/astaxie/beego"
+  matrix:
+    - ORM_DRIVER=sqlite3   ORM_SOURCE=$TRAVIS_BUILD_DIR/orm_test.db
+    - ORM_DRIVER=postgres ORM_SOURCE="user=postgres dbname=orm_test sslmode=disable"
+before_install:
+   # link the local repo with ${GOPATH}/src/<namespace>/<repo>
+ - GO_REPO_NAMESPACE=${GO_REPO_FULLNAME%/*}
+   # relies on GOPATH to contain only one directory...
+ - mkdir -p ${GOPATH}/src/${GO_REPO_NAMESPACE}
+ - ln -sv ${TRAVIS_BUILD_DIR} ${GOPATH}/src/${GO_REPO_FULLNAME}
+ - cd ${GOPATH}/src/${GO_REPO_FULLNAME}
+   # get and build ssdb
+ - git clone git://github.com/ideawu/ssdb.git
+ - cd ssdb
+ - make
+ - cd ..
+install:
+  - go get github.com/lib/pq
+  - go get github.com/go-sql-driver/mysql
+  - go get github.com/mattn/go-sqlite3
+  - go get github.com/bradfitz/gomemcache/memcache
+  - go get github.com/gomodule/redigo/redis
+  - go get github.com/beego/x2j
+  - go get github.com/couchbase/go-couchbase
+  - go get github.com/beego/goyaml2
+  - go get gopkg.in/yaml.v2
+  - go get github.com/belogik/goes
+  - go get github.com/ledisdb/ledisdb
+  - go get github.com/ssdb/gossdb/ssdb
+  - go get github.com/cloudflare/golz4
+  - go get github.com/gogo/protobuf/proto
+  - go get github.com/Knetic/govaluate
+  - go get github.com/casbin/casbin
+  - go get github.com/elazarl/go-bindata-assetfs
+  - go get github.com/OwnLocal/goes
+  - go get github.com/shiena/ansicolor
+  - go get -u honnef.co/go/tools/cmd/staticcheck
+  - go get -u github.com/mdempsky/unconvert
+  - go get -u github.com/gordonklaus/ineffassign
+  - go get -u golang.org/x/lint/golint
+  - go get -u github.com/go-redis/redis
+before_script:
+  - psql --version
+  - sh -c "if [ '$ORM_DRIVER' = 'postgres' ]; then psql -c 'create database orm_test;' -U postgres; fi"
+  - sh -c "if [ '$ORM_DRIVER' = 'mysql' ]; then mysql -u root -e 'create database orm_test;'; fi"
+  - sh -c "if [ '$ORM_DRIVER' = 'sqlite' ]; then touch $TRAVIS_BUILD_DIR/orm_test.db; fi"
+  - sh -c "go get github.com/golang/lint/golint; golint ./...;"
+  - sh -c "go list ./... | grep -v vendor | xargs go vet -v"
+  - mkdir -p res/var
+  - ./ssdb/ssdb-server ./ssdb/ssdb.conf -d
+after_script:
+  - killall -w ssdb-server
+  - rm -rf ./res/var/*
+script:
+  - go test -v ./...
+  - staticcheck -show-ignored -checks "-ST1017,-U1000,-ST1005,-S1034,-S1012,-SA4006,-SA6005,-SA1019,-SA1024"
+  - unconvert $(go list ./... | grep -v /vendor/)
+  - ineffassign .
+  - find . ! \( -path './vendor' -prune \) -type f -name '*.go' -print0 | xargs -0 gofmt -l -s
+  - golint ./...
+addons:
+  postgresql: "9.6"

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# Contributing to beego
+
+beego is an open source project.
+
+It is the work of hundreds of contributors. We appreciate your help!
+
+Here are instructions to get you started. They are probably not perfect, 
+please let us know if anything feels wrong or incomplete.
+
+## Contribution guidelines
+
+### Pull requests
+
+First of all. beego follow the gitflow. So please send you pull request 
+to **develop** branch. We will close the pull request to master branch.
+
+We are always happy to receive pull requests, and do our best to
+review them as fast as possible. Not sure if that typo is worth a pull
+request? Do it! We will appreciate it.
+
+If your pull request is not accepted on the first try, don't be
+discouraged! Sometimes we can make a mistake, please do more explaining 
+for us. We will appreciate it.
+
+We're trying very hard to keep beego simple and fast. We don't want it
+to do everything for everybody. This means that we might decide against
+incorporating a new feature. But we will give you some advice on how to 
+do it in other way.
+
+### Create issues
+
+Any significant improvement should be documented as [a GitHub
+issue](https://github.com/astaxie/beego/issues) before anybody
+starts working on it. 
+
+Also when filing an issue, make sure to answer these five questions:
+
+- What version of beego are you using (bee version)?
+- What operating system and processor architecture are you using?
+- What did you do?
+- What did you expect to see?
+- What did you see instead?
+
+### but check existing issues and docs first!
+
+Please take a moment to check that an issue doesn't already exist
+documenting your bug report or improvement proposal. If it does, it
+never hurts to add a quick "+1" or "I have this problem too". This will
+help prioritize the most common problems and requests.
+
+Also if you don't know how to use it. please make sure you have read though
+the docs in http://beego.me/docs

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/LICENSE

@@ -0,0 +1,13 @@
+Copyright 2014 astaxie
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/README.md

@@ -0,0 +1,73 @@
+# Beego [![Build Status](https://travis-ci.org/astaxie/beego.svg?branch=master)](https://travis-ci.org/astaxie/beego) [![GoDoc](http://godoc.org/github.com/astaxie/beego?status.svg)](http://godoc.org/github.com/astaxie/beego) [![Foundation](https://img.shields.io/badge/Golang-Foundation-green.svg)](http://golangfoundation.org) [![Go Report Card](https://goreportcard.com/badge/github.com/astaxie/beego)](https://goreportcard.com/report/github.com/astaxie/beego)
+
+
+beego is used for rapid development of RESTful APIs, web apps and backend services in Go.
+It is inspired by Tornado, Sinatra and Flask. beego has some Go-specific features such as interfaces and struct embedding.
+
+###### More info at [beego.me](http://beego.me).
+
+## Quick Start
+
+#### Create `hello` directory, cd `hello` directory
+
+    mkdir hello
+    cd hello
+ 
+#### Init module
+
+    go mod init
+
+#### Download and install
+
+    go get github.com/astaxie/beego
+
+#### Create file `hello.go`
+```go
+package main
+
+import "github.com/astaxie/beego"
+
+func main(){
+    beego.Run()
+}
+```
+#### Build and run
+
+    go build hello.go
+    ./hello
+
+#### Go to [http://localhost:8080](http://localhost:8080)
+
+Congratulations! You've just built your first **beego** app.
+
+###### Please see [Documentation](http://beego.me/docs) for more.
+
+###### [beego-example](https://github.com/beego-dev/beego-example)
+
+## Features
+
+* RESTful support
+* MVC architecture
+* Modularity
+* Auto API documents
+* Annotation router
+* Namespace
+* Powerful development tools
+* Full stack for Web & API
+
+## Documentation
+
+* [English](http://beego.me/docs/intro/)
+* [中文文档](http://beego.me/docs/intro/)
+* [Русский](http://beego.me/docs/intro/)
+
+## Community
+
+* [http://beego.me/community](http://beego.me/community)
+* Welcome to join us in Slack: [https://beego.slack.com](https://beego.slack.com), you can get invited from [here](https://github.com/beego/beedoc/issues/232)
+* QQ Group Group ID:523992905
+
+## License
+
+beego source code is licensed under the Apache Licence, Version 2.0
+(http://www.apache.org/licenses/LICENSE-2.0.html).

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/admin.go

@@ -0,0 +1,458 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"reflect"
+	"strconv"
+	"text/template"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+
+	"github.com/astaxie/beego/grace"
+	"github.com/astaxie/beego/logs"
+	"github.com/astaxie/beego/toolbox"
+	"github.com/astaxie/beego/utils"
+)
+
+// BeeAdminApp is the default adminApp used by admin module.
+var beeAdminApp *adminApp
+
+// FilterMonitorFunc is default monitor filter when admin module is enable.
+// if this func returns, admin module records qps for this request by condition of this function logic.
+// usage:
+// 	func MyFilterMonitor(method, requestPath string, t time.Duration, pattern string, statusCode int) bool {
+//	 	if method == "POST" {
+//			return false
+//	 	}
+//	 	if t.Nanoseconds() < 100 {
+//			return false
+//	 	}
+//	 	if strings.HasPrefix(requestPath, "/astaxie") {
+//			return false
+//	 	}
+//	 	return true
+// 	}
+// 	beego.FilterMonitorFunc = MyFilterMonitor.
+var FilterMonitorFunc func(string, string, time.Duration, string, int) bool
+
+func init() {
+	beeAdminApp = &adminApp{
+		routers: make(map[string]http.HandlerFunc),
+	}
+	// keep in mind that all data should be html escaped to avoid XSS attack
+	beeAdminApp.Route("/", adminIndex)
+	beeAdminApp.Route("/qps", qpsIndex)
+	beeAdminApp.Route("/prof", profIndex)
+	beeAdminApp.Route("/healthcheck", healthcheck)
+	beeAdminApp.Route("/task", taskStatus)
+	beeAdminApp.Route("/listconf", listConf)
+	beeAdminApp.Route("/metrics", promhttp.Handler().ServeHTTP)
+	FilterMonitorFunc = func(string, string, time.Duration, string, int) bool { return true }
+}
+
+// AdminIndex is the default http.Handler for admin module.
+// it matches url pattern "/".
+func adminIndex(rw http.ResponseWriter, _ *http.Request) {
+	writeTemplate(rw, map[interface{}]interface{}{}, indexTpl, defaultScriptsTpl)
+}
+
+// QpsIndex is the http.Handler for writing qps statistics map result info in http.ResponseWriter.
+// it's registered with url pattern "/qps" in admin module.
+func qpsIndex(rw http.ResponseWriter, _ *http.Request) {
+	data := make(map[interface{}]interface{})
+	data["Content"] = toolbox.StatisticsMap.GetMap()
+
+	// do html escape before display path, avoid xss
+	if content, ok := (data["Content"]).(M); ok {
+		if resultLists, ok := (content["Data"]).([][]string); ok {
+			for i := range resultLists {
+				if len(resultLists[i]) > 0 {
+					resultLists[i][0] = template.HTMLEscapeString(resultLists[i][0])
+				}
+			}
+		}
+	}
+
+	writeTemplate(rw, data, qpsTpl, defaultScriptsTpl)
+}
+
+// ListConf is the http.Handler of displaying all beego configuration values as key/value pair.
+// it's registered with url pattern "/listconf" in admin module.
+func listConf(rw http.ResponseWriter, r *http.Request) {
+	r.ParseForm()
+	command := r.Form.Get("command")
+	if command == "" {
+		rw.Write([]byte("command not support"))
+		return
+	}
+
+	data := make(map[interface{}]interface{})
+	switch command {
+	case "conf":
+		m := make(M)
+		list("BConfig", BConfig, m)
+		m["AppConfigPath"] = template.HTMLEscapeString(appConfigPath)
+		m["AppConfigProvider"] = template.HTMLEscapeString(appConfigProvider)
+		tmpl := template.Must(template.New("dashboard").Parse(dashboardTpl))
+		tmpl = template.Must(tmpl.Parse(configTpl))
+		tmpl = template.Must(tmpl.Parse(defaultScriptsTpl))
+
+		data["Content"] = m
+
+		tmpl.Execute(rw, data)
+
+	case "router":
+		content := PrintTree()
+		content["Fields"] = []string{
+			"Router Pattern",
+			"Methods",
+			"Controller",
+		}
+		data["Content"] = content
+		data["Title"] = "Routers"
+		writeTemplate(rw, data, routerAndFilterTpl, defaultScriptsTpl)
+	case "filter":
+		var (
+			content = M{
+				"Fields": []string{
+					"Router Pattern",
+					"Filter Function",
+				},
+			}
+			filterTypes    = []string{}
+			filterTypeData = make(M)
+		)
+
+		if BeeApp.Handlers.enableFilter {
+			var filterType string
+			for k, fr := range map[int]string{
+				BeforeStatic: "Before Static",
+				BeforeRouter: "Before Router",
+				BeforeExec:   "Before Exec",
+				AfterExec:    "After Exec",
+				FinishRouter: "Finish Router"} {
+				if bf := BeeApp.Handlers.filters[k]; len(bf) > 0 {
+					filterType = fr
+					filterTypes = append(filterTypes, filterType)
+					resultList := new([][]string)
+					for _, f := range bf {
+						var result = []string{
+							// void xss
+							template.HTMLEscapeString(f.pattern),
+							template.HTMLEscapeString(utils.GetFuncName(f.filterFunc)),
+						}
+						*resultList = append(*resultList, result)
+					}
+					filterTypeData[filterType] = resultList
+				}
+			}
+		}
+
+		content["Data"] = filterTypeData
+		content["Methods"] = filterTypes
+
+		data["Content"] = content
+		data["Title"] = "Filters"
+		writeTemplate(rw, data, routerAndFilterTpl, defaultScriptsTpl)
+	default:
+		rw.Write([]byte("command not support"))
+	}
+}
+
+func list(root string, p interface{}, m M) {
+	pt := reflect.TypeOf(p)
+	pv := reflect.ValueOf(p)
+	if pt.Kind() == reflect.Ptr {
+		pt = pt.Elem()
+		pv = pv.Elem()
+	}
+	for i := 0; i < pv.NumField(); i++ {
+		var key string
+		if root == "" {
+			key = pt.Field(i).Name
+		} else {
+			key = root + "." + pt.Field(i).Name
+		}
+		if pv.Field(i).Kind() == reflect.Struct {
+			list(key, pv.Field(i).Interface(), m)
+		} else {
+			m[key] = pv.Field(i).Interface()
+		}
+	}
+}
+
+// PrintTree prints all registered routers.
+func PrintTree() M {
+	var (
+		content     = M{}
+		methods     = []string{}
+		methodsData = make(M)
+	)
+	for method, t := range BeeApp.Handlers.routers {
+
+		resultList := new([][]string)
+
+		printTree(resultList, t)
+
+		methods = append(methods, template.HTMLEscapeString(method))
+		methodsData[template.HTMLEscapeString(method)] = resultList
+	}
+
+	content["Data"] = methodsData
+	content["Methods"] = methods
+	return content
+}
+
+func printTree(resultList *[][]string, t *Tree) {
+	for _, tr := range t.fixrouters {
+		printTree(resultList, tr)
+	}
+	if t.wildcard != nil {
+		printTree(resultList, t.wildcard)
+	}
+	for _, l := range t.leaves {
+		if v, ok := l.runObject.(*ControllerInfo); ok {
+			if v.routerType == routerTypeBeego {
+				var result = []string{
+					template.HTMLEscapeString(v.pattern),
+					template.HTMLEscapeString(fmt.Sprintf("%s", v.methods)),
+					template.HTMLEscapeString(v.controllerType.String()),
+				}
+				*resultList = append(*resultList, result)
+			} else if v.routerType == routerTypeRESTFul {
+				var result = []string{
+					template.HTMLEscapeString(v.pattern),
+					template.HTMLEscapeString(fmt.Sprintf("%s", v.methods)),
+					"",
+				}
+				*resultList = append(*resultList, result)
+			} else if v.routerType == routerTypeHandler {
+				var result = []string{
+					template.HTMLEscapeString(v.pattern),
+					"",
+					"",
+				}
+				*resultList = append(*resultList, result)
+			}
+		}
+	}
+}
+
+// ProfIndex is a http.Handler for showing profile command.
+// it's in url pattern "/prof" in admin module.
+func profIndex(rw http.ResponseWriter, r *http.Request) {
+	r.ParseForm()
+	command := r.Form.Get("command")
+	if command == "" {
+		return
+	}
+
+	var (
+		format = r.Form.Get("format")
+		data   = make(map[interface{}]interface{})
+		result bytes.Buffer
+	)
+	toolbox.ProcessInput(command, &result)
+	data["Content"] = template.HTMLEscapeString(result.String())
+
+	if format == "json" && command == "gc summary" {
+		dataJSON, err := json.Marshal(data)
+		if err != nil {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		writeJSON(rw, dataJSON)
+		return
+	}
+
+	data["Title"] = template.HTMLEscapeString(command)
+	defaultTpl := defaultScriptsTpl
+	if command == "gc summary" {
+		defaultTpl = gcAjaxTpl
+	}
+	writeTemplate(rw, data, profillingTpl, defaultTpl)
+}
+
+// Healthcheck is a http.Handler calling health checking and showing the result.
+// it's in "/healthcheck" pattern in admin module.
+func healthcheck(rw http.ResponseWriter, r *http.Request) {
+	var (
+		result     []string
+		data       = make(map[interface{}]interface{})
+		resultList = new([][]string)
+		content    = M{
+			"Fields": []string{"Name", "Message", "Status"},
+		}
+	)
+
+	for name, h := range toolbox.AdminCheckList {
+		if err := h.Check(); err != nil {
+			result = []string{
+				"error",
+				template.HTMLEscapeString(name),
+				template.HTMLEscapeString(err.Error()),
+			}
+		} else {
+			result = []string{
+				"success",
+				template.HTMLEscapeString(name),
+				"OK",
+			}
+		}
+		*resultList = append(*resultList, result)
+	}
+
+	queryParams := r.URL.Query()
+	jsonFlag := queryParams.Get("json")
+	shouldReturnJSON, _ := strconv.ParseBool(jsonFlag)
+
+	if shouldReturnJSON {
+		response := buildHealthCheckResponseList(resultList)
+		jsonResponse, err := json.Marshal(response)
+
+		if err != nil {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+		} else {
+			writeJSON(rw, jsonResponse)
+		}
+		return
+	}
+
+	content["Data"] = resultList
+	data["Content"] = content
+	data["Title"] = "Health Check"
+
+	writeTemplate(rw, data, healthCheckTpl, defaultScriptsTpl)
+}
+
+func buildHealthCheckResponseList(healthCheckResults *[][]string) []map[string]interface{} {
+	response := make([]map[string]interface{}, len(*healthCheckResults))
+
+	for i, healthCheckResult := range *healthCheckResults {
+		currentResultMap := make(map[string]interface{})
+
+		currentResultMap["name"] = healthCheckResult[0]
+		currentResultMap["message"] = healthCheckResult[1]
+		currentResultMap["status"] = healthCheckResult[2]
+
+		response[i] = currentResultMap
+	}
+
+	return response
+
+}
+
+func writeJSON(rw http.ResponseWriter, jsonData []byte) {
+	rw.Header().Set("Content-Type", "application/json")
+	rw.Write(jsonData)
+}
+
+// TaskStatus is a http.Handler with running task status (task name, status and the last execution).
+// it's in "/task" pattern in admin module.
+func taskStatus(rw http.ResponseWriter, req *http.Request) {
+	data := make(map[interface{}]interface{})
+
+	// Run Task
+	req.ParseForm()
+	taskname := req.Form.Get("taskname")
+	if taskname != "" {
+		if t, ok := toolbox.AdminTaskList[taskname]; ok {
+			if err := t.Run(); err != nil {
+				data["Message"] = []string{"error", template.HTMLEscapeString(fmt.Sprintf("%s", err))}
+			}
+			data["Message"] = []string{"success", template.HTMLEscapeString(fmt.Sprintf("%s run success,Now the Status is <br>%s", taskname, t.GetStatus()))}
+		} else {
+			data["Message"] = []string{"warning", template.HTMLEscapeString(fmt.Sprintf("there's no task which named: %s", taskname))}
+		}
+	}
+
+	// List Tasks
+	content := make(M)
+	resultList := new([][]string)
+	var fields = []string{
+		"Task Name",
+		"Task Spec",
+		"Task Status",
+		"Last Time",
+		"",
+	}
+	for tname, tk := range toolbox.AdminTaskList {
+		result := []string{
+			template.HTMLEscapeString(tname),
+			template.HTMLEscapeString(tk.GetSpec()),
+			template.HTMLEscapeString(tk.GetStatus()),
+			template.HTMLEscapeString(tk.GetPrev().String()),
+		}
+		*resultList = append(*resultList, result)
+	}
+
+	content["Fields"] = fields
+	content["Data"] = resultList
+	data["Content"] = content
+	data["Title"] = "Tasks"
+	writeTemplate(rw, data, tasksTpl, defaultScriptsTpl)
+}
+
+func writeTemplate(rw http.ResponseWriter, data map[interface{}]interface{}, tpls ...string) {
+	tmpl := template.Must(template.New("dashboard").Parse(dashboardTpl))
+	for _, tpl := range tpls {
+		tmpl = template.Must(tmpl.Parse(tpl))
+	}
+	tmpl.Execute(rw, data)
+}
+
+// adminApp is an http.HandlerFunc map used as beeAdminApp.
+type adminApp struct {
+	routers map[string]http.HandlerFunc
+}
+
+// Route adds http.HandlerFunc to adminApp with url pattern.
+func (admin *adminApp) Route(pattern string, f http.HandlerFunc) {
+	admin.routers[pattern] = f
+}
+
+// Run adminApp http server.
+// Its addr is defined in configuration file as adminhttpaddr and adminhttpport.
+func (admin *adminApp) Run() {
+	if len(toolbox.AdminTaskList) > 0 {
+		toolbox.StartTask()
+	}
+	addr := BConfig.Listen.AdminAddr
+
+	if BConfig.Listen.AdminPort != 0 {
+		addr = fmt.Sprintf("%s:%d", BConfig.Listen.AdminAddr, BConfig.Listen.AdminPort)
+	}
+	for p, f := range admin.routers {
+		http.Handle(p, f)
+	}
+	logs.Info("Admin server Running on %s", addr)
+
+	var err error
+	if BConfig.Listen.Graceful {
+		err = grace.ListenAndServe(addr, nil)
+	} else {
+		err = http.ListenAndServe(addr, nil)
+	}
+	if err != nil {
+		logs.Critical("Admin ListenAndServe: ", err, fmt.Sprintf("%d", os.Getpid()))
+	}
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/app.go

@@ -0,0 +1,496 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/http/fcgi"
+	"os"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/astaxie/beego/grace"
+	"github.com/astaxie/beego/logs"
+	"github.com/astaxie/beego/utils"
+	"golang.org/x/crypto/acme/autocert"
+)
+
+var (
+	// BeeApp is an application instance
+	BeeApp *App
+)
+
+func init() {
+	// create beego application
+	BeeApp = NewApp()
+}
+
+// App defines beego application with a new PatternServeMux.
+type App struct {
+	Handlers *ControllerRegister
+	Server   *http.Server
+}
+
+// NewApp returns a new beego application.
+func NewApp() *App {
+	cr := NewControllerRegister()
+	app := &App{Handlers: cr, Server: &http.Server{}}
+	return app
+}
+
+// MiddleWare function for http.Handler
+type MiddleWare func(http.Handler) http.Handler
+
+// Run beego application.
+func (app *App) Run(mws ...MiddleWare) {
+	addr := BConfig.Listen.HTTPAddr
+
+	if BConfig.Listen.HTTPPort != 0 {
+		addr = fmt.Sprintf("%s:%d", BConfig.Listen.HTTPAddr, BConfig.Listen.HTTPPort)
+	}
+
+	var (
+		err        error
+		l          net.Listener
+		endRunning = make(chan bool, 1)
+	)
+
+	// run cgi server
+	if BConfig.Listen.EnableFcgi {
+		if BConfig.Listen.EnableStdIo {
+			if err = fcgi.Serve(nil, app.Handlers); err == nil { // standard I/O
+				logs.Info("Use FCGI via standard I/O")
+			} else {
+				logs.Critical("Cannot use FCGI via standard I/O", err)
+			}
+			return
+		}
+		if BConfig.Listen.HTTPPort == 0 {
+			// remove the Socket file before start
+			if utils.FileExists(addr) {
+				os.Remove(addr)
+			}
+			l, err = net.Listen("unix", addr)
+		} else {
+			l, err = net.Listen("tcp", addr)
+		}
+		if err != nil {
+			logs.Critical("Listen: ", err)
+		}
+		if err = fcgi.Serve(l, app.Handlers); err != nil {
+			logs.Critical("fcgi.Serve: ", err)
+		}
+		return
+	}
+
+	app.Server.Handler = app.Handlers
+	for i := len(mws) - 1; i >= 0; i-- {
+		if mws[i] == nil {
+			continue
+		}
+		app.Server.Handler = mws[i](app.Server.Handler)
+	}
+	app.Server.ReadTimeout = time.Duration(BConfig.Listen.ServerTimeOut) * time.Second
+	app.Server.WriteTimeout = time.Duration(BConfig.Listen.ServerTimeOut) * time.Second
+	app.Server.ErrorLog = logs.GetLogger("HTTP")
+
+	// run graceful mode
+	if BConfig.Listen.Graceful {
+		httpsAddr := BConfig.Listen.HTTPSAddr
+		app.Server.Addr = httpsAddr
+		if BConfig.Listen.EnableHTTPS || BConfig.Listen.EnableMutualHTTPS {
+			go func() {
+				time.Sleep(1000 * time.Microsecond)
+				if BConfig.Listen.HTTPSPort != 0 {
+					httpsAddr = fmt.Sprintf("%s:%d", BConfig.Listen.HTTPSAddr, BConfig.Listen.HTTPSPort)
+					app.Server.Addr = httpsAddr
+				}
+				server := grace.NewServer(httpsAddr, app.Server.Handler)
+				server.Server.ReadTimeout = app.Server.ReadTimeout
+				server.Server.WriteTimeout = app.Server.WriteTimeout
+				if BConfig.Listen.EnableMutualHTTPS {
+					if err := server.ListenAndServeMutualTLS(BConfig.Listen.HTTPSCertFile, BConfig.Listen.HTTPSKeyFile, BConfig.Listen.TrustCaFile); err != nil {
+						logs.Critical("ListenAndServeTLS: ", err, fmt.Sprintf("%d", os.Getpid()))
+						time.Sleep(100 * time.Microsecond)
+					}
+				} else {
+					if BConfig.Listen.AutoTLS {
+						m := autocert.Manager{
+							Prompt:     autocert.AcceptTOS,
+							HostPolicy: autocert.HostWhitelist(BConfig.Listen.Domains...),
+							Cache:      autocert.DirCache(BConfig.Listen.TLSCacheDir),
+						}
+						app.Server.TLSConfig = &tls.Config{GetCertificate: m.GetCertificate}
+						BConfig.Listen.HTTPSCertFile, BConfig.Listen.HTTPSKeyFile = "", ""
+					}
+					if err := server.ListenAndServeTLS(BConfig.Listen.HTTPSCertFile, BConfig.Listen.HTTPSKeyFile); err != nil {
+						logs.Critical("ListenAndServeTLS: ", err, fmt.Sprintf("%d", os.Getpid()))
+						time.Sleep(100 * time.Microsecond)
+					}
+				}
+				endRunning <- true
+			}()
+		}
+		if BConfig.Listen.EnableHTTP {
+			go func() {
+				server := grace.NewServer(addr, app.Server.Handler)
+				server.Server.ReadTimeout = app.Server.ReadTimeout
+				server.Server.WriteTimeout = app.Server.WriteTimeout
+				if BConfig.Listen.ListenTCP4 {
+					server.Network = "tcp4"
+				}
+				if err := server.ListenAndServe(); err != nil {
+					logs.Critical("ListenAndServe: ", err, fmt.Sprintf("%d", os.Getpid()))
+					time.Sleep(100 * time.Microsecond)
+				}
+				endRunning <- true
+			}()
+		}
+		<-endRunning
+		return
+	}
+
+	// run normal mode
+	if BConfig.Listen.EnableHTTPS || BConfig.Listen.EnableMutualHTTPS {
+		go func() {
+			time.Sleep(1000 * time.Microsecond)
+			if BConfig.Listen.HTTPSPort != 0 {
+				app.Server.Addr = fmt.Sprintf("%s:%d", BConfig.Listen.HTTPSAddr, BConfig.Listen.HTTPSPort)
+			} else if BConfig.Listen.EnableHTTP {
+				logs.Info("Start https server error, conflict with http. Please reset https port")
+				return
+			}
+			logs.Info("https server Running on https://%s", app.Server.Addr)
+			if BConfig.Listen.AutoTLS {
+				m := autocert.Manager{
+					Prompt:     autocert.AcceptTOS,
+					HostPolicy: autocert.HostWhitelist(BConfig.Listen.Domains...),
+					Cache:      autocert.DirCache(BConfig.Listen.TLSCacheDir),
+				}
+				app.Server.TLSConfig = &tls.Config{GetCertificate: m.GetCertificate}
+				BConfig.Listen.HTTPSCertFile, BConfig.Listen.HTTPSKeyFile = "", ""
+			} else if BConfig.Listen.EnableMutualHTTPS {
+				pool := x509.NewCertPool()
+				data, err := ioutil.ReadFile(BConfig.Listen.TrustCaFile)
+				if err != nil {
+					logs.Info("MutualHTTPS should provide TrustCaFile")
+					return
+				}
+				pool.AppendCertsFromPEM(data)
+				app.Server.TLSConfig = &tls.Config{
+					ClientCAs:  pool,
+					ClientAuth: BConfig.Listen.ClientAuth,
+				}
+			}
+			if err := app.Server.ListenAndServeTLS(BConfig.Listen.HTTPSCertFile, BConfig.Listen.HTTPSKeyFile); err != nil {
+				logs.Critical("ListenAndServeTLS: ", err)
+				time.Sleep(100 * time.Microsecond)
+				endRunning <- true
+			}
+		}()
+
+	}
+	if BConfig.Listen.EnableHTTP {
+		go func() {
+			app.Server.Addr = addr
+			logs.Info("http server Running on http://%s", app.Server.Addr)
+			if BConfig.Listen.ListenTCP4 {
+				ln, err := net.Listen("tcp4", app.Server.Addr)
+				if err != nil {
+					logs.Critical("ListenAndServe: ", err)
+					time.Sleep(100 * time.Microsecond)
+					endRunning <- true
+					return
+				}
+				if err = app.Server.Serve(ln); err != nil {
+					logs.Critical("ListenAndServe: ", err)
+					time.Sleep(100 * time.Microsecond)
+					endRunning <- true
+					return
+				}
+			} else {
+				if err := app.Server.ListenAndServe(); err != nil {
+					logs.Critical("ListenAndServe: ", err)
+					time.Sleep(100 * time.Microsecond)
+					endRunning <- true
+				}
+			}
+		}()
+	}
+	<-endRunning
+}
+
+// Router adds a patterned controller handler to BeeApp.
+// it's an alias method of App.Router.
+// usage:
+//  simple router
+//  beego.Router("/admin", &admin.UserController{})
+//  beego.Router("/admin/index", &admin.ArticleController{})
+//
+//  regex router
+//
+//  beego.Router("/api/:id([0-9]+)", &controllers.RController{})
+//
+//  custom rules
+//  beego.Router("/api/list",&RestController{},"*:ListFood")
+//  beego.Router("/api/create",&RestController{},"post:CreateFood")
+//  beego.Router("/api/update",&RestController{},"put:UpdateFood")
+//  beego.Router("/api/delete",&RestController{},"delete:DeleteFood")
+func Router(rootpath string, c ControllerInterface, mappingMethods ...string) *App {
+	BeeApp.Handlers.Add(rootpath, c, mappingMethods...)
+	return BeeApp
+}
+
+// UnregisterFixedRoute unregisters the route with the specified fixedRoute. It is particularly useful
+// in web applications that inherit most routes from a base webapp via the underscore
+// import, and aim to overwrite only certain paths.
+// The method parameter can be empty or "*" for all HTTP methods, or a particular
+// method type (e.g. "GET" or "POST") for selective removal.
+//
+// Usage (replace "GET" with "*" for all methods):
+//  beego.UnregisterFixedRoute("/yourpreviouspath", "GET")
+//  beego.Router("/yourpreviouspath", yourControllerAddress, "get:GetNewPage")
+func UnregisterFixedRoute(fixedRoute string, method string) *App {
+	subPaths := splitPath(fixedRoute)
+	if method == "" || method == "*" {
+		for m := range HTTPMETHOD {
+			if _, ok := BeeApp.Handlers.routers[m]; !ok {
+				continue
+			}
+			if BeeApp.Handlers.routers[m].prefix == strings.Trim(fixedRoute, "/ ") {
+				findAndRemoveSingleTree(BeeApp.Handlers.routers[m])
+				continue
+			}
+			findAndRemoveTree(subPaths, BeeApp.Handlers.routers[m], m)
+		}
+		return BeeApp
+	}
+	// Single HTTP method
+	um := strings.ToUpper(method)
+	if _, ok := BeeApp.Handlers.routers[um]; ok {
+		if BeeApp.Handlers.routers[um].prefix == strings.Trim(fixedRoute, "/ ") {
+			findAndRemoveSingleTree(BeeApp.Handlers.routers[um])
+			return BeeApp
+		}
+		findAndRemoveTree(subPaths, BeeApp.Handlers.routers[um], um)
+	}
+	return BeeApp
+}
+
+func findAndRemoveTree(paths []string, entryPointTree *Tree, method string) {
+	for i := range entryPointTree.fixrouters {
+		if entryPointTree.fixrouters[i].prefix == paths[0] {
+			if len(paths) == 1 {
+				if len(entryPointTree.fixrouters[i].fixrouters) > 0 {
+					// If the route had children subtrees, remove just the functional leaf,
+					// to allow children to function as before
+					if len(entryPointTree.fixrouters[i].leaves) > 0 {
+						entryPointTree.fixrouters[i].leaves[0] = nil
+						entryPointTree.fixrouters[i].leaves = entryPointTree.fixrouters[i].leaves[1:]
+					}
+				} else {
+					// Remove the *Tree from the fixrouters slice
+					entryPointTree.fixrouters[i] = nil
+
+					if i == len(entryPointTree.fixrouters)-1 {
+						entryPointTree.fixrouters = entryPointTree.fixrouters[:i]
+					} else {
+						entryPointTree.fixrouters = append(entryPointTree.fixrouters[:i], entryPointTree.fixrouters[i+1:len(entryPointTree.fixrouters)]...)
+					}
+				}
+				return
+			}
+			findAndRemoveTree(paths[1:], entryPointTree.fixrouters[i], method)
+		}
+	}
+}
+
+func findAndRemoveSingleTree(entryPointTree *Tree) {
+	if entryPointTree == nil {
+		return
+	}
+	if len(entryPointTree.fixrouters) > 0 {
+		// If the route had children subtrees, remove just the functional leaf,
+		// to allow children to function as before
+		if len(entryPointTree.leaves) > 0 {
+			entryPointTree.leaves[0] = nil
+			entryPointTree.leaves = entryPointTree.leaves[1:]
+		}
+	}
+}
+
+// Include will generate router file in the router/xxx.go from the controller's comments
+// usage:
+// beego.Include(&BankAccount{}, &OrderController{},&RefundController{},&ReceiptController{})
+// type BankAccount struct{
+//   beego.Controller
+// }
+//
+// register the function
+// func (b *BankAccount)Mapping(){
+//  b.Mapping("ShowAccount" , b.ShowAccount)
+//  b.Mapping("ModifyAccount", b.ModifyAccount)
+//}
+//
+// //@router /account/:id  [get]
+// func (b *BankAccount) ShowAccount(){
+//    //logic
+// }
+//
+//
+// //@router /account/:id  [post]
+// func (b *BankAccount) ModifyAccount(){
+//    //logic
+// }
+//
+// the comments @router url methodlist
+// url support all the function Router's pattern
+// methodlist [get post head put delete options *]
+func Include(cList ...ControllerInterface) *App {
+	BeeApp.Handlers.Include(cList...)
+	return BeeApp
+}
+
+// RESTRouter adds a restful controller handler to BeeApp.
+// its' controller implements beego.ControllerInterface and
+// defines a param "pattern/:objectId" to visit each resource.
+func RESTRouter(rootpath string, c ControllerInterface) *App {
+	Router(rootpath, c)
+	Router(path.Join(rootpath, ":objectId"), c)
+	return BeeApp
+}
+
+// AutoRouter adds defined controller handler to BeeApp.
+// it's same to App.AutoRouter.
+// if beego.AddAuto(&MainContorlller{}) and MainController has methods List and Page,
+// visit the url /main/list to exec List function or /main/page to exec Page function.
+func AutoRouter(c ControllerInterface) *App {
+	BeeApp.Handlers.AddAuto(c)
+	return BeeApp
+}
+
+// AutoPrefix adds controller handler to BeeApp with prefix.
+// it's same to App.AutoRouterWithPrefix.
+// if beego.AutoPrefix("/admin",&MainContorlller{}) and MainController has methods List and Page,
+// visit the url /admin/main/list to exec List function or /admin/main/page to exec Page function.
+func AutoPrefix(prefix string, c ControllerInterface) *App {
+	BeeApp.Handlers.AddAutoPrefix(prefix, c)
+	return BeeApp
+}
+
+// Get used to register router for Get method
+// usage:
+//    beego.Get("/", func(ctx *context.Context){
+//          ctx.Output.Body("hello world")
+//    })
+func Get(rootpath string, f FilterFunc) *App {
+	BeeApp.Handlers.Get(rootpath, f)
+	return BeeApp
+}
+
+// Post used to register router for Post method
+// usage:
+//    beego.Post("/api", func(ctx *context.Context){
+//          ctx.Output.Body("hello world")
+//    })
+func Post(rootpath string, f FilterFunc) *App {
+	BeeApp.Handlers.Post(rootpath, f)
+	return BeeApp
+}
+
+// Delete used to register router for Delete method
+// usage:
+//    beego.Delete("/api", func(ctx *context.Context){
+//          ctx.Output.Body("hello world")
+//    })
+func Delete(rootpath string, f FilterFunc) *App {
+	BeeApp.Handlers.Delete(rootpath, f)
+	return BeeApp
+}
+
+// Put used to register router for Put method
+// usage:
+//    beego.Put("/api", func(ctx *context.Context){
+//          ctx.Output.Body("hello world")
+//    })
+func Put(rootpath string, f FilterFunc) *App {
+	BeeApp.Handlers.Put(rootpath, f)
+	return BeeApp
+}
+
+// Head used to register router for Head method
+// usage:
+//    beego.Head("/api", func(ctx *context.Context){
+//          ctx.Output.Body("hello world")
+//    })
+func Head(rootpath string, f FilterFunc) *App {
+	BeeApp.Handlers.Head(rootpath, f)
+	return BeeApp
+}
+
+// Options used to register router for Options method
+// usage:
+//    beego.Options("/api", func(ctx *context.Context){
+//          ctx.Output.Body("hello world")
+//    })
+func Options(rootpath string, f FilterFunc) *App {
+	BeeApp.Handlers.Options(rootpath, f)
+	return BeeApp
+}
+
+// Patch used to register router for Patch method
+// usage:
+//    beego.Patch("/api", func(ctx *context.Context){
+//          ctx.Output.Body("hello world")
+//    })
+func Patch(rootpath string, f FilterFunc) *App {
+	BeeApp.Handlers.Patch(rootpath, f)
+	return BeeApp
+}
+
+// Any used to register router for all methods
+// usage:
+//    beego.Any("/api", func(ctx *context.Context){
+//          ctx.Output.Body("hello world")
+//    })
+func Any(rootpath string, f FilterFunc) *App {
+	BeeApp.Handlers.Any(rootpath, f)
+	return BeeApp
+}
+
+// Handler used to register a Handler router
+// usage:
+//    beego.Handler("/api", http.HandlerFunc(func (w http.ResponseWriter, r *http.Request) {
+//          fmt.Fprintf(w, "Hello, %q", html.EscapeString(r.URL.Path))
+//    }))
+func Handler(rootpath string, h http.Handler, options ...interface{}) *App {
+	BeeApp.Handlers.Handler(rootpath, h, options...)
+	return BeeApp
+}
+
+// InsertFilter adds a FilterFunc with pattern condition and action constant.
+// The pos means action constant including
+// beego.BeforeStatic, beego.BeforeRouter, beego.BeforeExec, beego.AfterExec and beego.FinishRouter.
+// The bool params is for setting the returnOnOutput value (false allows multiple filters to execute)
+func InsertFilter(pattern string, pos int, filter FilterFunc, params ...bool) *App {
+	BeeApp.Handlers.InsertFilter(pattern, pos, filter, params...)
+	return BeeApp
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/beego.go

@@ -0,0 +1,123 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+const (
+	// VERSION represent beego web framework version.
+	VERSION = "1.12.3"
+
+	// DEV is for develop
+	DEV = "dev"
+	// PROD is for production
+	PROD = "prod"
+)
+
+// M is Map shortcut
+type M map[string]interface{}
+
+// Hook function to run
+type hookfunc func() error
+
+var (
+	hooks = make([]hookfunc, 0) //hook function slice to store the hookfunc
+)
+
+// AddAPPStartHook is used to register the hookfunc
+// The hookfuncs will run in beego.Run()
+// such as initiating session , starting middleware , building template, starting admin control and so on.
+func AddAPPStartHook(hf ...hookfunc) {
+	hooks = append(hooks, hf...)
+}
+
+// Run beego application.
+// beego.Run() default run on HttpPort
+// beego.Run("localhost")
+// beego.Run(":8089")
+// beego.Run("127.0.0.1:8089")
+func Run(params ...string) {
+
+	initBeforeHTTPRun()
+
+	if len(params) > 0 && params[0] != "" {
+		strs := strings.Split(params[0], ":")
+		if len(strs) > 0 && strs[0] != "" {
+			BConfig.Listen.HTTPAddr = strs[0]
+		}
+		if len(strs) > 1 && strs[1] != "" {
+			BConfig.Listen.HTTPPort, _ = strconv.Atoi(strs[1])
+		}
+
+		BConfig.Listen.Domains = params
+	}
+
+	BeeApp.Run()
+}
+
+// RunWithMiddleWares Run beego application with middlewares.
+func RunWithMiddleWares(addr string, mws ...MiddleWare) {
+	initBeforeHTTPRun()
+
+	strs := strings.Split(addr, ":")
+	if len(strs) > 0 && strs[0] != "" {
+		BConfig.Listen.HTTPAddr = strs[0]
+		BConfig.Listen.Domains = []string{strs[0]}
+	}
+	if len(strs) > 1 && strs[1] != "" {
+		BConfig.Listen.HTTPPort, _ = strconv.Atoi(strs[1])
+	}
+
+	BeeApp.Run(mws...)
+}
+
+func initBeforeHTTPRun() {
+	//init hooks
+	AddAPPStartHook(
+		registerMime,
+		registerDefaultErrorHandler,
+		registerSession,
+		registerTemplate,
+		registerAdmin,
+		registerGzip,
+	)
+
+	for _, hk := range hooks {
+		if err := hk(); err != nil {
+			panic(err)
+		}
+	}
+}
+
+// TestBeegoInit is for test package init
+func TestBeegoInit(ap string) {
+	path := filepath.Join(ap, "conf", "app.conf")
+	os.Chdir(ap)
+	InitBeegoBeforeTest(path)
+}
+
+// InitBeegoBeforeTest is for test package init
+func InitBeegoBeforeTest(appConfigPath string) {
+	if err := LoadAppConfig(appConfigProvider, appConfigPath); err != nil {
+		panic(err)
+	}
+	BConfig.RunMode = "test"
+	initBeforeHTTPRun()
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/build_info.go

@@ -0,0 +1,27 @@
+// Copyright 2020 astaxie
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+var (
+	BuildVersion     string
+	BuildGitRevision string
+	BuildStatus      string
+	BuildTag         string
+	BuildTime        string
+
+	GoVersion string
+
+	GitBranch string
+)

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/config.go

@@ -0,0 +1,533 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"strings"
+
+	"github.com/astaxie/beego/config"
+	"github.com/astaxie/beego/context"
+	"github.com/astaxie/beego/logs"
+	"github.com/astaxie/beego/session"
+	"github.com/astaxie/beego/utils"
+)
+
+// Config is the main struct for BConfig
+type Config struct {
+	AppName             string //Application name
+	RunMode             string //Running Mode: dev | prod
+	RouterCaseSensitive bool
+	ServerName          string
+	RecoverPanic        bool
+	RecoverFunc         func(*context.Context)
+	CopyRequestBody     bool
+	EnableGzip          bool
+	MaxMemory           int64
+	EnableErrorsShow    bool
+	EnableErrorsRender  bool
+	Listen              Listen
+	WebConfig           WebConfig
+	Log                 LogConfig
+}
+
+// Listen holds for http and https related config
+type Listen struct {
+	Graceful          bool // Graceful means use graceful module to start the server
+	ServerTimeOut     int64
+	ListenTCP4        bool
+	EnableHTTP        bool
+	HTTPAddr          string
+	HTTPPort          int
+	AutoTLS           bool
+	Domains           []string
+	TLSCacheDir       string
+	EnableHTTPS       bool
+	EnableMutualHTTPS bool
+	HTTPSAddr         string
+	HTTPSPort         int
+	HTTPSCertFile     string
+	HTTPSKeyFile      string
+	TrustCaFile       string
+	ClientAuth        tls.ClientAuthType
+	EnableAdmin       bool
+	AdminAddr         string
+	AdminPort         int
+	EnableFcgi        bool
+	EnableStdIo       bool // EnableStdIo works with EnableFcgi Use FCGI via standard I/O
+}
+
+// WebConfig holds web related config
+type WebConfig struct {
+	AutoRender             bool
+	EnableDocs             bool
+	FlashName              string
+	FlashSeparator         string
+	DirectoryIndex         bool
+	StaticDir              map[string]string
+	StaticExtensionsToGzip []string
+	StaticCacheFileSize    int
+	StaticCacheFileNum     int
+	TemplateLeft           string
+	TemplateRight          string
+	ViewsPath              string
+	EnableXSRF             bool
+	XSRFKey                string
+	XSRFExpire             int
+	Session                SessionConfig
+}
+
+// SessionConfig holds session related config
+type SessionConfig struct {
+	SessionOn                    bool
+	SessionProvider              string
+	SessionName                  string
+	SessionGCMaxLifetime         int64
+	SessionProviderConfig        string
+	SessionCookieLifeTime        int
+	SessionAutoSetCookie         bool
+	SessionDomain                string
+	SessionDisableHTTPOnly       bool // used to allow for cross domain cookies/javascript cookies.
+	SessionEnableSidInHTTPHeader bool // enable store/get the sessionId into/from http headers
+	SessionNameInHTTPHeader      string
+	SessionEnableSidInURLQuery   bool // enable get the sessionId from Url Query params
+	SessionCookieSameSite        http.SameSite
+}
+
+// LogConfig holds Log related config
+type LogConfig struct {
+	AccessLogs       bool
+	EnableStaticLogs bool   //log static files requests default: false
+	AccessLogsFormat string //access log format: JSON_FORMAT, APACHE_FORMAT or empty string
+	FileLineNum      bool
+	Outputs          map[string]string // Store Adaptor : config
+}
+
+var (
+	// BConfig is the default config for Application
+	BConfig *Config
+	// AppConfig is the instance of Config, store the config information from file
+	AppConfig *beegoAppConfig
+	// AppPath is the absolute path to the app
+	AppPath string
+	// GlobalSessions is the instance for the session manager
+	GlobalSessions *session.Manager
+
+	// appConfigPath is the path to the config files
+	appConfigPath string
+	// appConfigProvider is the provider for the config, default is ini
+	appConfigProvider = "ini"
+	// WorkPath is the absolute path to project root directory
+	WorkPath string
+)
+
+func init() {
+	BConfig = newBConfig()
+	var err error
+	if AppPath, err = filepath.Abs(filepath.Dir(os.Args[0])); err != nil {
+		panic(err)
+	}
+	WorkPath, err = os.Getwd()
+	if err != nil {
+		panic(err)
+	}
+	var filename = "app.conf"
+	if os.Getenv("BEEGO_RUNMODE") != "" {
+		filename = os.Getenv("BEEGO_RUNMODE") + ".app.conf"
+	}
+	appConfigPath = filepath.Join(WorkPath, "conf", filename)
+	if configPath := os.Getenv("BEEGO_CONFIG_PATH"); configPath != "" {
+		appConfigPath = configPath
+	}
+	if !utils.FileExists(appConfigPath) {
+		appConfigPath = filepath.Join(AppPath, "conf", filename)
+		if !utils.FileExists(appConfigPath) {
+			AppConfig = &beegoAppConfig{innerConfig: config.NewFakeConfig()}
+			return
+		}
+	}
+	if err = parseConfig(appConfigPath); err != nil {
+		panic(err)
+	}
+}
+
+func recoverPanic(ctx *context.Context) {
+	if err := recover(); err != nil {
+		if err == ErrAbort {
+			return
+		}
+		if !BConfig.RecoverPanic {
+			panic(err)
+		}
+		if BConfig.EnableErrorsShow {
+			if _, ok := ErrorMaps[fmt.Sprint(err)]; ok {
+				exception(fmt.Sprint(err), ctx)
+				return
+			}
+		}
+		var stack string
+		logs.Critical("the request url is ", ctx.Input.URL())
+		logs.Critical("Handler crashed with error", err)
+		for i := 1; ; i++ {
+			_, file, line, ok := runtime.Caller(i)
+			if !ok {
+				break
+			}
+			logs.Critical(fmt.Sprintf("%s:%d", file, line))
+			stack = stack + fmt.Sprintln(fmt.Sprintf("%s:%d", file, line))
+		}
+		if BConfig.RunMode == DEV && BConfig.EnableErrorsRender {
+			showErr(err, ctx, stack)
+		}
+		if ctx.Output.Status != 0 {
+			ctx.ResponseWriter.WriteHeader(ctx.Output.Status)
+		} else {
+			ctx.ResponseWriter.WriteHeader(500)
+		}
+	}
+}
+
+func newBConfig() *Config {
+	return &Config{
+		AppName:             "beego",
+		RunMode:             PROD,
+		RouterCaseSensitive: true,
+		ServerName:          "beegoServer:" + VERSION,
+		RecoverPanic:        true,
+		RecoverFunc:         recoverPanic,
+		CopyRequestBody:     false,
+		EnableGzip:          false,
+		MaxMemory:           1 << 26, //64MB
+		EnableErrorsShow:    true,
+		EnableErrorsRender:  true,
+		Listen: Listen{
+			Graceful:      false,
+			ServerTimeOut: 0,
+			ListenTCP4:    false,
+			EnableHTTP:    true,
+			AutoTLS:       false,
+			Domains:       []string{},
+			TLSCacheDir:   ".",
+			HTTPAddr:      "",
+			HTTPPort:      8080,
+			EnableHTTPS:   false,
+			HTTPSAddr:     "",
+			HTTPSPort:     10443,
+			HTTPSCertFile: "",
+			HTTPSKeyFile:  "",
+			EnableAdmin:   false,
+			AdminAddr:     "",
+			AdminPort:     8088,
+			EnableFcgi:    false,
+			EnableStdIo:   false,
+			ClientAuth:    tls.RequireAndVerifyClientCert,
+		},
+		WebConfig: WebConfig{
+			AutoRender:             true,
+			EnableDocs:             false,
+			FlashName:              "BEEGO_FLASH",
+			FlashSeparator:         "BEEGOFLASH",
+			DirectoryIndex:         false,
+			StaticDir:              map[string]string{"/static": "static"},
+			StaticExtensionsToGzip: []string{".css", ".js"},
+			StaticCacheFileSize:    1024 * 100,
+			StaticCacheFileNum:     1000,
+			TemplateLeft:           "{{",
+			TemplateRight:          "}}",
+			ViewsPath:              "views",
+			EnableXSRF:             false,
+			XSRFKey:                "beegoxsrf",
+			XSRFExpire:             0,
+			Session: SessionConfig{
+				SessionOn:                    false,
+				SessionProvider:              "memory",
+				SessionName:                  "beegosessionID",
+				SessionGCMaxLifetime:         3600,
+				SessionProviderConfig:        "",
+				SessionDisableHTTPOnly:       false,
+				SessionCookieLifeTime:        0, //set cookie default is the browser life
+				SessionAutoSetCookie:         true,
+				SessionDomain:                "",
+				SessionEnableSidInHTTPHeader: false, // enable store/get the sessionId into/from http headers
+				SessionNameInHTTPHeader:      "Beegosessionid",
+				SessionEnableSidInURLQuery:   false, // enable get the sessionId from Url Query params
+				SessionCookieSameSite:        http.SameSiteDefaultMode,
+			},
+		},
+		Log: LogConfig{
+			AccessLogs:       false,
+			EnableStaticLogs: false,
+			AccessLogsFormat: "APACHE_FORMAT",
+			FileLineNum:      true,
+			Outputs:          map[string]string{"console": ""},
+		},
+	}
+}
+
+// now only support ini, next will support json.
+func parseConfig(appConfigPath string) (err error) {
+	AppConfig, err = newAppConfig(appConfigProvider, appConfigPath)
+	if err != nil {
+		return err
+	}
+	return assignConfig(AppConfig)
+}
+
+func assignConfig(ac config.Configer) error {
+	for _, i := range []interface{}{BConfig, &BConfig.Listen, &BConfig.WebConfig, &BConfig.Log, &BConfig.WebConfig.Session} {
+		assignSingleConfig(i, ac)
+	}
+	// set the run mode first
+	if envRunMode := os.Getenv("BEEGO_RUNMODE"); envRunMode != "" {
+		BConfig.RunMode = envRunMode
+	} else if runMode := ac.String("RunMode"); runMode != "" {
+		BConfig.RunMode = runMode
+	}
+
+	if sd := ac.String("StaticDir"); sd != "" {
+		BConfig.WebConfig.StaticDir = map[string]string{}
+		sds := strings.Fields(sd)
+		for _, v := range sds {
+			if url2fsmap := strings.SplitN(v, ":", 2); len(url2fsmap) == 2 {
+				BConfig.WebConfig.StaticDir["/"+strings.Trim(url2fsmap[0], "/")] = url2fsmap[1]
+			} else {
+				BConfig.WebConfig.StaticDir["/"+strings.Trim(url2fsmap[0], "/")] = url2fsmap[0]
+			}
+		}
+	}
+
+	if sgz := ac.String("StaticExtensionsToGzip"); sgz != "" {
+		extensions := strings.Split(sgz, ",")
+		fileExts := []string{}
+		for _, ext := range extensions {
+			ext = strings.TrimSpace(ext)
+			if ext == "" {
+				continue
+			}
+			if !strings.HasPrefix(ext, ".") {
+				ext = "." + ext
+			}
+			fileExts = append(fileExts, ext)
+		}
+		if len(fileExts) > 0 {
+			BConfig.WebConfig.StaticExtensionsToGzip = fileExts
+		}
+	}
+
+	if sfs, err := ac.Int("StaticCacheFileSize"); err == nil {
+		BConfig.WebConfig.StaticCacheFileSize = sfs
+	}
+
+	if sfn, err := ac.Int("StaticCacheFileNum"); err == nil {
+		BConfig.WebConfig.StaticCacheFileNum = sfn
+	}
+
+	if lo := ac.String("LogOutputs"); lo != "" {
+		// if lo is not nil or empty
+		// means user has set his own LogOutputs
+		// clear the default setting to BConfig.Log.Outputs
+		BConfig.Log.Outputs = make(map[string]string)
+		los := strings.Split(lo, ";")
+		for _, v := range los {
+			if logType2Config := strings.SplitN(v, ",", 2); len(logType2Config) == 2 {
+				BConfig.Log.Outputs[logType2Config[0]] = logType2Config[1]
+			} else {
+				continue
+			}
+		}
+	}
+
+	//init log
+	logs.Reset()
+	for adaptor, config := range BConfig.Log.Outputs {
+		err := logs.SetLogger(adaptor, config)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, fmt.Sprintf("%s with the config %q got err:%s", adaptor, config, err.Error()))
+		}
+	}
+	logs.SetLogFuncCall(BConfig.Log.FileLineNum)
+
+	return nil
+}
+
+func assignSingleConfig(p interface{}, ac config.Configer) {
+	pt := reflect.TypeOf(p)
+	if pt.Kind() != reflect.Ptr {
+		return
+	}
+	pt = pt.Elem()
+	if pt.Kind() != reflect.Struct {
+		return
+	}
+	pv := reflect.ValueOf(p).Elem()
+
+	for i := 0; i < pt.NumField(); i++ {
+		pf := pv.Field(i)
+		if !pf.CanSet() {
+			continue
+		}
+		name := pt.Field(i).Name
+		switch pf.Kind() {
+		case reflect.String:
+			pf.SetString(ac.DefaultString(name, pf.String()))
+		case reflect.Int, reflect.Int64:
+			pf.SetInt(ac.DefaultInt64(name, pf.Int()))
+		case reflect.Bool:
+			pf.SetBool(ac.DefaultBool(name, pf.Bool()))
+		case reflect.Struct:
+		default:
+			//do nothing here
+		}
+	}
+
+}
+
+// LoadAppConfig allow developer to apply a config file
+func LoadAppConfig(adapterName, configPath string) error {
+	absConfigPath, err := filepath.Abs(configPath)
+	if err != nil {
+		return err
+	}
+
+	if !utils.FileExists(absConfigPath) {
+		return fmt.Errorf("the target config file: %s don't exist", configPath)
+	}
+
+	appConfigPath = absConfigPath
+	appConfigProvider = adapterName
+
+	return parseConfig(appConfigPath)
+}
+
+type beegoAppConfig struct {
+	innerConfig config.Configer
+}
+
+func newAppConfig(appConfigProvider, appConfigPath string) (*beegoAppConfig, error) {
+	ac, err := config.NewConfig(appConfigProvider, appConfigPath)
+	if err != nil {
+		return nil, err
+	}
+	return &beegoAppConfig{ac}, nil
+}
+
+func (b *beegoAppConfig) Set(key, val string) error {
+	if err := b.innerConfig.Set(BConfig.RunMode+"::"+key, val); err != nil {
+		return b.innerConfig.Set(key, val)
+	}
+	return nil
+}
+
+func (b *beegoAppConfig) String(key string) string {
+	if v := b.innerConfig.String(BConfig.RunMode + "::" + key); v != "" {
+		return v
+	}
+	return b.innerConfig.String(key)
+}
+
+func (b *beegoAppConfig) Strings(key string) []string {
+	if v := b.innerConfig.Strings(BConfig.RunMode + "::" + key); len(v) > 0 {
+		return v
+	}
+	return b.innerConfig.Strings(key)
+}
+
+func (b *beegoAppConfig) Int(key string) (int, error) {
+	if v, err := b.innerConfig.Int(BConfig.RunMode + "::" + key); err == nil {
+		return v, nil
+	}
+	return b.innerConfig.Int(key)
+}
+
+func (b *beegoAppConfig) Int64(key string) (int64, error) {
+	if v, err := b.innerConfig.Int64(BConfig.RunMode + "::" + key); err == nil {
+		return v, nil
+	}
+	return b.innerConfig.Int64(key)
+}
+
+func (b *beegoAppConfig) Bool(key string) (bool, error) {
+	if v, err := b.innerConfig.Bool(BConfig.RunMode + "::" + key); err == nil {
+		return v, nil
+	}
+	return b.innerConfig.Bool(key)
+}
+
+func (b *beegoAppConfig) Float(key string) (float64, error) {
+	if v, err := b.innerConfig.Float(BConfig.RunMode + "::" + key); err == nil {
+		return v, nil
+	}
+	return b.innerConfig.Float(key)
+}
+
+func (b *beegoAppConfig) DefaultString(key string, defaultVal string) string {
+	if v := b.String(key); v != "" {
+		return v
+	}
+	return defaultVal
+}
+
+func (b *beegoAppConfig) DefaultStrings(key string, defaultVal []string) []string {
+	if v := b.Strings(key); len(v) != 0 {
+		return v
+	}
+	return defaultVal
+}
+
+func (b *beegoAppConfig) DefaultInt(key string, defaultVal int) int {
+	if v, err := b.Int(key); err == nil {
+		return v
+	}
+	return defaultVal
+}
+
+func (b *beegoAppConfig) DefaultInt64(key string, defaultVal int64) int64 {
+	if v, err := b.Int64(key); err == nil {
+		return v
+	}
+	return defaultVal
+}
+
+func (b *beegoAppConfig) DefaultBool(key string, defaultVal bool) bool {
+	if v, err := b.Bool(key); err == nil {
+		return v
+	}
+	return defaultVal
+}
+
+func (b *beegoAppConfig) DefaultFloat(key string, defaultVal float64) float64 {
+	if v, err := b.Float(key); err == nil {
+		return v
+	}
+	return defaultVal
+}
+
+func (b *beegoAppConfig) DIY(key string) (interface{}, error) {
+	return b.innerConfig.DIY(key)
+}
+
+func (b *beegoAppConfig) GetSection(section string) (map[string]string, error) {
+	return b.innerConfig.GetSection(section)
+}
+
+func (b *beegoAppConfig) SaveConfigFile(filename string) error {
+	return b.innerConfig.SaveConfigFile(filename)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/config/config.go

@@ -0,0 +1,242 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package config is used to parse config.
+// Usage:
+//  import "github.com/astaxie/beego/config"
+//Examples.
+//
+//  cnf, err := config.NewConfig("ini", "config.conf")
+//
+//  cnf APIS:
+//
+//  cnf.Set(key, val string) error
+//  cnf.String(key string) string
+//  cnf.Strings(key string) []string
+//  cnf.Int(key string) (int, error)
+//  cnf.Int64(key string) (int64, error)
+//  cnf.Bool(key string) (bool, error)
+//  cnf.Float(key string) (float64, error)
+//  cnf.DefaultString(key string, defaultVal string) string
+//  cnf.DefaultStrings(key string, defaultVal []string) []string
+//  cnf.DefaultInt(key string, defaultVal int) int
+//  cnf.DefaultInt64(key string, defaultVal int64) int64
+//  cnf.DefaultBool(key string, defaultVal bool) bool
+//  cnf.DefaultFloat(key string, defaultVal float64) float64
+//  cnf.DIY(key string) (interface{}, error)
+//  cnf.GetSection(section string) (map[string]string, error)
+//  cnf.SaveConfigFile(filename string) error
+//More docs http://beego.me/docs/module/config.md
+package config
+
+import (
+	"fmt"
+	"os"
+	"reflect"
+	"time"
+)
+
+// Configer defines how to get and set value from configuration raw data.
+type Configer interface {
+	Set(key, val string) error   //support section::key type in given key when using ini type.
+	String(key string) string    //support section::key type in key string when using ini and json type; Int,Int64,Bool,Float,DIY are same.
+	Strings(key string) []string //get string slice
+	Int(key string) (int, error)
+	Int64(key string) (int64, error)
+	Bool(key string) (bool, error)
+	Float(key string) (float64, error)
+	DefaultString(key string, defaultVal string) string      // support section::key type in key string when using ini and json type; Int,Int64,Bool,Float,DIY are same.
+	DefaultStrings(key string, defaultVal []string) []string //get string slice
+	DefaultInt(key string, defaultVal int) int
+	DefaultInt64(key string, defaultVal int64) int64
+	DefaultBool(key string, defaultVal bool) bool
+	DefaultFloat(key string, defaultVal float64) float64
+	DIY(key string) (interface{}, error)
+	GetSection(section string) (map[string]string, error)
+	SaveConfigFile(filename string) error
+}
+
+// Config is the adapter interface for parsing config file to get raw data to Configer.
+type Config interface {
+	Parse(key string) (Configer, error)
+	ParseData(data []byte) (Configer, error)
+}
+
+var adapters = make(map[string]Config)
+
+// Register makes a config adapter available by the adapter name.
+// If Register is called twice with the same name or if driver is nil,
+// it panics.
+func Register(name string, adapter Config) {
+	if adapter == nil {
+		panic("config: Register adapter is nil")
+	}
+	if _, ok := adapters[name]; ok {
+		panic("config: Register called twice for adapter " + name)
+	}
+	adapters[name] = adapter
+}
+
+// NewConfig adapterName is ini/json/xml/yaml.
+// filename is the config file path.
+func NewConfig(adapterName, filename string) (Configer, error) {
+	adapter, ok := adapters[adapterName]
+	if !ok {
+		return nil, fmt.Errorf("config: unknown adaptername %q (forgotten import?)", adapterName)
+	}
+	return adapter.Parse(filename)
+}
+
+// NewConfigData adapterName is ini/json/xml/yaml.
+// data is the config data.
+func NewConfigData(adapterName string, data []byte) (Configer, error) {
+	adapter, ok := adapters[adapterName]
+	if !ok {
+		return nil, fmt.Errorf("config: unknown adaptername %q (forgotten import?)", adapterName)
+	}
+	return adapter.ParseData(data)
+}
+
+// ExpandValueEnvForMap convert all string value with environment variable.
+func ExpandValueEnvForMap(m map[string]interface{}) map[string]interface{} {
+	for k, v := range m {
+		switch value := v.(type) {
+		case string:
+			m[k] = ExpandValueEnv(value)
+		case map[string]interface{}:
+			m[k] = ExpandValueEnvForMap(value)
+		case map[string]string:
+			for k2, v2 := range value {
+				value[k2] = ExpandValueEnv(v2)
+			}
+			m[k] = value
+		}
+	}
+	return m
+}
+
+// ExpandValueEnv returns value of convert with environment variable.
+//
+// Return environment variable if value start with "${" and end with "}".
+// Return default value if environment variable is empty or not exist.
+//
+// It accept value formats "${env}" , "${env||}}" , "${env||defaultValue}" , "defaultvalue".
+// Examples:
+//	v1 := config.ExpandValueEnv("${GOPATH}")			// return the GOPATH environment variable.
+//	v2 := config.ExpandValueEnv("${GOAsta||/usr/local/go}")	// return the default value "/usr/local/go/".
+//	v3 := config.ExpandValueEnv("Astaxie")				// return the value "Astaxie".
+func ExpandValueEnv(value string) (realValue string) {
+	realValue = value
+
+	vLen := len(value)
+	// 3 = ${}
+	if vLen < 3 {
+		return
+	}
+	// Need start with "${" and end with "}", then return.
+	if value[0] != '$' || value[1] != '{' || value[vLen-1] != '}' {
+		return
+	}
+
+	key := ""
+	defaultV := ""
+	// value start with "${"
+	for i := 2; i < vLen; i++ {
+		if value[i] == '|' && (i+1 < vLen && value[i+1] == '|') {
+			key = value[2:i]
+			defaultV = value[i+2 : vLen-1] // other string is default value.
+			break
+		} else if value[i] == '}' {
+			key = value[2:i]
+			break
+		}
+	}
+
+	realValue = os.Getenv(key)
+	if realValue == "" {
+		realValue = defaultV
+	}
+
+	return
+}
+
+// ParseBool returns the boolean value represented by the string.
+//
+// It accepts 1, 1.0, t, T, TRUE, true, True, YES, yes, Yes,Y, y, ON, on, On,
+// 0, 0.0, f, F, FALSE, false, False, NO, no, No, N,n, OFF, off, Off.
+// Any other value returns an error.
+func ParseBool(val interface{}) (value bool, err error) {
+	if val != nil {
+		switch v := val.(type) {
+		case bool:
+			return v, nil
+		case string:
+			switch v {
+			case "1", "t", "T", "true", "TRUE", "True", "YES", "yes", "Yes", "Y", "y", "ON", "on", "On":
+				return true, nil
+			case "0", "f", "F", "false", "FALSE", "False", "NO", "no", "No", "N", "n", "OFF", "off", "Off":
+				return false, nil
+			}
+		case int8, int32, int64:
+			strV := fmt.Sprintf("%d", v)
+			if strV == "1" {
+				return true, nil
+			} else if strV == "0" {
+				return false, nil
+			}
+		case float64:
+			if v == 1.0 {
+				return true, nil
+			} else if v == 0.0 {
+				return false, nil
+			}
+		}
+		return false, fmt.Errorf("parsing %q: invalid syntax", val)
+	}
+	return false, fmt.Errorf("parsing <nil>: invalid syntax")
+}
+
+// ToString converts values of any type to string.
+func ToString(x interface{}) string {
+	switch y := x.(type) {
+
+	// Handle dates with special logic
+	// This needs to come above the fmt.Stringer
+	// test since time.Time's have a .String()
+	// method
+	case time.Time:
+		return y.Format("A Monday")
+
+	// Handle type string
+	case string:
+		return y
+
+	// Handle type with .String() method
+	case fmt.Stringer:
+		return y.String()
+
+	// Handle type with .Error() method
+	case error:
+		return y.Error()
+
+	}
+
+	// Handle named string type
+	if v := reflect.ValueOf(x); v.Kind() == reflect.String {
+		return v.String()
+	}
+
+	// Fallback to fmt package for anything else like numeric types
+	return fmt.Sprint(x)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/config/fake.go

@@ -0,0 +1,134 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package config
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+)
+
+type fakeConfigContainer struct {
+	data map[string]string
+}
+
+func (c *fakeConfigContainer) getData(key string) string {
+	return c.data[strings.ToLower(key)]
+}
+
+func (c *fakeConfigContainer) Set(key, val string) error {
+	c.data[strings.ToLower(key)] = val
+	return nil
+}
+
+func (c *fakeConfigContainer) String(key string) string {
+	return c.getData(key)
+}
+
+func (c *fakeConfigContainer) DefaultString(key string, defaultval string) string {
+	v := c.String(key)
+	if v == "" {
+		return defaultval
+	}
+	return v
+}
+
+func (c *fakeConfigContainer) Strings(key string) []string {
+	v := c.String(key)
+	if v == "" {
+		return nil
+	}
+	return strings.Split(v, ";")
+}
+
+func (c *fakeConfigContainer) DefaultStrings(key string, defaultval []string) []string {
+	v := c.Strings(key)
+	if v == nil {
+		return defaultval
+	}
+	return v
+}
+
+func (c *fakeConfigContainer) Int(key string) (int, error) {
+	return strconv.Atoi(c.getData(key))
+}
+
+func (c *fakeConfigContainer) DefaultInt(key string, defaultval int) int {
+	v, err := c.Int(key)
+	if err != nil {
+		return defaultval
+	}
+	return v
+}
+
+func (c *fakeConfigContainer) Int64(key string) (int64, error) {
+	return strconv.ParseInt(c.getData(key), 10, 64)
+}
+
+func (c *fakeConfigContainer) DefaultInt64(key string, defaultval int64) int64 {
+	v, err := c.Int64(key)
+	if err != nil {
+		return defaultval
+	}
+	return v
+}
+
+func (c *fakeConfigContainer) Bool(key string) (bool, error) {
+	return ParseBool(c.getData(key))
+}
+
+func (c *fakeConfigContainer) DefaultBool(key string, defaultval bool) bool {
+	v, err := c.Bool(key)
+	if err != nil {
+		return defaultval
+	}
+	return v
+}
+
+func (c *fakeConfigContainer) Float(key string) (float64, error) {
+	return strconv.ParseFloat(c.getData(key), 64)
+}
+
+func (c *fakeConfigContainer) DefaultFloat(key string, defaultval float64) float64 {
+	v, err := c.Float(key)
+	if err != nil {
+		return defaultval
+	}
+	return v
+}
+
+func (c *fakeConfigContainer) DIY(key string) (interface{}, error) {
+	if v, ok := c.data[strings.ToLower(key)]; ok {
+		return v, nil
+	}
+	return nil, errors.New("key not find")
+}
+
+func (c *fakeConfigContainer) GetSection(section string) (map[string]string, error) {
+	return nil, errors.New("not implement in the fakeConfigContainer")
+}
+
+func (c *fakeConfigContainer) SaveConfigFile(filename string) error {
+	return errors.New("not implement in the fakeConfigContainer")
+}
+
+var _ Configer = new(fakeConfigContainer)
+
+// NewFakeConfig return a fake Configer
+func NewFakeConfig() Configer {
+	return &fakeConfigContainer{
+		data: make(map[string]string),
+	}
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/config/ini.go

@@ -0,0 +1,504 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package config
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"io"
+	"io/ioutil"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+var (
+	defaultSection = "default"   // default section means if some ini items not in a section, make them in default section,
+	bNumComment    = []byte{'#'} // number signal
+	bSemComment    = []byte{';'} // semicolon signal
+	bEmpty         = []byte{}
+	bEqual         = []byte{'='} // equal signal
+	bDQuote        = []byte{'"'} // quote signal
+	sectionStart   = []byte{'['} // section start signal
+	sectionEnd     = []byte{']'} // section end signal
+	lineBreak      = "\n"
+)
+
+// IniConfig implements Config to parse ini file.
+type IniConfig struct {
+}
+
+// Parse creates a new Config and parses the file configuration from the named file.
+func (ini *IniConfig) Parse(name string) (Configer, error) {
+	return ini.parseFile(name)
+}
+
+func (ini *IniConfig) parseFile(name string) (*IniConfigContainer, error) {
+	data, err := ioutil.ReadFile(name)
+	if err != nil {
+		return nil, err
+	}
+
+	return ini.parseData(filepath.Dir(name), data)
+}
+
+func (ini *IniConfig) parseData(dir string, data []byte) (*IniConfigContainer, error) {
+	cfg := &IniConfigContainer{
+		data:           make(map[string]map[string]string),
+		sectionComment: make(map[string]string),
+		keyComment:     make(map[string]string),
+		RWMutex:        sync.RWMutex{},
+	}
+	cfg.Lock()
+	defer cfg.Unlock()
+
+	var comment bytes.Buffer
+	buf := bufio.NewReader(bytes.NewBuffer(data))
+	// check the BOM
+	head, err := buf.Peek(3)
+	if err == nil && head[0] == 239 && head[1] == 187 && head[2] == 191 {
+		for i := 1; i <= 3; i++ {
+			buf.ReadByte()
+		}
+	}
+	section := defaultSection
+	tmpBuf := bytes.NewBuffer(nil)
+	for {
+		tmpBuf.Reset()
+
+		shouldBreak := false
+		for {
+			tmp, isPrefix, err := buf.ReadLine()
+			if err == io.EOF {
+				shouldBreak = true
+				break
+			}
+
+			//It might be a good idea to throw a error on all unknonw errors?
+			if _, ok := err.(*os.PathError); ok {
+				return nil, err
+			}
+
+			tmpBuf.Write(tmp)
+			if isPrefix {
+				continue
+			}
+
+			if !isPrefix {
+				break
+			}
+		}
+		if shouldBreak {
+			break
+		}
+
+		line := tmpBuf.Bytes()
+		line = bytes.TrimSpace(line)
+		if bytes.Equal(line, bEmpty) {
+			continue
+		}
+		var bComment []byte
+		switch {
+		case bytes.HasPrefix(line, bNumComment):
+			bComment = bNumComment
+		case bytes.HasPrefix(line, bSemComment):
+			bComment = bSemComment
+		}
+		if bComment != nil {
+			line = bytes.TrimLeft(line, string(bComment))
+			// Need append to a new line if multi-line comments.
+			if comment.Len() > 0 {
+				comment.WriteByte('\n')
+			}
+			comment.Write(line)
+			continue
+		}
+
+		if bytes.HasPrefix(line, sectionStart) && bytes.HasSuffix(line, sectionEnd) {
+			section = strings.ToLower(string(line[1 : len(line)-1])) // section name case insensitive
+			if comment.Len() > 0 {
+				cfg.sectionComment[section] = comment.String()
+				comment.Reset()
+			}
+			if _, ok := cfg.data[section]; !ok {
+				cfg.data[section] = make(map[string]string)
+			}
+			continue
+		}
+
+		if _, ok := cfg.data[section]; !ok {
+			cfg.data[section] = make(map[string]string)
+		}
+		keyValue := bytes.SplitN(line, bEqual, 2)
+
+		key := string(bytes.TrimSpace(keyValue[0])) // key name case insensitive
+		key = strings.ToLower(key)
+
+		// handle include "other.conf"
+		if len(keyValue) == 1 && strings.HasPrefix(key, "include") {
+
+			includefiles := strings.Fields(key)
+			if includefiles[0] == "include" && len(includefiles) == 2 {
+
+				otherfile := strings.Trim(includefiles[1], "\"")
+				if !filepath.IsAbs(otherfile) {
+					otherfile = filepath.Join(dir, otherfile)
+				}
+
+				i, err := ini.parseFile(otherfile)
+				if err != nil {
+					return nil, err
+				}
+
+				for sec, dt := range i.data {
+					if _, ok := cfg.data[sec]; !ok {
+						cfg.data[sec] = make(map[string]string)
+					}
+					for k, v := range dt {
+						cfg.data[sec][k] = v
+					}
+				}
+
+				for sec, comm := range i.sectionComment {
+					cfg.sectionComment[sec] = comm
+				}
+
+				for k, comm := range i.keyComment {
+					cfg.keyComment[k] = comm
+				}
+
+				continue
+			}
+		}
+
+		if len(keyValue) != 2 {
+			return nil, errors.New("read the content error: \"" + string(line) + "\", should key = val")
+		}
+		val := bytes.TrimSpace(keyValue[1])
+		if bytes.HasPrefix(val, bDQuote) {
+			val = bytes.Trim(val, `"`)
+		}
+
+		cfg.data[section][key] = ExpandValueEnv(string(val))
+		if comment.Len() > 0 {
+			cfg.keyComment[section+"."+key] = comment.String()
+			comment.Reset()
+		}
+
+	}
+	return cfg, nil
+}
+
+// ParseData parse ini the data
+// When include other.conf,other.conf is either absolute directory
+// or under beego in default temporary directory(/tmp/beego[-username]).
+func (ini *IniConfig) ParseData(data []byte) (Configer, error) {
+	dir := "beego"
+	currentUser, err := user.Current()
+	if err == nil {
+		dir = "beego-" + currentUser.Username
+	}
+	dir = filepath.Join(os.TempDir(), dir)
+	if err = os.MkdirAll(dir, os.ModePerm); err != nil {
+		return nil, err
+	}
+
+	return ini.parseData(dir, data)
+}
+
+// IniConfigContainer A Config represents the ini configuration.
+// When set and get value, support key as section:name type.
+type IniConfigContainer struct {
+	data           map[string]map[string]string // section=> key:val
+	sectionComment map[string]string            // section : comment
+	keyComment     map[string]string            // id: []{comment, key...}; id 1 is for main comment.
+	sync.RWMutex
+}
+
+// Bool returns the boolean value for a given key.
+func (c *IniConfigContainer) Bool(key string) (bool, error) {
+	return ParseBool(c.getdata(key))
+}
+
+// DefaultBool returns the boolean value for a given key.
+// if err != nil return defaultval
+func (c *IniConfigContainer) DefaultBool(key string, defaultval bool) bool {
+	v, err := c.Bool(key)
+	if err != nil {
+		return defaultval
+	}
+	return v
+}
+
+// Int returns the integer value for a given key.
+func (c *IniConfigContainer) Int(key string) (int, error) {
+	return strconv.Atoi(c.getdata(key))
+}
+
+// DefaultInt returns the integer value for a given key.
+// if err != nil return defaultval
+func (c *IniConfigContainer) DefaultInt(key string, defaultval int) int {
+	v, err := c.Int(key)
+	if err != nil {
+		return defaultval
+	}
+	return v
+}
+
+// Int64 returns the int64 value for a given key.
+func (c *IniConfigContainer) Int64(key string) (int64, error) {
+	return strconv.ParseInt(c.getdata(key), 10, 64)
+}
+
+// DefaultInt64 returns the int64 value for a given key.
+// if err != nil return defaultval
+func (c *IniConfigContainer) DefaultInt64(key string, defaultval int64) int64 {
+	v, err := c.Int64(key)
+	if err != nil {
+		return defaultval
+	}
+	return v
+}
+
+// Float returns the float value for a given key.
+func (c *IniConfigContainer) Float(key string) (float64, error) {
+	return strconv.ParseFloat(c.getdata(key), 64)
+}
+
+// DefaultFloat returns the float64 value for a given key.
+// if err != nil return defaultval
+func (c *IniConfigContainer) DefaultFloat(key string, defaultval float64) float64 {
+	v, err := c.Float(key)
+	if err != nil {
+		return defaultval
+	}
+	return v
+}
+
+// String returns the string value for a given key.
+func (c *IniConfigContainer) String(key string) string {
+	return c.getdata(key)
+}
+
+// DefaultString returns the string value for a given key.
+// if err != nil return defaultval
+func (c *IniConfigContainer) DefaultString(key string, defaultval string) string {
+	v := c.String(key)
+	if v == "" {
+		return defaultval
+	}
+	return v
+}
+
+// Strings returns the []string value for a given key.
+// Return nil if config value does not exist or is empty.
+func (c *IniConfigContainer) Strings(key string) []string {
+	v := c.String(key)
+	if v == "" {
+		return nil
+	}
+	return strings.Split(v, ";")
+}
+
+// DefaultStrings returns the []string value for a given key.
+// if err != nil return defaultval
+func (c *IniConfigContainer) DefaultStrings(key string, defaultval []string) []string {
+	v := c.Strings(key)
+	if v == nil {
+		return defaultval
+	}
+	return v
+}
+
+// GetSection returns map for the given section
+func (c *IniConfigContainer) GetSection(section string) (map[string]string, error) {
+	if v, ok := c.data[section]; ok {
+		return v, nil
+	}
+	return nil, errors.New("not exist section")
+}
+
+// SaveConfigFile save the config into file.
+//
+// BUG(env): The environment variable config item will be saved with real value in SaveConfigFile Function.
+func (c *IniConfigContainer) SaveConfigFile(filename string) (err error) {
+	// Write configuration file by filename.
+	f, err := os.Create(filename)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	// Get section or key comments. Fixed #1607
+	getCommentStr := func(section, key string) string {
+		var (
+			comment string
+			ok      bool
+		)
+		if len(key) == 0 {
+			comment, ok = c.sectionComment[section]
+		} else {
+			comment, ok = c.keyComment[section+"."+key]
+		}
+
+		if ok {
+			// Empty comment
+			if len(comment) == 0 || len(strings.TrimSpace(comment)) == 0 {
+				return string(bNumComment)
+			}
+			prefix := string(bNumComment)
+			// Add the line head character "#"
+			return prefix + strings.Replace(comment, lineBreak, lineBreak+prefix, -1)
+		}
+		return ""
+	}
+
+	buf := bytes.NewBuffer(nil)
+	// Save default section at first place
+	if dt, ok := c.data[defaultSection]; ok {
+		for key, val := range dt {
+			if key != " " {
+				// Write key comments.
+				if v := getCommentStr(defaultSection, key); len(v) > 0 {
+					if _, err = buf.WriteString(v + lineBreak); err != nil {
+						return err
+					}
+				}
+
+				// Write key and value.
+				if _, err = buf.WriteString(key + string(bEqual) + val + lineBreak); err != nil {
+					return err
+				}
+			}
+		}
+
+		// Put a line between sections.
+		if _, err = buf.WriteString(lineBreak); err != nil {
+			return err
+		}
+	}
+	// Save named sections
+	for section, dt := range c.data {
+		if section != defaultSection {
+			// Write section comments.
+			if v := getCommentStr(section, ""); len(v) > 0 {
+				if _, err = buf.WriteString(v + lineBreak); err != nil {
+					return err
+				}
+			}
+
+			// Write section name.
+			if _, err = buf.WriteString(string(sectionStart) + section + string(sectionEnd) + lineBreak); err != nil {
+				return err
+			}
+
+			for key, val := range dt {
+				if key != " " {
+					// Write key comments.
+					if v := getCommentStr(section, key); len(v) > 0 {
+						if _, err = buf.WriteString(v + lineBreak); err != nil {
+							return err
+						}
+					}
+
+					// Write key and value.
+					if _, err = buf.WriteString(key + string(bEqual) + val + lineBreak); err != nil {
+						return err
+					}
+				}
+			}
+
+			// Put a line between sections.
+			if _, err = buf.WriteString(lineBreak); err != nil {
+				return err
+			}
+		}
+	}
+	_, err = buf.WriteTo(f)
+	return err
+}
+
+// Set writes a new value for key.
+// if write to one section, the key need be "section::key".
+// if the section is not existed, it panics.
+func (c *IniConfigContainer) Set(key, value string) error {
+	c.Lock()
+	defer c.Unlock()
+	if len(key) == 0 {
+		return errors.New("key is empty")
+	}
+
+	var (
+		section, k string
+		sectionKey = strings.Split(strings.ToLower(key), "::")
+	)
+
+	if len(sectionKey) >= 2 {
+		section = sectionKey[0]
+		k = sectionKey[1]
+	} else {
+		section = defaultSection
+		k = sectionKey[0]
+	}
+
+	if _, ok := c.data[section]; !ok {
+		c.data[section] = make(map[string]string)
+	}
+	c.data[section][k] = value
+	return nil
+}
+
+// DIY returns the raw value by a given key.
+func (c *IniConfigContainer) DIY(key string) (v interface{}, err error) {
+	if v, ok := c.data[strings.ToLower(key)]; ok {
+		return v, nil
+	}
+	return v, errors.New("key not find")
+}
+
+// section.key or key
+func (c *IniConfigContainer) getdata(key string) string {
+	if len(key) == 0 {
+		return ""
+	}
+	c.RLock()
+	defer c.RUnlock()
+
+	var (
+		section, k string
+		sectionKey = strings.Split(strings.ToLower(key), "::")
+	)
+	if len(sectionKey) >= 2 {
+		section = sectionKey[0]
+		k = sectionKey[1]
+	} else {
+		section = defaultSection
+		k = sectionKey[0]
+	}
+	if v, ok := c.data[section]; ok {
+		if vv, ok := v[k]; ok {
+			return vv
+		}
+	}
+	return ""
+}
+
+func init() {
+	Register("ini", &IniConfig{})
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/config/json.go

@@ -0,0 +1,269 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package config
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+// JSONConfig is a json config parser and implements Config interface.
+type JSONConfig struct {
+}
+
+// Parse returns a ConfigContainer with parsed json config map.
+func (js *JSONConfig) Parse(filename string) (Configer, error) {
+	file, err := os.Open(filename)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	content, err := ioutil.ReadAll(file)
+	if err != nil {
+		return nil, err
+	}
+
+	return js.ParseData(content)
+}
+
+// ParseData returns a ConfigContainer with json string
+func (js *JSONConfig) ParseData(data []byte) (Configer, error) {
+	x := &JSONConfigContainer{
+		data: make(map[string]interface{}),
+	}
+	err := json.Unmarshal(data, &x.data)
+	if err != nil {
+		var wrappingArray []interface{}
+		err2 := json.Unmarshal(data, &wrappingArray)
+		if err2 != nil {
+			return nil, err
+		}
+		x.data["rootArray"] = wrappingArray
+	}
+
+	x.data = ExpandValueEnvForMap(x.data)
+
+	return x, nil
+}
+
+// JSONConfigContainer A Config represents the json configuration.
+// Only when get value, support key as section:name type.
+type JSONConfigContainer struct {
+	data map[string]interface{}
+	sync.RWMutex
+}
+
+// Bool returns the boolean value for a given key.
+func (c *JSONConfigContainer) Bool(key string) (bool, error) {
+	val := c.getData(key)
+	if val != nil {
+		return ParseBool(val)
+	}
+	return false, fmt.Errorf("not exist key: %q", key)
+}
+
+// DefaultBool return the bool value if has no error
+// otherwise return the defaultval
+func (c *JSONConfigContainer) DefaultBool(key string, defaultval bool) bool {
+	if v, err := c.Bool(key); err == nil {
+		return v
+	}
+	return defaultval
+}
+
+// Int returns the integer value for a given key.
+func (c *JSONConfigContainer) Int(key string) (int, error) {
+	val := c.getData(key)
+	if val != nil {
+		if v, ok := val.(float64); ok {
+			return int(v), nil
+		} else if v, ok := val.(string); ok {
+			return strconv.Atoi(v)
+		}
+		return 0, errors.New("not valid value")
+	}
+	return 0, errors.New("not exist key:" + key)
+}
+
+// DefaultInt returns the integer value for a given key.
+// if err != nil return defaultval
+func (c *JSONConfigContainer) DefaultInt(key string, defaultval int) int {
+	if v, err := c.Int(key); err == nil {
+		return v
+	}
+	return defaultval
+}
+
+// Int64 returns the int64 value for a given key.
+func (c *JSONConfigContainer) Int64(key string) (int64, error) {
+	val := c.getData(key)
+	if val != nil {
+		if v, ok := val.(float64); ok {
+			return int64(v), nil
+		}
+		return 0, errors.New("not int64 value")
+	}
+	return 0, errors.New("not exist key:" + key)
+}
+
+// DefaultInt64 returns the int64 value for a given key.
+// if err != nil return defaultval
+func (c *JSONConfigContainer) DefaultInt64(key string, defaultval int64) int64 {
+	if v, err := c.Int64(key); err == nil {
+		return v
+	}
+	return defaultval
+}
+
+// Float returns the float value for a given key.
+func (c *JSONConfigContainer) Float(key string) (float64, error) {
+	val := c.getData(key)
+	if val != nil {
+		if v, ok := val.(float64); ok {
+			return v, nil
+		}
+		return 0.0, errors.New("not float64 value")
+	}
+	return 0.0, errors.New("not exist key:" + key)
+}
+
+// DefaultFloat returns the float64 value for a given key.
+// if err != nil return defaultval
+func (c *JSONConfigContainer) DefaultFloat(key string, defaultval float64) float64 {
+	if v, err := c.Float(key); err == nil {
+		return v
+	}
+	return defaultval
+}
+
+// String returns the string value for a given key.
+func (c *JSONConfigContainer) String(key string) string {
+	val := c.getData(key)
+	if val != nil {
+		if v, ok := val.(string); ok {
+			return v
+		}
+	}
+	return ""
+}
+
+// DefaultString returns the string value for a given key.
+// if err != nil return defaultval
+func (c *JSONConfigContainer) DefaultString(key string, defaultval string) string {
+	// TODO FIXME should not use "" to replace non existence
+	if v := c.String(key); v != "" {
+		return v
+	}
+	return defaultval
+}
+
+// Strings returns the []string value for a given key.
+func (c *JSONConfigContainer) Strings(key string) []string {
+	stringVal := c.String(key)
+	if stringVal == "" {
+		return nil
+	}
+	return strings.Split(c.String(key), ";")
+}
+
+// DefaultStrings returns the []string value for a given key.
+// if err != nil return defaultval
+func (c *JSONConfigContainer) DefaultStrings(key string, defaultval []string) []string {
+	if v := c.Strings(key); v != nil {
+		return v
+	}
+	return defaultval
+}
+
+// GetSection returns map for the given section
+func (c *JSONConfigContainer) GetSection(section string) (map[string]string, error) {
+	if v, ok := c.data[section]; ok {
+		return v.(map[string]string), nil
+	}
+	return nil, errors.New("nonexist section " + section)
+}
+
+// SaveConfigFile save the config into file
+func (c *JSONConfigContainer) SaveConfigFile(filename string) (err error) {
+	// Write configuration file by filename.
+	f, err := os.Create(filename)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	b, err := json.MarshalIndent(c.data, "", "  ")
+	if err != nil {
+		return err
+	}
+	_, err = f.Write(b)
+	return err
+}
+
+// Set writes a new value for key.
+func (c *JSONConfigContainer) Set(key, val string) error {
+	c.Lock()
+	defer c.Unlock()
+	c.data[key] = val
+	return nil
+}
+
+// DIY returns the raw value by a given key.
+func (c *JSONConfigContainer) DIY(key string) (v interface{}, err error) {
+	val := c.getData(key)
+	if val != nil {
+		return val, nil
+	}
+	return nil, errors.New("not exist key")
+}
+
+// section.key or key
+func (c *JSONConfigContainer) getData(key string) interface{} {
+	if len(key) == 0 {
+		return nil
+	}
+
+	c.RLock()
+	defer c.RUnlock()
+
+	sectionKeys := strings.Split(key, "::")
+	if len(sectionKeys) >= 2 {
+		curValue, ok := c.data[sectionKeys[0]]
+		if !ok {
+			return nil
+		}
+		for _, key := range sectionKeys[1:] {
+			if v, ok := curValue.(map[string]interface{}); ok {
+				if curValue, ok = v[key]; !ok {
+					return nil
+				}
+			}
+		}
+		return curValue
+	}
+	if v, ok := c.data[key]; ok {
+		return v
+	}
+	return nil
+}
+
+func init() {
+	Register("json", &JSONConfig{})
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/acceptencoder.go

@@ -0,0 +1,232 @@
+// Copyright 2015 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package context
+
+import (
+	"bytes"
+	"compress/flate"
+	"compress/gzip"
+	"compress/zlib"
+	"io"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+var (
+	//Default size==20B same as nginx
+	defaultGzipMinLength = 20
+	//Content will only be compressed if content length is either unknown or greater than gzipMinLength.
+	gzipMinLength = defaultGzipMinLength
+	//The compression level used for deflate compression. (0-9).
+	gzipCompressLevel int
+	//List of HTTP methods to compress. If not set, only GET requests are compressed.
+	includedMethods map[string]bool
+	getMethodOnly   bool
+)
+
+// InitGzip init the gzipcompress
+func InitGzip(minLength, compressLevel int, methods []string) {
+	if minLength >= 0 {
+		gzipMinLength = minLength
+	}
+	gzipCompressLevel = compressLevel
+	if gzipCompressLevel < flate.NoCompression || gzipCompressLevel > flate.BestCompression {
+		gzipCompressLevel = flate.BestSpeed
+	}
+	getMethodOnly = (len(methods) == 0) || (len(methods) == 1 && strings.ToUpper(methods[0]) == "GET")
+	includedMethods = make(map[string]bool, len(methods))
+	for _, v := range methods {
+		includedMethods[strings.ToUpper(v)] = true
+	}
+}
+
+type resetWriter interface {
+	io.Writer
+	Reset(w io.Writer)
+}
+
+type nopResetWriter struct {
+	io.Writer
+}
+
+func (n nopResetWriter) Reset(w io.Writer) {
+	//do nothing
+}
+
+type acceptEncoder struct {
+	name                    string
+	levelEncode             func(int) resetWriter
+	customCompressLevelPool *sync.Pool
+	bestCompressionPool     *sync.Pool
+}
+
+func (ac acceptEncoder) encode(wr io.Writer, level int) resetWriter {
+	if ac.customCompressLevelPool == nil || ac.bestCompressionPool == nil {
+		return nopResetWriter{wr}
+	}
+	var rwr resetWriter
+	switch level {
+	case flate.BestSpeed:
+		rwr = ac.customCompressLevelPool.Get().(resetWriter)
+	case flate.BestCompression:
+		rwr = ac.bestCompressionPool.Get().(resetWriter)
+	default:
+		rwr = ac.levelEncode(level)
+	}
+	rwr.Reset(wr)
+	return rwr
+}
+
+func (ac acceptEncoder) put(wr resetWriter, level int) {
+	if ac.customCompressLevelPool == nil || ac.bestCompressionPool == nil {
+		return
+	}
+	wr.Reset(nil)
+
+	//notice
+	//compressionLevel==BestCompression DOES NOT MATTER
+	//sync.Pool will not memory leak
+
+	switch level {
+	case gzipCompressLevel:
+		ac.customCompressLevelPool.Put(wr)
+	case flate.BestCompression:
+		ac.bestCompressionPool.Put(wr)
+	}
+}
+
+var (
+	noneCompressEncoder = acceptEncoder{"", nil, nil, nil}
+	gzipCompressEncoder = acceptEncoder{
+		name:                    "gzip",
+		levelEncode:             func(level int) resetWriter { wr, _ := gzip.NewWriterLevel(nil, level); return wr },
+		customCompressLevelPool: &sync.Pool{New: func() interface{} { wr, _ := gzip.NewWriterLevel(nil, gzipCompressLevel); return wr }},
+		bestCompressionPool:     &sync.Pool{New: func() interface{} { wr, _ := gzip.NewWriterLevel(nil, flate.BestCompression); return wr }},
+	}
+
+	//according to the sec :http://tools.ietf.org/html/rfc2616#section-3.5 ,the deflate compress in http is zlib indeed
+	//deflate
+	//The "zlib" format defined in RFC 1950 [31] in combination with
+	//the "deflate" compression mechanism described in RFC 1951 [29].
+	deflateCompressEncoder = acceptEncoder{
+		name:                    "deflate",
+		levelEncode:             func(level int) resetWriter { wr, _ := zlib.NewWriterLevel(nil, level); return wr },
+		customCompressLevelPool: &sync.Pool{New: func() interface{} { wr, _ := zlib.NewWriterLevel(nil, gzipCompressLevel); return wr }},
+		bestCompressionPool:     &sync.Pool{New: func() interface{} { wr, _ := zlib.NewWriterLevel(nil, flate.BestCompression); return wr }},
+	}
+)
+
+var (
+	encoderMap = map[string]acceptEncoder{ // all the other compress methods will ignore
+		"gzip":     gzipCompressEncoder,
+		"deflate":  deflateCompressEncoder,
+		"*":        gzipCompressEncoder, // * means any compress will accept,we prefer gzip
+		"identity": noneCompressEncoder, // identity means none-compress
+	}
+)
+
+// WriteFile reads from file and writes to writer by the specific encoding(gzip/deflate)
+func WriteFile(encoding string, writer io.Writer, file *os.File) (bool, string, error) {
+	return writeLevel(encoding, writer, file, flate.BestCompression)
+}
+
+// WriteBody reads  writes content to writer by the specific encoding(gzip/deflate)
+func WriteBody(encoding string, writer io.Writer, content []byte) (bool, string, error) {
+	if encoding == "" || len(content) < gzipMinLength {
+		_, err := writer.Write(content)
+		return false, "", err
+	}
+	return writeLevel(encoding, writer, bytes.NewReader(content), gzipCompressLevel)
+}
+
+// writeLevel reads from reader,writes to writer by specific encoding and compress level
+// the compress level is defined by deflate package
+func writeLevel(encoding string, writer io.Writer, reader io.Reader, level int) (bool, string, error) {
+	var outputWriter resetWriter
+	var err error
+	var ce = noneCompressEncoder
+
+	if cf, ok := encoderMap[encoding]; ok {
+		ce = cf
+	}
+	encoding = ce.name
+	outputWriter = ce.encode(writer, level)
+	defer ce.put(outputWriter, level)
+
+	_, err = io.Copy(outputWriter, reader)
+	if err != nil {
+		return false, "", err
+	}
+
+	switch outputWriter.(type) {
+	case io.WriteCloser:
+		outputWriter.(io.WriteCloser).Close()
+	}
+	return encoding != "", encoding, nil
+}
+
+// ParseEncoding will extract the right encoding for response
+// the Accept-Encoding's sec is here:
+// http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.3
+func ParseEncoding(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	if (getMethodOnly && r.Method == "GET") || includedMethods[r.Method] {
+		return parseEncoding(r)
+	}
+	return ""
+}
+
+type q struct {
+	name  string
+	value float64
+}
+
+func parseEncoding(r *http.Request) string {
+	acceptEncoding := r.Header.Get("Accept-Encoding")
+	if acceptEncoding == "" {
+		return ""
+	}
+	var lastQ q
+	for _, v := range strings.Split(acceptEncoding, ",") {
+		v = strings.TrimSpace(v)
+		if v == "" {
+			continue
+		}
+		vs := strings.Split(v, ";")
+		var cf acceptEncoder
+		var ok bool
+		if cf, ok = encoderMap[vs[0]]; !ok {
+			continue
+		}
+		if len(vs) == 1 {
+			return cf.name
+		}
+		if len(vs) == 2 {
+			f, _ := strconv.ParseFloat(strings.Replace(vs[1], "q=", "", -1), 64)
+			if f == 0 {
+				continue
+			}
+			if f > lastQ.value {
+				lastQ = q{cf.name, f}
+			}
+		}
+	}
+	return lastQ.name
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/context.go

@@ -0,0 +1,263 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package context provide the context utils
+// Usage:
+//
+//	import "github.com/astaxie/beego/context"
+//
+//	ctx := context.Context{Request:req,ResponseWriter:rw}
+//
+//  more docs http://beego.me/docs/module/context.md
+package context
+
+import (
+	"bufio"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/astaxie/beego/utils"
+)
+
+//commonly used mime-types
+const (
+	ApplicationJSON = "application/json"
+	ApplicationXML  = "application/xml"
+	ApplicationYAML = "application/x-yaml"
+	TextXML         = "text/xml"
+)
+
+// NewContext return the Context with Input and Output
+func NewContext() *Context {
+	return &Context{
+		Input:  NewInput(),
+		Output: NewOutput(),
+	}
+}
+
+// Context Http request context struct including BeegoInput, BeegoOutput, http.Request and http.ResponseWriter.
+// BeegoInput and BeegoOutput provides some api to operate request and response more easily.
+type Context struct {
+	Input          *BeegoInput
+	Output         *BeegoOutput
+	Request        *http.Request
+	ResponseWriter *Response
+	_xsrfToken     string
+}
+
+// Reset init Context, BeegoInput and BeegoOutput
+func (ctx *Context) Reset(rw http.ResponseWriter, r *http.Request) {
+	ctx.Request = r
+	if ctx.ResponseWriter == nil {
+		ctx.ResponseWriter = &Response{}
+	}
+	ctx.ResponseWriter.reset(rw)
+	ctx.Input.Reset(ctx)
+	ctx.Output.Reset(ctx)
+	ctx._xsrfToken = ""
+}
+
+// Redirect does redirection to localurl with http header status code.
+func (ctx *Context) Redirect(status int, localurl string) {
+	http.Redirect(ctx.ResponseWriter, ctx.Request, localurl, status)
+}
+
+// Abort stops this request.
+// if beego.ErrorMaps exists, panic body.
+func (ctx *Context) Abort(status int, body string) {
+	ctx.Output.SetStatus(status)
+	panic(body)
+}
+
+// WriteString Write string to response body.
+// it sends response body.
+func (ctx *Context) WriteString(content string) {
+	ctx.ResponseWriter.Write([]byte(content))
+}
+
+// GetCookie Get cookie from request by a given key.
+// It's alias of BeegoInput.Cookie.
+func (ctx *Context) GetCookie(key string) string {
+	return ctx.Input.Cookie(key)
+}
+
+// SetCookie Set cookie for response.
+// It's alias of BeegoOutput.Cookie.
+func (ctx *Context) SetCookie(name string, value string, others ...interface{}) {
+	ctx.Output.Cookie(name, value, others...)
+}
+
+// GetSecureCookie Get secure cookie from request by a given key.
+func (ctx *Context) GetSecureCookie(Secret, key string) (string, bool) {
+	val := ctx.Input.Cookie(key)
+	if val == "" {
+		return "", false
+	}
+
+	parts := strings.SplitN(val, "|", 3)
+
+	if len(parts) != 3 {
+		return "", false
+	}
+
+	vs := parts[0]
+	timestamp := parts[1]
+	sig := parts[2]
+
+	h := hmac.New(sha256.New, []byte(Secret))
+	fmt.Fprintf(h, "%s%s", vs, timestamp)
+
+	if fmt.Sprintf("%02x", h.Sum(nil)) != sig {
+		return "", false
+	}
+	res, _ := base64.URLEncoding.DecodeString(vs)
+	return string(res), true
+}
+
+// SetSecureCookie Set Secure cookie for response.
+func (ctx *Context) SetSecureCookie(Secret, name, value string, others ...interface{}) {
+	vs := base64.URLEncoding.EncodeToString([]byte(value))
+	timestamp := strconv.FormatInt(time.Now().UnixNano(), 10)
+	h := hmac.New(sha256.New, []byte(Secret))
+	fmt.Fprintf(h, "%s%s", vs, timestamp)
+	sig := fmt.Sprintf("%02x", h.Sum(nil))
+	cookie := strings.Join([]string{vs, timestamp, sig}, "|")
+	ctx.Output.Cookie(name, cookie, others...)
+}
+
+// XSRFToken creates a xsrf token string and returns.
+func (ctx *Context) XSRFToken(key string, expire int64) string {
+	if ctx._xsrfToken == "" {
+		token, ok := ctx.GetSecureCookie(key, "_xsrf")
+		if !ok {
+			token = string(utils.RandomCreateBytes(32))
+			ctx.SetSecureCookie(key, "_xsrf", token, expire, "", "", true, true)
+		}
+		ctx._xsrfToken = token
+	}
+	return ctx._xsrfToken
+}
+
+// CheckXSRFCookie checks xsrf token in this request is valid or not.
+// the token can provided in request header "X-Xsrftoken" and "X-CsrfToken"
+// or in form field value named as "_xsrf".
+func (ctx *Context) CheckXSRFCookie() bool {
+	token := ctx.Input.Query("_xsrf")
+	if token == "" {
+		token = ctx.Request.Header.Get("X-Xsrftoken")
+	}
+	if token == "" {
+		token = ctx.Request.Header.Get("X-Csrftoken")
+	}
+	if token == "" {
+		ctx.Abort(422, "422")
+		return false
+	}
+	if ctx._xsrfToken != token {
+		ctx.Abort(417, "417")
+		return false
+	}
+	return true
+}
+
+// RenderMethodResult renders the return value of a controller method to the output
+func (ctx *Context) RenderMethodResult(result interface{}) {
+	if result != nil {
+		renderer, ok := result.(Renderer)
+		if !ok {
+			err, ok := result.(error)
+			if ok {
+				renderer = errorRenderer(err)
+			} else {
+				renderer = jsonRenderer(result)
+			}
+		}
+		renderer.Render(ctx)
+	}
+}
+
+//Response is a wrapper for the http.ResponseWriter
+//started set to true if response was written to then don't execute other handler
+type Response struct {
+	http.ResponseWriter
+	Started bool
+	Status  int
+	Elapsed time.Duration
+}
+
+func (r *Response) reset(rw http.ResponseWriter) {
+	r.ResponseWriter = rw
+	r.Status = 0
+	r.Started = false
+}
+
+// Write writes the data to the connection as part of an HTTP reply,
+// and sets `started` to true.
+// started means the response has sent out.
+func (r *Response) Write(p []byte) (int, error) {
+	r.Started = true
+	return r.ResponseWriter.Write(p)
+}
+
+// WriteHeader sends an HTTP response header with status code,
+// and sets `started` to true.
+func (r *Response) WriteHeader(code int) {
+	if r.Status > 0 {
+		//prevent multiple response.WriteHeader calls
+		return
+	}
+	r.Status = code
+	r.Started = true
+	r.ResponseWriter.WriteHeader(code)
+}
+
+// Hijack hijacker for http
+func (r *Response) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	hj, ok := r.ResponseWriter.(http.Hijacker)
+	if !ok {
+		return nil, nil, errors.New("webserver doesn't support hijacking")
+	}
+	return hj.Hijack()
+}
+
+// Flush http.Flusher
+func (r *Response) Flush() {
+	if f, ok := r.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+// CloseNotify http.CloseNotifier
+func (r *Response) CloseNotify() <-chan bool {
+	if cn, ok := r.ResponseWriter.(http.CloseNotifier); ok {
+		return cn.CloseNotify()
+	}
+	return nil
+}
+
+// Pusher http.Pusher
+func (r *Response) Pusher() (pusher http.Pusher) {
+	if pusher, ok := r.ResponseWriter.(http.Pusher); ok {
+		return pusher
+	}
+	return nil
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/input.go

@@ -0,0 +1,689 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package context
+
+import (
+	"bytes"
+	"compress/gzip"
+	"errors"
+	"io"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/url"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/astaxie/beego/session"
+)
+
+// Regexes for checking the accept headers
+// TODO make sure these are correct
+var (
+	acceptsHTMLRegex = regexp.MustCompile(`(text/html|application/xhtml\+xml)(?:,|$)`)
+	acceptsXMLRegex  = regexp.MustCompile(`(application/xml|text/xml)(?:,|$)`)
+	acceptsJSONRegex = regexp.MustCompile(`(application/json)(?:,|$)`)
+	acceptsYAMLRegex = regexp.MustCompile(`(application/x-yaml)(?:,|$)`)
+	maxParam         = 50
+)
+
+// BeegoInput operates the http request header, data, cookie and body.
+// it also contains router params and current session.
+type BeegoInput struct {
+	Context       *Context
+	CruSession    session.Store
+	pnames        []string
+	pvalues       []string
+	data          map[interface{}]interface{} // store some values in this context when calling context in filter or controller.
+	dataLock      sync.RWMutex
+	RequestBody   []byte
+	RunMethod     string
+	RunController reflect.Type
+}
+
+// NewInput return BeegoInput generated by Context.
+func NewInput() *BeegoInput {
+	return &BeegoInput{
+		pnames:  make([]string, 0, maxParam),
+		pvalues: make([]string, 0, maxParam),
+		data:    make(map[interface{}]interface{}),
+	}
+}
+
+// Reset init the BeegoInput
+func (input *BeegoInput) Reset(ctx *Context) {
+	input.Context = ctx
+	input.CruSession = nil
+	input.pnames = input.pnames[:0]
+	input.pvalues = input.pvalues[:0]
+	input.dataLock.Lock()
+	input.data = nil
+	input.dataLock.Unlock()
+	input.RequestBody = []byte{}
+}
+
+// Protocol returns request protocol name, such as HTTP/1.1 .
+func (input *BeegoInput) Protocol() string {
+	return input.Context.Request.Proto
+}
+
+// URI returns full request url with query string, fragment.
+func (input *BeegoInput) URI() string {
+	return input.Context.Request.RequestURI
+}
+
+// URL returns request url path (without query string, fragment).
+func (input *BeegoInput) URL() string {
+	return input.Context.Request.URL.EscapedPath()
+}
+
+// Site returns base site url as scheme://domain type.
+func (input *BeegoInput) Site() string {
+	return input.Scheme() + "://" + input.Domain()
+}
+
+// Scheme returns request scheme as "http" or "https".
+func (input *BeegoInput) Scheme() string {
+	if scheme := input.Header("X-Forwarded-Proto"); scheme != "" {
+		return scheme
+	}
+	if input.Context.Request.URL.Scheme != "" {
+		return input.Context.Request.URL.Scheme
+	}
+	if input.Context.Request.TLS == nil {
+		return "http"
+	}
+	return "https"
+}
+
+// Domain returns host name.
+// Alias of Host method.
+func (input *BeegoInput) Domain() string {
+	return input.Host()
+}
+
+// Host returns host name.
+// if no host info in request, return localhost.
+func (input *BeegoInput) Host() string {
+	if input.Context.Request.Host != "" {
+		if hostPart, _, err := net.SplitHostPort(input.Context.Request.Host); err == nil {
+			return hostPart
+		}
+		return input.Context.Request.Host
+	}
+	return "localhost"
+}
+
+// Method returns http request method.
+func (input *BeegoInput) Method() string {
+	return input.Context.Request.Method
+}
+
+// Is returns boolean of this request is on given method, such as Is("POST").
+func (input *BeegoInput) Is(method string) bool {
+	return input.Method() == method
+}
+
+// IsGet Is this a GET method request?
+func (input *BeegoInput) IsGet() bool {
+	return input.Is("GET")
+}
+
+// IsPost Is this a POST method request?
+func (input *BeegoInput) IsPost() bool {
+	return input.Is("POST")
+}
+
+// IsHead Is this a Head method request?
+func (input *BeegoInput) IsHead() bool {
+	return input.Is("HEAD")
+}
+
+// IsOptions Is this a OPTIONS method request?
+func (input *BeegoInput) IsOptions() bool {
+	return input.Is("OPTIONS")
+}
+
+// IsPut Is this a PUT method request?
+func (input *BeegoInput) IsPut() bool {
+	return input.Is("PUT")
+}
+
+// IsDelete Is this a DELETE method request?
+func (input *BeegoInput) IsDelete() bool {
+	return input.Is("DELETE")
+}
+
+// IsPatch Is this a PATCH method request?
+func (input *BeegoInput) IsPatch() bool {
+	return input.Is("PATCH")
+}
+
+// IsAjax returns boolean of this request is generated by ajax.
+func (input *BeegoInput) IsAjax() bool {
+	return input.Header("X-Requested-With") == "XMLHttpRequest"
+}
+
+// IsSecure returns boolean of this request is in https.
+func (input *BeegoInput) IsSecure() bool {
+	return input.Scheme() == "https"
+}
+
+// IsWebsocket returns boolean of this request is in webSocket.
+func (input *BeegoInput) IsWebsocket() bool {
+	return input.Header("Upgrade") == "websocket"
+}
+
+// IsUpload returns boolean of whether file uploads in this request or not..
+func (input *BeegoInput) IsUpload() bool {
+	return strings.Contains(input.Header("Content-Type"), "multipart/form-data")
+}
+
+// AcceptsHTML Checks if request accepts html response
+func (input *BeegoInput) AcceptsHTML() bool {
+	return acceptsHTMLRegex.MatchString(input.Header("Accept"))
+}
+
+// AcceptsXML Checks if request accepts xml response
+func (input *BeegoInput) AcceptsXML() bool {
+	return acceptsXMLRegex.MatchString(input.Header("Accept"))
+}
+
+// AcceptsJSON Checks if request accepts json response
+func (input *BeegoInput) AcceptsJSON() bool {
+	return acceptsJSONRegex.MatchString(input.Header("Accept"))
+}
+
+// AcceptsYAML Checks if request accepts json response
+func (input *BeegoInput) AcceptsYAML() bool {
+	return acceptsYAMLRegex.MatchString(input.Header("Accept"))
+}
+
+// IP returns request client ip.
+// if in proxy, return first proxy id.
+// if error, return RemoteAddr.
+func (input *BeegoInput) IP() string {
+	ips := input.Proxy()
+	if len(ips) > 0 && ips[0] != "" {
+		rip, _, err := net.SplitHostPort(ips[0])
+		if err != nil {
+			rip = ips[0]
+		}
+		return rip
+	}
+	if ip, _, err := net.SplitHostPort(input.Context.Request.RemoteAddr); err == nil {
+		return ip
+	}
+	return input.Context.Request.RemoteAddr
+}
+
+// Proxy returns proxy client ips slice.
+func (input *BeegoInput) Proxy() []string {
+	if ips := input.Header("X-Forwarded-For"); ips != "" {
+		return strings.Split(ips, ",")
+	}
+	return []string{}
+}
+
+// Referer returns http referer header.
+func (input *BeegoInput) Referer() string {
+	return input.Header("Referer")
+}
+
+// Refer returns http referer header.
+func (input *BeegoInput) Refer() string {
+	return input.Referer()
+}
+
+// SubDomains returns sub domain string.
+// if aa.bb.domain.com, returns aa.bb .
+func (input *BeegoInput) SubDomains() string {
+	parts := strings.Split(input.Host(), ".")
+	if len(parts) >= 3 {
+		return strings.Join(parts[:len(parts)-2], ".")
+	}
+	return ""
+}
+
+// Port returns request client port.
+// when error or empty, return 80.
+func (input *BeegoInput) Port() int {
+	if _, portPart, err := net.SplitHostPort(input.Context.Request.Host); err == nil {
+		port, _ := strconv.Atoi(portPart)
+		return port
+	}
+	return 80
+}
+
+// UserAgent returns request client user agent string.
+func (input *BeegoInput) UserAgent() string {
+	return input.Header("User-Agent")
+}
+
+// ParamsLen return the length of the params
+func (input *BeegoInput) ParamsLen() int {
+	return len(input.pnames)
+}
+
+// Param returns router param by a given key.
+func (input *BeegoInput) Param(key string) string {
+	for i, v := range input.pnames {
+		if v == key && i <= len(input.pvalues) {
+			// we cannot use url.PathEscape(input.pvalues[i])
+			// for example, if the value is /a/b
+			// after url.PathEscape(input.pvalues[i]), the value is %2Fa%2Fb
+			// However, the value is used in ControllerRegister.ServeHTTP
+			// and split by "/", so function crash...
+			return input.pvalues[i]
+		}
+	}
+	return ""
+}
+
+// Params returns the map[key]value.
+func (input *BeegoInput) Params() map[string]string {
+	m := make(map[string]string)
+	for i, v := range input.pnames {
+		if i <= len(input.pvalues) {
+			m[v] = input.pvalues[i]
+		}
+	}
+	return m
+}
+
+// SetParam will set the param with key and value
+func (input *BeegoInput) SetParam(key, val string) {
+	// check if already exists
+	for i, v := range input.pnames {
+		if v == key && i <= len(input.pvalues) {
+			input.pvalues[i] = val
+			return
+		}
+	}
+	input.pvalues = append(input.pvalues, val)
+	input.pnames = append(input.pnames, key)
+}
+
+// ResetParams clears any of the input's Params
+// This function is used to clear parameters so they may be reset between filter
+// passes.
+func (input *BeegoInput) ResetParams() {
+	input.pnames = input.pnames[:0]
+	input.pvalues = input.pvalues[:0]
+}
+
+// Query returns input data item string by a given string.
+func (input *BeegoInput) Query(key string) string {
+	if val := input.Param(key); val != "" {
+		return val
+	}
+	if input.Context.Request.Form == nil {
+		input.dataLock.Lock()
+		if input.Context.Request.Form == nil {
+			input.Context.Request.ParseForm()
+		}
+		input.dataLock.Unlock()
+	}
+	input.dataLock.RLock()
+	defer input.dataLock.RUnlock()
+	return input.Context.Request.Form.Get(key)
+}
+
+// Header returns request header item string by a given string.
+// if non-existed, return empty string.
+func (input *BeegoInput) Header(key string) string {
+	return input.Context.Request.Header.Get(key)
+}
+
+// Cookie returns request cookie item string by a given key.
+// if non-existed, return empty string.
+func (input *BeegoInput) Cookie(key string) string {
+	ck, err := input.Context.Request.Cookie(key)
+	if err != nil {
+		return ""
+	}
+	return ck.Value
+}
+
+// Session returns current session item value by a given key.
+// if non-existed, return nil.
+func (input *BeegoInput) Session(key interface{}) interface{} {
+	return input.CruSession.Get(key)
+}
+
+// CopyBody returns the raw request body data as bytes.
+func (input *BeegoInput) CopyBody(MaxMemory int64) []byte {
+	if input.Context.Request.Body == nil {
+		return []byte{}
+	}
+
+	var requestbody []byte
+	safe := &io.LimitedReader{R: input.Context.Request.Body, N: MaxMemory}
+	if input.Header("Content-Encoding") == "gzip" {
+		reader, err := gzip.NewReader(safe)
+		if err != nil {
+			return nil
+		}
+		requestbody, _ = ioutil.ReadAll(reader)
+	} else {
+		requestbody, _ = ioutil.ReadAll(safe)
+	}
+
+	input.Context.Request.Body.Close()
+	bf := bytes.NewBuffer(requestbody)
+	input.Context.Request.Body = http.MaxBytesReader(input.Context.ResponseWriter, ioutil.NopCloser(bf), MaxMemory)
+	input.RequestBody = requestbody
+	return requestbody
+}
+
+// Data return the implicit data in the input
+func (input *BeegoInput) Data() map[interface{}]interface{} {
+	input.dataLock.Lock()
+	defer input.dataLock.Unlock()
+	if input.data == nil {
+		input.data = make(map[interface{}]interface{})
+	}
+	return input.data
+}
+
+// GetData returns the stored data in this context.
+func (input *BeegoInput) GetData(key interface{}) interface{} {
+	input.dataLock.Lock()
+	defer input.dataLock.Unlock()
+	if v, ok := input.data[key]; ok {
+		return v
+	}
+	return nil
+}
+
+// SetData stores data with given key in this context.
+// This data are only available in this context.
+func (input *BeegoInput) SetData(key, val interface{}) {
+	input.dataLock.Lock()
+	defer input.dataLock.Unlock()
+	if input.data == nil {
+		input.data = make(map[interface{}]interface{})
+	}
+	input.data[key] = val
+}
+
+// ParseFormOrMulitForm parseForm or parseMultiForm based on Content-type
+func (input *BeegoInput) ParseFormOrMulitForm(maxMemory int64) error {
+	// Parse the body depending on the content type.
+	if strings.Contains(input.Header("Content-Type"), "multipart/form-data") {
+		if err := input.Context.Request.ParseMultipartForm(maxMemory); err != nil {
+			return errors.New("Error parsing request body:" + err.Error())
+		}
+	} else if err := input.Context.Request.ParseForm(); err != nil {
+		return errors.New("Error parsing request body:" + err.Error())
+	}
+	return nil
+}
+
+// Bind data from request.Form[key] to dest
+// like /?id=123&isok=true&ft=1.2&ol[0]=1&ol[1]=2&ul[]=str&ul[]=array&user.Name=astaxie
+// var id int  beegoInput.Bind(&id, "id")  id ==123
+// var isok bool  beegoInput.Bind(&isok, "isok")  isok ==true
+// var ft float64  beegoInput.Bind(&ft, "ft")  ft ==1.2
+// ol := make([]int, 0, 2)  beegoInput.Bind(&ol, "ol")  ol ==[1 2]
+// ul := make([]string, 0, 2)  beegoInput.Bind(&ul, "ul")  ul ==[str array]
+// user struct{Name}  beegoInput.Bind(&user, "user")  user == {Name:"astaxie"}
+func (input *BeegoInput) Bind(dest interface{}, key string) error {
+	value := reflect.ValueOf(dest)
+	if value.Kind() != reflect.Ptr {
+		return errors.New("beego: non-pointer passed to Bind: " + key)
+	}
+	value = value.Elem()
+	if !value.CanSet() {
+		return errors.New("beego: non-settable variable passed to Bind: " + key)
+	}
+	typ := value.Type()
+	// Get real type if dest define with interface{}.
+	// e.g  var dest interface{} dest=1.0
+	if value.Kind() == reflect.Interface {
+		typ = value.Elem().Type()
+	}
+	rv := input.bind(key, typ)
+	if !rv.IsValid() {
+		return errors.New("beego: reflect value is empty")
+	}
+	value.Set(rv)
+	return nil
+}
+
+func (input *BeegoInput) bind(key string, typ reflect.Type) reflect.Value {
+	if input.Context.Request.Form == nil {
+		input.Context.Request.ParseForm()
+	}
+	rv := reflect.Zero(typ)
+	switch typ.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		val := input.Query(key)
+		if len(val) == 0 {
+			return rv
+		}
+		rv = input.bindInt(val, typ)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		val := input.Query(key)
+		if len(val) == 0 {
+			return rv
+		}
+		rv = input.bindUint(val, typ)
+	case reflect.Float32, reflect.Float64:
+		val := input.Query(key)
+		if len(val) == 0 {
+			return rv
+		}
+		rv = input.bindFloat(val, typ)
+	case reflect.String:
+		val := input.Query(key)
+		if len(val) == 0 {
+			return rv
+		}
+		rv = input.bindString(val, typ)
+	case reflect.Bool:
+		val := input.Query(key)
+		if len(val) == 0 {
+			return rv
+		}
+		rv = input.bindBool(val, typ)
+	case reflect.Slice:
+		rv = input.bindSlice(&input.Context.Request.Form, key, typ)
+	case reflect.Struct:
+		rv = input.bindStruct(&input.Context.Request.Form, key, typ)
+	case reflect.Ptr:
+		rv = input.bindPoint(key, typ)
+	case reflect.Map:
+		rv = input.bindMap(&input.Context.Request.Form, key, typ)
+	}
+	return rv
+}
+
+func (input *BeegoInput) bindValue(val string, typ reflect.Type) reflect.Value {
+	rv := reflect.Zero(typ)
+	switch typ.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		rv = input.bindInt(val, typ)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		rv = input.bindUint(val, typ)
+	case reflect.Float32, reflect.Float64:
+		rv = input.bindFloat(val, typ)
+	case reflect.String:
+		rv = input.bindString(val, typ)
+	case reflect.Bool:
+		rv = input.bindBool(val, typ)
+	case reflect.Slice:
+		rv = input.bindSlice(&url.Values{"": {val}}, "", typ)
+	case reflect.Struct:
+		rv = input.bindStruct(&url.Values{"": {val}}, "", typ)
+	case reflect.Ptr:
+		rv = input.bindPoint(val, typ)
+	case reflect.Map:
+		rv = input.bindMap(&url.Values{"": {val}}, "", typ)
+	}
+	return rv
+}
+
+func (input *BeegoInput) bindInt(val string, typ reflect.Type) reflect.Value {
+	intValue, err := strconv.ParseInt(val, 10, 64)
+	if err != nil {
+		return reflect.Zero(typ)
+	}
+	pValue := reflect.New(typ)
+	pValue.Elem().SetInt(intValue)
+	return pValue.Elem()
+}
+
+func (input *BeegoInput) bindUint(val string, typ reflect.Type) reflect.Value {
+	uintValue, err := strconv.ParseUint(val, 10, 64)
+	if err != nil {
+		return reflect.Zero(typ)
+	}
+	pValue := reflect.New(typ)
+	pValue.Elem().SetUint(uintValue)
+	return pValue.Elem()
+}
+
+func (input *BeegoInput) bindFloat(val string, typ reflect.Type) reflect.Value {
+	floatValue, err := strconv.ParseFloat(val, 64)
+	if err != nil {
+		return reflect.Zero(typ)
+	}
+	pValue := reflect.New(typ)
+	pValue.Elem().SetFloat(floatValue)
+	return pValue.Elem()
+}
+
+func (input *BeegoInput) bindString(val string, typ reflect.Type) reflect.Value {
+	return reflect.ValueOf(val)
+}
+
+func (input *BeegoInput) bindBool(val string, typ reflect.Type) reflect.Value {
+	val = strings.TrimSpace(strings.ToLower(val))
+	switch val {
+	case "true", "on", "1":
+		return reflect.ValueOf(true)
+	}
+	return reflect.ValueOf(false)
+}
+
+type sliceValue struct {
+	index int           // Index extracted from brackets.  If -1, no index was provided.
+	value reflect.Value // the bound value for this slice element.
+}
+
+func (input *BeegoInput) bindSlice(params *url.Values, key string, typ reflect.Type) reflect.Value {
+	maxIndex := -1
+	numNoIndex := 0
+	sliceValues := []sliceValue{}
+	for reqKey, vals := range *params {
+		if !strings.HasPrefix(reqKey, key+"[") {
+			continue
+		}
+		// Extract the index, and the index where a sub-key starts. (e.g. field[0].subkey)
+		index := -1
+		leftBracket, rightBracket := len(key), strings.Index(reqKey[len(key):], "]")+len(key)
+		if rightBracket > leftBracket+1 {
+			index, _ = strconv.Atoi(reqKey[leftBracket+1 : rightBracket])
+		}
+		subKeyIndex := rightBracket + 1
+
+		// Handle the indexed case.
+		if index > -1 {
+			if index > maxIndex {
+				maxIndex = index
+			}
+			sliceValues = append(sliceValues, sliceValue{
+				index: index,
+				value: input.bind(reqKey[:subKeyIndex], typ.Elem()),
+			})
+			continue
+		}
+
+		// It's an un-indexed element.  (e.g. element[])
+		numNoIndex += len(vals)
+		for _, val := range vals {
+			// Unindexed values can only be direct-bound.
+			sliceValues = append(sliceValues, sliceValue{
+				index: -1,
+				value: input.bindValue(val, typ.Elem()),
+			})
+		}
+	}
+	resultArray := reflect.MakeSlice(typ, maxIndex+1, maxIndex+1+numNoIndex)
+	for _, sv := range sliceValues {
+		if sv.index != -1 {
+			resultArray.Index(sv.index).Set(sv.value)
+		} else {
+			resultArray = reflect.Append(resultArray, sv.value)
+		}
+	}
+	return resultArray
+}
+
+func (input *BeegoInput) bindStruct(params *url.Values, key string, typ reflect.Type) reflect.Value {
+	result := reflect.New(typ).Elem()
+	fieldValues := make(map[string]reflect.Value)
+	for reqKey, val := range *params {
+		var fieldName string
+		if strings.HasPrefix(reqKey, key+".") {
+			fieldName = reqKey[len(key)+1:]
+		} else if strings.HasPrefix(reqKey, key+"[") && reqKey[len(reqKey)-1] == ']' {
+			fieldName = reqKey[len(key)+1 : len(reqKey)-1]
+		} else {
+			continue
+		}
+
+		if _, ok := fieldValues[fieldName]; !ok {
+			// Time to bind this field.  Get it and make sure we can set it.
+			fieldValue := result.FieldByName(fieldName)
+			if !fieldValue.IsValid() {
+				continue
+			}
+			if !fieldValue.CanSet() {
+				continue
+			}
+			boundVal := input.bindValue(val[0], fieldValue.Type())
+			fieldValue.Set(boundVal)
+			fieldValues[fieldName] = boundVal
+		}
+	}
+
+	return result
+}
+
+func (input *BeegoInput) bindPoint(key string, typ reflect.Type) reflect.Value {
+	return input.bind(key, typ.Elem()).Addr()
+}
+
+func (input *BeegoInput) bindMap(params *url.Values, key string, typ reflect.Type) reflect.Value {
+	var (
+		result    = reflect.MakeMap(typ)
+		keyType   = typ.Key()
+		valueType = typ.Elem()
+	)
+	for paramName, values := range *params {
+		if !strings.HasPrefix(paramName, key+"[") || paramName[len(paramName)-1] != ']' {
+			continue
+		}
+
+		key := paramName[len(key)+1 : len(paramName)-1]
+		result.SetMapIndex(input.bindValue(key, keyType), input.bindValue(values[0], valueType))
+	}
+	return result
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/output.go

@@ -0,0 +1,408 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package context
+
+import (
+	"bytes"
+	"encoding/json"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"html/template"
+	"io"
+	"mime"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	yaml "gopkg.in/yaml.v2"
+)
+
+// BeegoOutput does work for sending response header.
+type BeegoOutput struct {
+	Context    *Context
+	Status     int
+	EnableGzip bool
+}
+
+// NewOutput returns new BeegoOutput.
+// it contains nothing now.
+func NewOutput() *BeegoOutput {
+	return &BeegoOutput{}
+}
+
+// Reset init BeegoOutput
+func (output *BeegoOutput) Reset(ctx *Context) {
+	output.Context = ctx
+	output.Status = 0
+}
+
+// Header sets response header item string via given key.
+func (output *BeegoOutput) Header(key, val string) {
+	output.Context.ResponseWriter.Header().Set(key, val)
+}
+
+// Body sets response body content.
+// if EnableGzip, compress content string.
+// it sends out response body directly.
+func (output *BeegoOutput) Body(content []byte) error {
+	var encoding string
+	var buf = &bytes.Buffer{}
+	if output.EnableGzip {
+		encoding = ParseEncoding(output.Context.Request)
+	}
+	if b, n, _ := WriteBody(encoding, buf, content); b {
+		output.Header("Content-Encoding", n)
+		output.Header("Content-Length", strconv.Itoa(buf.Len()))
+	} else {
+		output.Header("Content-Length", strconv.Itoa(len(content)))
+	}
+	// Write status code if it has been set manually
+	// Set it to 0 afterwards to prevent "multiple response.WriteHeader calls"
+	if output.Status != 0 {
+		output.Context.ResponseWriter.WriteHeader(output.Status)
+		output.Status = 0
+	} else {
+		output.Context.ResponseWriter.Started = true
+	}
+	io.Copy(output.Context.ResponseWriter, buf)
+	return nil
+}
+
+// Cookie sets cookie value via given key.
+// others are ordered as cookie's max age time, path,domain, secure and httponly.
+func (output *BeegoOutput) Cookie(name string, value string, others ...interface{}) {
+	var b bytes.Buffer
+	fmt.Fprintf(&b, "%s=%s", sanitizeName(name), sanitizeValue(value))
+
+	//fix cookie not work in IE
+	if len(others) > 0 {
+		var maxAge int64
+
+		switch v := others[0].(type) {
+		case int:
+			maxAge = int64(v)
+		case int32:
+			maxAge = int64(v)
+		case int64:
+			maxAge = v
+		}
+
+		switch {
+		case maxAge > 0:
+			fmt.Fprintf(&b, "; Expires=%s; Max-Age=%d", time.Now().Add(time.Duration(maxAge)*time.Second).UTC().Format(time.RFC1123), maxAge)
+		case maxAge < 0:
+			fmt.Fprintf(&b, "; Max-Age=0")
+		}
+	}
+
+	// the settings below
+	// Path, Domain, Secure, HttpOnly
+	// can use nil skip set
+
+	// default "/"
+	if len(others) > 1 {
+		if v, ok := others[1].(string); ok && len(v) > 0 {
+			fmt.Fprintf(&b, "; Path=%s", sanitizeValue(v))
+		}
+	} else {
+		fmt.Fprintf(&b, "; Path=%s", "/")
+	}
+
+	// default empty
+	if len(others) > 2 {
+		if v, ok := others[2].(string); ok && len(v) > 0 {
+			fmt.Fprintf(&b, "; Domain=%s", sanitizeValue(v))
+		}
+	}
+
+	// default empty
+	if len(others) > 3 {
+		var secure bool
+		switch v := others[3].(type) {
+		case bool:
+			secure = v
+		default:
+			if others[3] != nil {
+				secure = true
+			}
+		}
+		if secure {
+			fmt.Fprintf(&b, "; Secure")
+		}
+	}
+
+	// default false. for session cookie default true
+	if len(others) > 4 {
+		if v, ok := others[4].(bool); ok && v {
+			fmt.Fprintf(&b, "; HttpOnly")
+		}
+	}
+
+	output.Context.ResponseWriter.Header().Add("Set-Cookie", b.String())
+}
+
+var cookieNameSanitizer = strings.NewReplacer("\n", "-", "\r", "-")
+
+func sanitizeName(n string) string {
+	return cookieNameSanitizer.Replace(n)
+}
+
+var cookieValueSanitizer = strings.NewReplacer("\n", " ", "\r", " ", ";", " ")
+
+func sanitizeValue(v string) string {
+	return cookieValueSanitizer.Replace(v)
+}
+
+func jsonRenderer(value interface{}) Renderer {
+	return rendererFunc(func(ctx *Context) {
+		ctx.Output.JSON(value, false, false)
+	})
+}
+
+func errorRenderer(err error) Renderer {
+	return rendererFunc(func(ctx *Context) {
+		ctx.Output.SetStatus(500)
+		ctx.Output.Body([]byte(err.Error()))
+	})
+}
+
+// JSON writes json to response body.
+// if encoding is true, it converts utf-8 to \u0000 type.
+func (output *BeegoOutput) JSON(data interface{}, hasIndent bool, encoding bool) error {
+	output.Header("Content-Type", "application/json; charset=utf-8")
+	var content []byte
+	var err error
+	if hasIndent {
+		content, err = json.MarshalIndent(data, "", "  ")
+	} else {
+		content, err = json.Marshal(data)
+	}
+	if err != nil {
+		http.Error(output.Context.ResponseWriter, err.Error(), http.StatusInternalServerError)
+		return err
+	}
+	if encoding {
+		content = []byte(stringsToJSON(string(content)))
+	}
+	return output.Body(content)
+}
+
+// YAML writes yaml to response body.
+func (output *BeegoOutput) YAML(data interface{}) error {
+	output.Header("Content-Type", "application/x-yaml; charset=utf-8")
+	var content []byte
+	var err error
+	content, err = yaml.Marshal(data)
+	if err != nil {
+		http.Error(output.Context.ResponseWriter, err.Error(), http.StatusInternalServerError)
+		return err
+	}
+	return output.Body(content)
+}
+
+// JSONP writes jsonp to response body.
+func (output *BeegoOutput) JSONP(data interface{}, hasIndent bool) error {
+	output.Header("Content-Type", "application/javascript; charset=utf-8")
+	var content []byte
+	var err error
+	if hasIndent {
+		content, err = json.MarshalIndent(data, "", "  ")
+	} else {
+		content, err = json.Marshal(data)
+	}
+	if err != nil {
+		http.Error(output.Context.ResponseWriter, err.Error(), http.StatusInternalServerError)
+		return err
+	}
+	callback := output.Context.Input.Query("callback")
+	if callback == "" {
+		return errors.New(`"callback" parameter required`)
+	}
+	callback = template.JSEscapeString(callback)
+	callbackContent := bytes.NewBufferString(" if(window." + callback + ")" + callback)
+	callbackContent.WriteString("(")
+	callbackContent.Write(content)
+	callbackContent.WriteString(");\r\n")
+	return output.Body(callbackContent.Bytes())
+}
+
+// XML writes xml string to response body.
+func (output *BeegoOutput) XML(data interface{}, hasIndent bool) error {
+	output.Header("Content-Type", "application/xml; charset=utf-8")
+	var content []byte
+	var err error
+	if hasIndent {
+		content, err = xml.MarshalIndent(data, "", "  ")
+	} else {
+		content, err = xml.Marshal(data)
+	}
+	if err != nil {
+		http.Error(output.Context.ResponseWriter, err.Error(), http.StatusInternalServerError)
+		return err
+	}
+	return output.Body(content)
+}
+
+// ServeFormatted serve YAML, XML OR JSON, depending on the value of the Accept header
+func (output *BeegoOutput) ServeFormatted(data interface{}, hasIndent bool, hasEncode ...bool) {
+	accept := output.Context.Input.Header("Accept")
+	switch accept {
+	case ApplicationYAML:
+		output.YAML(data)
+	case ApplicationXML, TextXML:
+		output.XML(data, hasIndent)
+	default:
+		output.JSON(data, hasIndent, len(hasEncode) > 0 && hasEncode[0])
+	}
+}
+
+// Download forces response for download file.
+// it prepares the download response header automatically.
+func (output *BeegoOutput) Download(file string, filename ...string) {
+	// check get file error, file not found or other error.
+	if _, err := os.Stat(file); err != nil {
+		http.ServeFile(output.Context.ResponseWriter, output.Context.Request, file)
+		return
+	}
+
+	var fName string
+	if len(filename) > 0 && filename[0] != "" {
+		fName = filename[0]
+	} else {
+		fName = filepath.Base(file)
+	}
+	//https://tools.ietf.org/html/rfc6266#section-4.3
+	fn := url.PathEscape(fName)
+	if fName == fn {
+		fn = "filename=" + fn
+	} else {
+		/**
+		  The parameters "filename" and "filename*" differ only in that
+		  "filename*" uses the encoding defined in [RFC5987], allowing the use
+		  of characters not present in the ISO-8859-1 character set
+		  ([ISO-8859-1]).
+		*/
+		fn = "filename=" + fName + "; filename*=utf-8''" + fn
+	}
+	output.Header("Content-Disposition", "attachment; "+fn)
+	output.Header("Content-Description", "File Transfer")
+	output.Header("Content-Type", "application/octet-stream")
+	output.Header("Content-Transfer-Encoding", "binary")
+	output.Header("Expires", "0")
+	output.Header("Cache-Control", "must-revalidate")
+	output.Header("Pragma", "public")
+	http.ServeFile(output.Context.ResponseWriter, output.Context.Request, file)
+}
+
+// ContentType sets the content type from ext string.
+// MIME type is given in mime package.
+func (output *BeegoOutput) ContentType(ext string) {
+	if !strings.HasPrefix(ext, ".") {
+		ext = "." + ext
+	}
+	ctype := mime.TypeByExtension(ext)
+	if ctype != "" {
+		output.Header("Content-Type", ctype)
+	}
+}
+
+// SetStatus sets response status code.
+// It writes response header directly.
+func (output *BeegoOutput) SetStatus(status int) {
+	output.Status = status
+}
+
+// IsCachable returns boolean of this request is cached.
+// HTTP 304 means cached.
+func (output *BeegoOutput) IsCachable() bool {
+	return output.Status >= 200 && output.Status < 300 || output.Status == 304
+}
+
+// IsEmpty returns boolean of this request is empty.
+// HTTP 201，204 and 304 means empty.
+func (output *BeegoOutput) IsEmpty() bool {
+	return output.Status == 201 || output.Status == 204 || output.Status == 304
+}
+
+// IsOk returns boolean of this request runs well.
+// HTTP 200 means ok.
+func (output *BeegoOutput) IsOk() bool {
+	return output.Status == 200
+}
+
+// IsSuccessful returns boolean of this request runs successfully.
+// HTTP 2xx means ok.
+func (output *BeegoOutput) IsSuccessful() bool {
+	return output.Status >= 200 && output.Status < 300
+}
+
+// IsRedirect returns boolean of this request is redirection header.
+// HTTP 301,302,307 means redirection.
+func (output *BeegoOutput) IsRedirect() bool {
+	return output.Status == 301 || output.Status == 302 || output.Status == 303 || output.Status == 307
+}
+
+// IsForbidden returns boolean of this request is forbidden.
+// HTTP 403 means forbidden.
+func (output *BeegoOutput) IsForbidden() bool {
+	return output.Status == 403
+}
+
+// IsNotFound returns boolean of this request is not found.
+// HTTP 404 means not found.
+func (output *BeegoOutput) IsNotFound() bool {
+	return output.Status == 404
+}
+
+// IsClientError returns boolean of this request client sends error data.
+// HTTP 4xx means client error.
+func (output *BeegoOutput) IsClientError() bool {
+	return output.Status >= 400 && output.Status < 500
+}
+
+// IsServerError returns boolean of this server handler errors.
+// HTTP 5xx means server internal error.
+func (output *BeegoOutput) IsServerError() bool {
+	return output.Status >= 500 && output.Status < 600
+}
+
+func stringsToJSON(str string) string {
+	var jsons bytes.Buffer
+	for _, r := range str {
+		rint := int(r)
+		if rint < 128 {
+			jsons.WriteRune(r)
+		} else {
+			jsons.WriteString("\\u")
+			if rint < 0x100 {
+				jsons.WriteString("00")
+			} else if rint < 0x1000 {
+				jsons.WriteString("0")
+			}
+			jsons.WriteString(strconv.FormatInt(int64(rint), 16))
+		}
+	}
+	return jsons.String()
+}
+
+// Session sets session item value with given key.
+func (output *BeegoOutput) Session(name interface{}, value interface{}) {
+	output.Context.Input.CruSession.Set(name, value)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/param/conv.go

@@ -0,0 +1,78 @@
+package param
+
+import (
+	"fmt"
+	"reflect"
+
+	beecontext "github.com/astaxie/beego/context"
+	"github.com/astaxie/beego/logs"
+)
+
+// ConvertParams converts http method params to values that will be passed to the method controller as arguments
+func ConvertParams(methodParams []*MethodParam, methodType reflect.Type, ctx *beecontext.Context) (result []reflect.Value) {
+	result = make([]reflect.Value, 0, len(methodParams))
+	for i := 0; i < len(methodParams); i++ {
+		reflectValue := convertParam(methodParams[i], methodType.In(i), ctx)
+		result = append(result, reflectValue)
+	}
+	return
+}
+
+func convertParam(param *MethodParam, paramType reflect.Type, ctx *beecontext.Context) (result reflect.Value) {
+	paramValue := getParamValue(param, ctx)
+	if paramValue == "" {
+		if param.required {
+			ctx.Abort(400, fmt.Sprintf("Missing parameter %s", param.name))
+		} else {
+			paramValue = param.defaultValue
+		}
+	}
+
+	reflectValue, err := parseValue(param, paramValue, paramType)
+	if err != nil {
+		logs.Debug(fmt.Sprintf("Error converting param %s to type %s. Value: %v, Error: %s", param.name, paramType, paramValue, err))
+		ctx.Abort(400, fmt.Sprintf("Invalid parameter %s. Can not convert %v to type %s", param.name, paramValue, paramType))
+	}
+
+	return reflectValue
+}
+
+func getParamValue(param *MethodParam, ctx *beecontext.Context) string {
+	switch param.in {
+	case body:
+		return string(ctx.Input.RequestBody)
+	case header:
+		return ctx.Input.Header(param.name)
+	case path:
+		return ctx.Input.Query(":" + param.name)
+	default:
+		return ctx.Input.Query(param.name)
+	}
+}
+
+func parseValue(param *MethodParam, paramValue string, paramType reflect.Type) (result reflect.Value, err error) {
+	if paramValue == "" {
+		return reflect.Zero(paramType), nil
+	}
+	parser := getParser(param, paramType)
+	value, err := parser.parse(paramValue, paramType)
+	if err != nil {
+		return result, err
+	}
+
+	return safeConvert(reflect.ValueOf(value), paramType)
+}
+
+func safeConvert(value reflect.Value, t reflect.Type) (result reflect.Value, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			var ok bool
+			err, ok = r.(error)
+			if !ok {
+				err = fmt.Errorf("%v", r)
+			}
+		}
+	}()
+	result = value.Convert(t)
+	return
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/param/methodparams.go

@@ -0,0 +1,69 @@
+package param
+
+import (
+	"fmt"
+	"strings"
+)
+
+//MethodParam keeps param information to be auto passed to controller methods
+type MethodParam struct {
+	name         string
+	in           paramType
+	required     bool
+	defaultValue string
+}
+
+type paramType byte
+
+const (
+	param paramType = iota
+	path
+	body
+	header
+)
+
+//New creates a new MethodParam with name and specific options
+func New(name string, opts ...MethodParamOption) *MethodParam {
+	return newParam(name, nil, opts)
+}
+
+func newParam(name string, parser paramParser, opts []MethodParamOption) (param *MethodParam) {
+	param = &MethodParam{name: name}
+	for _, option := range opts {
+		option(param)
+	}
+	return
+}
+
+//Make creates an array of MethodParmas or an empty array
+func Make(list ...*MethodParam) []*MethodParam {
+	if len(list) > 0 {
+		return list
+	}
+	return nil
+}
+
+func (mp *MethodParam) String() string {
+	options := []string{}
+	result := "param.New(\"" + mp.name + "\""
+	if mp.required {
+		options = append(options, "param.IsRequired")
+	}
+	switch mp.in {
+	case path:
+		options = append(options, "param.InPath")
+	case body:
+		options = append(options, "param.InBody")
+	case header:
+		options = append(options, "param.InHeader")
+	}
+	if mp.defaultValue != "" {
+		options = append(options, fmt.Sprintf(`param.Default("%s")`, mp.defaultValue))
+	}
+	if len(options) > 0 {
+		result += ", "
+	}
+	result += strings.Join(options, ", ")
+	result += ")"
+	return result
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/param/options.go

@@ -0,0 +1,37 @@
+package param
+
+import (
+	"fmt"
+)
+
+// MethodParamOption defines a func which apply options on a MethodParam
+type MethodParamOption func(*MethodParam)
+
+// IsRequired indicates that this param is required and can not be omitted from the http request
+var IsRequired MethodParamOption = func(p *MethodParam) {
+	p.required = true
+}
+
+// InHeader indicates that this param is passed via an http header
+var InHeader MethodParamOption = func(p *MethodParam) {
+	p.in = header
+}
+
+// InPath indicates that this param is part of the URL path
+var InPath MethodParamOption = func(p *MethodParam) {
+	p.in = path
+}
+
+// InBody indicates that this param is passed as an http request body
+var InBody MethodParamOption = func(p *MethodParam) {
+	p.in = body
+}
+
+// Default provides a default value for the http param
+func Default(defaultValue interface{}) MethodParamOption {
+	return func(p *MethodParam) {
+		if defaultValue != nil {
+			p.defaultValue = fmt.Sprint(defaultValue)
+		}
+	}
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/param/parsers.go

@@ -0,0 +1,149 @@
+package param
+
+import (
+	"encoding/json"
+	"reflect"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type paramParser interface {
+	parse(value string, toType reflect.Type) (interface{}, error)
+}
+
+func getParser(param *MethodParam, t reflect.Type) paramParser {
+	switch t.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return intParser{}
+	case reflect.Slice:
+		if t.Elem().Kind() == reflect.Uint8 { //treat []byte as string
+			return stringParser{}
+		}
+		if param.in == body {
+			return jsonParser{}
+		}
+		elemParser := getParser(param, t.Elem())
+		if elemParser == (jsonParser{}) {
+			return elemParser
+		}
+		return sliceParser(elemParser)
+	case reflect.Bool:
+		return boolParser{}
+	case reflect.String:
+		return stringParser{}
+	case reflect.Float32, reflect.Float64:
+		return floatParser{}
+	case reflect.Ptr:
+		elemParser := getParser(param, t.Elem())
+		if elemParser == (jsonParser{}) {
+			return elemParser
+		}
+		return ptrParser(elemParser)
+	default:
+		if t.PkgPath() == "time" && t.Name() == "Time" {
+			return timeParser{}
+		}
+		return jsonParser{}
+	}
+}
+
+type parserFunc func(value string, toType reflect.Type) (interface{}, error)
+
+func (f parserFunc) parse(value string, toType reflect.Type) (interface{}, error) {
+	return f(value, toType)
+}
+
+type boolParser struct {
+}
+
+func (p boolParser) parse(value string, toType reflect.Type) (interface{}, error) {
+	return strconv.ParseBool(value)
+}
+
+type stringParser struct {
+}
+
+func (p stringParser) parse(value string, toType reflect.Type) (interface{}, error) {
+	return value, nil
+}
+
+type intParser struct {
+}
+
+func (p intParser) parse(value string, toType reflect.Type) (interface{}, error) {
+	return strconv.Atoi(value)
+}
+
+type floatParser struct {
+}
+
+func (p floatParser) parse(value string, toType reflect.Type) (interface{}, error) {
+	if toType.Kind() == reflect.Float32 {
+		res, err := strconv.ParseFloat(value, 32)
+		if err != nil {
+			return nil, err
+		}
+		return float32(res), nil
+	}
+	return strconv.ParseFloat(value, 64)
+}
+
+type timeParser struct {
+}
+
+func (p timeParser) parse(value string, toType reflect.Type) (result interface{}, err error) {
+	result, err = time.Parse(time.RFC3339, value)
+	if err != nil {
+		result, err = time.Parse("2006-01-02", value)
+	}
+	return
+}
+
+type jsonParser struct {
+}
+
+func (p jsonParser) parse(value string, toType reflect.Type) (interface{}, error) {
+	pResult := reflect.New(toType)
+	v := pResult.Interface()
+	err := json.Unmarshal([]byte(value), v)
+	if err != nil {
+		return nil, err
+	}
+	return pResult.Elem().Interface(), nil
+}
+
+func sliceParser(elemParser paramParser) paramParser {
+	return parserFunc(func(value string, toType reflect.Type) (interface{}, error) {
+		values := strings.Split(value, ",")
+		result := reflect.MakeSlice(toType, 0, len(values))
+		elemType := toType.Elem()
+		for _, v := range values {
+			parsedValue, err := elemParser.parse(v, elemType)
+			if err != nil {
+				return nil, err
+			}
+			result = reflect.Append(result, reflect.ValueOf(parsedValue))
+		}
+		return result.Interface(), nil
+	})
+}
+
+func ptrParser(elemParser paramParser) paramParser {
+	return parserFunc(func(value string, toType reflect.Type) (interface{}, error) {
+		parsedValue, err := elemParser.parse(value, toType.Elem())
+		if err != nil {
+			return nil, err
+		}
+		newValPtr := reflect.New(toType.Elem())
+		newVal := reflect.Indirect(newValPtr)
+		convertedVal, err := safeConvert(reflect.ValueOf(parsedValue), toType.Elem())
+		if err != nil {
+			return nil, err
+		}
+
+		newVal.Set(convertedVal)
+		return newValPtr.Interface(), nil
+	})
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/renderer.go

@@ -0,0 +1,12 @@
+package context
+
+// Renderer defines an http response renderer
+type Renderer interface {
+	Render(ctx *Context)
+}
+
+type rendererFunc func(ctx *Context)
+
+func (f rendererFunc) Render(ctx *Context) {
+	f(ctx)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/context/response.go

@@ -0,0 +1,27 @@
+package context
+
+import (
+	"strconv"
+
+	"net/http"
+)
+
+const (
+	//BadRequest indicates http error 400
+	BadRequest StatusCode = http.StatusBadRequest
+
+	//NotFound indicates http error 404
+	NotFound StatusCode = http.StatusNotFound
+)
+
+// StatusCode sets the http response status code
+type StatusCode int
+
+func (s StatusCode) Error() string {
+	return strconv.Itoa(int(s))
+}
+
+// Render sets the http status code
+func (s StatusCode) Render(ctx *Context) {
+	ctx.Output.SetStatus(int(s))
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/controller.go

@@ -0,0 +1,706 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"html/template"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/url"
+	"os"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"github.com/astaxie/beego/context"
+	"github.com/astaxie/beego/context/param"
+	"github.com/astaxie/beego/session"
+)
+
+var (
+	// ErrAbort custom error when user stop request handler manually.
+	ErrAbort = errors.New("user stop run")
+	// GlobalControllerRouter store comments with controller. pkgpath+controller:comments
+	GlobalControllerRouter = make(map[string][]ControllerComments)
+)
+
+// ControllerFilter store the filter for controller
+type ControllerFilter struct {
+	Pattern        string
+	Pos            int
+	Filter         FilterFunc
+	ReturnOnOutput bool
+	ResetParams    bool
+}
+
+// ControllerFilterComments store the comment for controller level filter
+type ControllerFilterComments struct {
+	Pattern        string
+	Pos            int
+	Filter         string // NOQA
+	ReturnOnOutput bool
+	ResetParams    bool
+}
+
+// ControllerImportComments store the import comment for controller needed
+type ControllerImportComments struct {
+	ImportPath  string
+	ImportAlias string
+}
+
+// ControllerComments store the comment for the controller method
+type ControllerComments struct {
+	Method           string
+	Router           string
+	Filters          []*ControllerFilter
+	ImportComments   []*ControllerImportComments
+	FilterComments   []*ControllerFilterComments
+	AllowHTTPMethods []string
+	Params           []map[string]string
+	MethodParams     []*param.MethodParam
+}
+
+// ControllerCommentsSlice implements the sort interface
+type ControllerCommentsSlice []ControllerComments
+
+func (p ControllerCommentsSlice) Len() int           { return len(p) }
+func (p ControllerCommentsSlice) Less(i, j int) bool { return p[i].Router < p[j].Router }
+func (p ControllerCommentsSlice) Swap(i, j int)      { p[i], p[j] = p[j], p[i] }
+
+// Controller defines some basic http request handler operations, such as
+// http context, template and view, session and xsrf.
+type Controller struct {
+	// context data
+	Ctx  *context.Context
+	Data map[interface{}]interface{}
+
+	// route controller info
+	controllerName string
+	actionName     string
+	methodMapping  map[string]func() //method:routertree
+	AppController  interface{}
+
+	// template data
+	TplName        string
+	ViewPath       string
+	Layout         string
+	LayoutSections map[string]string // the key is the section name and the value is the template name
+	TplPrefix      string
+	TplExt         string
+	EnableRender   bool
+
+	// xsrf data
+	_xsrfToken string
+	XSRFExpire int
+	EnableXSRF bool
+
+	// session
+	CruSession session.Store
+}
+
+// ControllerInterface is an interface to uniform all controller handler.
+type ControllerInterface interface {
+	Init(ct *context.Context, controllerName, actionName string, app interface{})
+	Prepare()
+	Get()
+	Post()
+	Delete()
+	Put()
+	Head()
+	Patch()
+	Options()
+	Trace()
+	Finish()
+	Render() error
+	XSRFToken() string
+	CheckXSRFCookie() bool
+	HandlerFunc(fn string) bool
+	URLMapping()
+}
+
+// Init generates default values of controller operations.
+func (c *Controller) Init(ctx *context.Context, controllerName, actionName string, app interface{}) {
+	c.Layout = ""
+	c.TplName = ""
+	c.controllerName = controllerName
+	c.actionName = actionName
+	c.Ctx = ctx
+	c.TplExt = "tpl"
+	c.AppController = app
+	c.EnableRender = true
+	c.EnableXSRF = true
+	c.Data = ctx.Input.Data()
+	c.methodMapping = make(map[string]func())
+}
+
+// Prepare runs after Init before request function execution.
+func (c *Controller) Prepare() {}
+
+// Finish runs after request function execution.
+func (c *Controller) Finish() {}
+
+// Get adds a request function to handle GET request.
+func (c *Controller) Get() {
+	http.Error(c.Ctx.ResponseWriter, "Method Not Allowed", http.StatusMethodNotAllowed)
+}
+
+// Post adds a request function to handle POST request.
+func (c *Controller) Post() {
+	http.Error(c.Ctx.ResponseWriter, "Method Not Allowed", http.StatusMethodNotAllowed)
+}
+
+// Delete adds a request function to handle DELETE request.
+func (c *Controller) Delete() {
+	http.Error(c.Ctx.ResponseWriter, "Method Not Allowed", http.StatusMethodNotAllowed)
+}
+
+// Put adds a request function to handle PUT request.
+func (c *Controller) Put() {
+	http.Error(c.Ctx.ResponseWriter, "Method Not Allowed", http.StatusMethodNotAllowed)
+}
+
+// Head adds a request function to handle HEAD request.
+func (c *Controller) Head() {
+	http.Error(c.Ctx.ResponseWriter, "Method Not Allowed", http.StatusMethodNotAllowed)
+}
+
+// Patch adds a request function to handle PATCH request.
+func (c *Controller) Patch() {
+	http.Error(c.Ctx.ResponseWriter, "Method Not Allowed", http.StatusMethodNotAllowed)
+}
+
+// Options adds a request function to handle OPTIONS request.
+func (c *Controller) Options() {
+	http.Error(c.Ctx.ResponseWriter, "Method Not Allowed", http.StatusMethodNotAllowed)
+}
+
+// Trace adds a request function to handle Trace request.
+// this method SHOULD NOT be overridden.
+// https://tools.ietf.org/html/rfc7231#section-4.3.8
+// The TRACE method requests a remote, application-level loop-back of
+// the request message.  The final recipient of the request SHOULD
+// reflect the message received, excluding some fields described below,
+// back to the client as the message body of a 200 (OK) response with a
+// Content-Type of "message/http" (Section 8.3.1 of [RFC7230]).
+func (c *Controller) Trace() {
+	ts := func(h http.Header) (hs string) {
+		for k, v := range h {
+			hs += fmt.Sprintf("\r\n%s: %s", k, v)
+		}
+		return
+	}
+	hs := fmt.Sprintf("\r\nTRACE %s %s%s\r\n", c.Ctx.Request.RequestURI, c.Ctx.Request.Proto, ts(c.Ctx.Request.Header))
+	c.Ctx.Output.Header("Content-Type", "message/http")
+	c.Ctx.Output.Header("Content-Length", fmt.Sprint(len(hs)))
+	c.Ctx.Output.Header("Cache-Control", "no-cache, no-store, must-revalidate")
+	c.Ctx.WriteString(hs)
+}
+
+// HandlerFunc call function with the name
+func (c *Controller) HandlerFunc(fnname string) bool {
+	if v, ok := c.methodMapping[fnname]; ok {
+		v()
+		return true
+	}
+	return false
+}
+
+// URLMapping register the internal Controller router.
+func (c *Controller) URLMapping() {}
+
+// Mapping the method to function
+func (c *Controller) Mapping(method string, fn func()) {
+	c.methodMapping[method] = fn
+}
+
+// Render sends the response with rendered template bytes as text/html type.
+func (c *Controller) Render() error {
+	if !c.EnableRender {
+		return nil
+	}
+	rb, err := c.RenderBytes()
+	if err != nil {
+		return err
+	}
+
+	if c.Ctx.ResponseWriter.Header().Get("Content-Type") == "" {
+		c.Ctx.Output.Header("Content-Type", "text/html; charset=utf-8")
+	}
+
+	return c.Ctx.Output.Body(rb)
+}
+
+// RenderString returns the rendered template string. Do not send out response.
+func (c *Controller) RenderString() (string, error) {
+	b, e := c.RenderBytes()
+	return string(b), e
+}
+
+// RenderBytes returns the bytes of rendered template string. Do not send out response.
+func (c *Controller) RenderBytes() ([]byte, error) {
+	buf, err := c.renderTemplate()
+	//if the controller has set layout, then first get the tplName's content set the content to the layout
+	if err == nil && c.Layout != "" {
+		c.Data["LayoutContent"] = template.HTML(buf.String())
+
+		if c.LayoutSections != nil {
+			for sectionName, sectionTpl := range c.LayoutSections {
+				if sectionTpl == "" {
+					c.Data[sectionName] = ""
+					continue
+				}
+				buf.Reset()
+				err = ExecuteViewPathTemplate(&buf, sectionTpl, c.viewPath(), c.Data)
+				if err != nil {
+					return nil, err
+				}
+				c.Data[sectionName] = template.HTML(buf.String())
+			}
+		}
+
+		buf.Reset()
+		ExecuteViewPathTemplate(&buf, c.Layout, c.viewPath(), c.Data)
+	}
+	return buf.Bytes(), err
+}
+
+func (c *Controller) renderTemplate() (bytes.Buffer, error) {
+	var buf bytes.Buffer
+	if c.TplName == "" {
+		c.TplName = strings.ToLower(c.controllerName) + "/" + strings.ToLower(c.actionName) + "." + c.TplExt
+	}
+	if c.TplPrefix != "" {
+		c.TplName = c.TplPrefix + c.TplName
+	}
+	if BConfig.RunMode == DEV {
+		buildFiles := []string{c.TplName}
+		if c.Layout != "" {
+			buildFiles = append(buildFiles, c.Layout)
+			if c.LayoutSections != nil {
+				for _, sectionTpl := range c.LayoutSections {
+					if sectionTpl == "" {
+						continue
+					}
+					buildFiles = append(buildFiles, sectionTpl)
+				}
+			}
+		}
+		BuildTemplate(c.viewPath(), buildFiles...)
+	}
+	return buf, ExecuteViewPathTemplate(&buf, c.TplName, c.viewPath(), c.Data)
+}
+
+func (c *Controller) viewPath() string {
+	if c.ViewPath == "" {
+		return BConfig.WebConfig.ViewsPath
+	}
+	return c.ViewPath
+}
+
+// Redirect sends the redirection response to url with status code.
+func (c *Controller) Redirect(url string, code int) {
+	LogAccess(c.Ctx, nil, code)
+	c.Ctx.Redirect(code, url)
+}
+
+// SetData set the data depending on the accepted
+func (c *Controller) SetData(data interface{}) {
+	accept := c.Ctx.Input.Header("Accept")
+	switch accept {
+	case context.ApplicationYAML:
+		c.Data["yaml"] = data
+	case context.ApplicationXML, context.TextXML:
+		c.Data["xml"] = data
+	default:
+		c.Data["json"] = data
+	}
+}
+
+// Abort stops controller handler and show the error data if code is defined in ErrorMap or code string.
+func (c *Controller) Abort(code string) {
+	status, err := strconv.Atoi(code)
+	if err != nil {
+		status = 200
+	}
+	c.CustomAbort(status, code)
+}
+
+// CustomAbort stops controller handler and show the error data, it's similar Aborts, but support status code and body.
+func (c *Controller) CustomAbort(status int, body string) {
+	// first panic from ErrorMaps, it is user defined error functions.
+	if _, ok := ErrorMaps[body]; ok {
+		c.Ctx.Output.Status = status
+		panic(body)
+	}
+	// last panic user string
+	c.Ctx.ResponseWriter.WriteHeader(status)
+	c.Ctx.ResponseWriter.Write([]byte(body))
+	panic(ErrAbort)
+}
+
+// StopRun makes panic of USERSTOPRUN error and go to recover function if defined.
+func (c *Controller) StopRun() {
+	panic(ErrAbort)
+}
+
+// URLFor does another controller handler in this request function.
+// it goes to this controller method if endpoint is not clear.
+func (c *Controller) URLFor(endpoint string, values ...interface{}) string {
+	if len(endpoint) == 0 {
+		return ""
+	}
+	if endpoint[0] == '.' {
+		return URLFor(reflect.Indirect(reflect.ValueOf(c.AppController)).Type().Name()+endpoint, values...)
+	}
+	return URLFor(endpoint, values...)
+}
+
+// ServeJSON sends a json response with encoding charset.
+func (c *Controller) ServeJSON(encoding ...bool) {
+	var (
+		hasIndent   = BConfig.RunMode != PROD
+		hasEncoding = len(encoding) > 0 && encoding[0]
+	)
+
+	c.Ctx.Output.JSON(c.Data["json"], hasIndent, hasEncoding)
+}
+
+// ServeJSONP sends a jsonp response.
+func (c *Controller) ServeJSONP() {
+	hasIndent := BConfig.RunMode != PROD
+	c.Ctx.Output.JSONP(c.Data["jsonp"], hasIndent)
+}
+
+// ServeXML sends xml response.
+func (c *Controller) ServeXML() {
+	hasIndent := BConfig.RunMode != PROD
+	c.Ctx.Output.XML(c.Data["xml"], hasIndent)
+}
+
+// ServeYAML sends yaml response.
+func (c *Controller) ServeYAML() {
+	c.Ctx.Output.YAML(c.Data["yaml"])
+}
+
+// ServeFormatted serve YAML, XML OR JSON, depending on the value of the Accept header
+func (c *Controller) ServeFormatted(encoding ...bool) {
+	hasIndent := BConfig.RunMode != PROD
+	hasEncoding := len(encoding) > 0 && encoding[0]
+	c.Ctx.Output.ServeFormatted(c.Data, hasIndent, hasEncoding)
+}
+
+// Input returns the input data map from POST or PUT request body and query string.
+func (c *Controller) Input() url.Values {
+	if c.Ctx.Request.Form == nil {
+		c.Ctx.Request.ParseForm()
+	}
+	return c.Ctx.Request.Form
+}
+
+// ParseForm maps input data map to obj struct.
+func (c *Controller) ParseForm(obj interface{}) error {
+	return ParseForm(c.Input(), obj)
+}
+
+// GetString returns the input value by key string or the default value while it's present and input is blank
+func (c *Controller) GetString(key string, def ...string) string {
+	if v := c.Ctx.Input.Query(key); v != "" {
+		return v
+	}
+	if len(def) > 0 {
+		return def[0]
+	}
+	return ""
+}
+
+// GetStrings returns the input string slice by key string or the default value while it's present and input is blank
+// it's designed for multi-value input field such as checkbox(input[type=checkbox]), multi-selection.
+func (c *Controller) GetStrings(key string, def ...[]string) []string {
+	var defv []string
+	if len(def) > 0 {
+		defv = def[0]
+	}
+
+	if f := c.Input(); f == nil {
+		return defv
+	} else if vs := f[key]; len(vs) > 0 {
+		return vs
+	}
+
+	return defv
+}
+
+// GetInt returns input as an int or the default value while it's present and input is blank
+func (c *Controller) GetInt(key string, def ...int) (int, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	return strconv.Atoi(strv)
+}
+
+// GetInt8 return input as an int8 or the default value while it's present and input is blank
+func (c *Controller) GetInt8(key string, def ...int8) (int8, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	i64, err := strconv.ParseInt(strv, 10, 8)
+	return int8(i64), err
+}
+
+// GetUint8 return input as an uint8 or the default value while it's present and input is blank
+func (c *Controller) GetUint8(key string, def ...uint8) (uint8, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	u64, err := strconv.ParseUint(strv, 10, 8)
+	return uint8(u64), err
+}
+
+// GetInt16 returns input as an int16 or the default value while it's present and input is blank
+func (c *Controller) GetInt16(key string, def ...int16) (int16, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	i64, err := strconv.ParseInt(strv, 10, 16)
+	return int16(i64), err
+}
+
+// GetUint16 returns input as an uint16 or the default value while it's present and input is blank
+func (c *Controller) GetUint16(key string, def ...uint16) (uint16, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	u64, err := strconv.ParseUint(strv, 10, 16)
+	return uint16(u64), err
+}
+
+// GetInt32 returns input as an int32 or the default value while it's present and input is blank
+func (c *Controller) GetInt32(key string, def ...int32) (int32, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	i64, err := strconv.ParseInt(strv, 10, 32)
+	return int32(i64), err
+}
+
+// GetUint32 returns input as an uint32 or the default value while it's present and input is blank
+func (c *Controller) GetUint32(key string, def ...uint32) (uint32, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	u64, err := strconv.ParseUint(strv, 10, 32)
+	return uint32(u64), err
+}
+
+// GetInt64 returns input value as int64 or the default value while it's present and input is blank.
+func (c *Controller) GetInt64(key string, def ...int64) (int64, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	return strconv.ParseInt(strv, 10, 64)
+}
+
+// GetUint64 returns input value as uint64 or the default value while it's present and input is blank.
+func (c *Controller) GetUint64(key string, def ...uint64) (uint64, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	return strconv.ParseUint(strv, 10, 64)
+}
+
+// GetBool returns input value as bool or the default value while it's present and input is blank.
+func (c *Controller) GetBool(key string, def ...bool) (bool, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	return strconv.ParseBool(strv)
+}
+
+// GetFloat returns input value as float64 or the default value while it's present and input is blank.
+func (c *Controller) GetFloat(key string, def ...float64) (float64, error) {
+	strv := c.Ctx.Input.Query(key)
+	if len(strv) == 0 && len(def) > 0 {
+		return def[0], nil
+	}
+	return strconv.ParseFloat(strv, 64)
+}
+
+// GetFile returns the file data in file upload field named as key.
+// it returns the first one of multi-uploaded files.
+func (c *Controller) GetFile(key string) (multipart.File, *multipart.FileHeader, error) {
+	return c.Ctx.Request.FormFile(key)
+}
+
+// GetFiles return multi-upload files
+// files, err:=c.GetFiles("myfiles")
+//	if err != nil {
+//		http.Error(w, err.Error(), http.StatusNoContent)
+//		return
+//	}
+// for i, _ := range files {
+//	//for each fileheader, get a handle to the actual file
+//	file, err := files[i].Open()
+//	defer file.Close()
+//	if err != nil {
+//		http.Error(w, err.Error(), http.StatusInternalServerError)
+//		return
+//	}
+//	//create destination file making sure the path is writeable.
+//	dst, err := os.Create("upload/" + files[i].Filename)
+//	defer dst.Close()
+//	if err != nil {
+//		http.Error(w, err.Error(), http.StatusInternalServerError)
+//		return
+//	}
+//	//copy the uploaded file to the destination file
+//	if _, err := io.Copy(dst, file); err != nil {
+//		http.Error(w, err.Error(), http.StatusInternalServerError)
+//		return
+//	}
+// }
+func (c *Controller) GetFiles(key string) ([]*multipart.FileHeader, error) {
+	if files, ok := c.Ctx.Request.MultipartForm.File[key]; ok {
+		return files, nil
+	}
+	return nil, http.ErrMissingFile
+}
+
+// SaveToFile saves uploaded file to new path.
+// it only operates the first one of mutil-upload form file field.
+func (c *Controller) SaveToFile(fromfile, tofile string) error {
+	file, _, err := c.Ctx.Request.FormFile(fromfile)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	f, err := os.OpenFile(tofile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0666)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	io.Copy(f, file)
+	return nil
+}
+
+// StartSession starts session and load old session data info this controller.
+func (c *Controller) StartSession() session.Store {
+	if c.CruSession == nil {
+		c.CruSession = c.Ctx.Input.CruSession
+	}
+	return c.CruSession
+}
+
+// SetSession puts value into session.
+func (c *Controller) SetSession(name interface{}, value interface{}) {
+	if c.CruSession == nil {
+		c.StartSession()
+	}
+	c.CruSession.Set(name, value)
+}
+
+// GetSession gets value from session.
+func (c *Controller) GetSession(name interface{}) interface{} {
+	if c.CruSession == nil {
+		c.StartSession()
+	}
+	return c.CruSession.Get(name)
+}
+
+// DelSession removes value from session.
+func (c *Controller) DelSession(name interface{}) {
+	if c.CruSession == nil {
+		c.StartSession()
+	}
+	c.CruSession.Delete(name)
+}
+
+// SessionRegenerateID regenerates session id for this session.
+// the session data have no changes.
+func (c *Controller) SessionRegenerateID() {
+	if c.CruSession != nil {
+		c.CruSession.SessionRelease(c.Ctx.ResponseWriter)
+	}
+	c.CruSession = GlobalSessions.SessionRegenerateID(c.Ctx.ResponseWriter, c.Ctx.Request)
+	c.Ctx.Input.CruSession = c.CruSession
+}
+
+// DestroySession cleans session data and session cookie.
+func (c *Controller) DestroySession() {
+	c.Ctx.Input.CruSession.Flush()
+	c.Ctx.Input.CruSession = nil
+	GlobalSessions.SessionDestroy(c.Ctx.ResponseWriter, c.Ctx.Request)
+}
+
+// IsAjax returns this request is ajax or not.
+func (c *Controller) IsAjax() bool {
+	return c.Ctx.Input.IsAjax()
+}
+
+// GetSecureCookie returns decoded cookie value from encoded browser cookie values.
+func (c *Controller) GetSecureCookie(Secret, key string) (string, bool) {
+	return c.Ctx.GetSecureCookie(Secret, key)
+}
+
+// SetSecureCookie puts value into cookie after encoded the value.
+func (c *Controller) SetSecureCookie(Secret, name, value string, others ...interface{}) {
+	c.Ctx.SetSecureCookie(Secret, name, value, others...)
+}
+
+// XSRFToken creates a CSRF token string and returns.
+func (c *Controller) XSRFToken() string {
+	if c._xsrfToken == "" {
+		expire := int64(BConfig.WebConfig.XSRFExpire)
+		if c.XSRFExpire > 0 {
+			expire = int64(c.XSRFExpire)
+		}
+		c._xsrfToken = c.Ctx.XSRFToken(BConfig.WebConfig.XSRFKey, expire)
+	}
+	return c._xsrfToken
+}
+
+// CheckXSRFCookie checks xsrf token in this request is valid or not.
+// the token can provided in request header "X-Xsrftoken" and "X-CsrfToken"
+// or in form field value named as "_xsrf".
+func (c *Controller) CheckXSRFCookie() bool {
+	if !c.EnableXSRF {
+		return true
+	}
+	return c.Ctx.CheckXSRFCookie()
+}
+
+// XSRFFormHTML writes an input field contains xsrf token value.
+func (c *Controller) XSRFFormHTML() string {
+	return `<input type="hidden" name="_xsrf" value="` +
+		c.XSRFToken() + `" />`
+}
+
+// GetControllerAndAction gets the executing controller name and action name.
+func (c *Controller) GetControllerAndAction() (string, string) {
+	return c.controllerName, c.actionName
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/doc.go

@@ -0,0 +1,17 @@
+/*
+Package beego provide a MVC framework
+beego: an open-source, high-performance, modular, full-stack web framework
+
+It is used for rapid development of RESTful APIs, web apps and backend services in Go.
+beego is inspired by Tornado, Sinatra and Flask with the added benefit of some Go-specific features such as interfaces and struct embedding.
+
+	package main
+	import "github.com/astaxie/beego"
+
+	func main() {
+	 beego.Run()
+	}
+
+more information: http://beego.me
+*/
+package beego

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/error.go

@@ -0,0 +1,488 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"fmt"
+	"html/template"
+	"net/http"
+	"reflect"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"github.com/astaxie/beego/context"
+	"github.com/astaxie/beego/utils"
+)
+
+const (
+	errorTypeHandler = iota
+	errorTypeController
+)
+
+var tpl = `
+<!DOCTYPE html>
+<html>
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+    <title>beego application error</title>
+    <style>
+        html, body, body * {padding: 0; margin: 0;}
+        #header {background:#ffd; border-bottom:solid 2px #A31515; padding: 20px 10px;}
+        #header h2{ }
+        #footer {border-top:solid 1px #aaa; padding: 5px 10px; font-size: 12px; color:green;}
+        #content {padding: 5px;}
+        #content .stack b{ font-size: 13px; color: red;}
+        #content .stack pre{padding-left: 10px;}
+        table {}
+        td.t {text-align: right; padding-right: 5px; color: #888;}
+    </style>
+    <script type="text/javascript">
+    </script>
+</head>
+<body>
+    <div id="header">
+        <h2>{{.AppError}}</h2>
+    </div>
+    <div id="content">
+        <table>
+            <tr>
+                <td class="t">Request Method: </td><td>{{.RequestMethod}}</td>
+            </tr>
+            <tr>
+                <td class="t">Request URL: </td><td>{{.RequestURL}}</td>
+            </tr>
+            <tr>
+                <td class="t">RemoteAddr: </td><td>{{.RemoteAddr }}</td>
+            </tr>
+        </table>
+        <div class="stack">
+            <b>Stack</b>
+            <pre>{{.Stack}}</pre>
+        </div>
+    </div>
+    <div id="footer">
+        <p>beego {{ .BeegoVersion }} (beego framework)</p>
+        <p>golang version: {{.GoVersion}}</p>
+    </div>
+</body>
+</html>
+`
+
+// render default application error page with error and stack string.
+func showErr(err interface{}, ctx *context.Context, stack string) {
+	t, _ := template.New("beegoerrortemp").Parse(tpl)
+	data := map[string]string{
+		"AppError":      fmt.Sprintf("%s:%v", BConfig.AppName, err),
+		"RequestMethod": ctx.Input.Method(),
+		"RequestURL":    ctx.Input.URI(),
+		"RemoteAddr":    ctx.Input.IP(),
+		"Stack":         stack,
+		"BeegoVersion":  VERSION,
+		"GoVersion":     runtime.Version(),
+	}
+	t.Execute(ctx.ResponseWriter, data)
+}
+
+var errtpl = `
+<!DOCTYPE html>
+<html lang="en">
+	<head>
+		<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+		<title>{{.Title}}</title>
+		<style type="text/css">
+			* {
+				margin:0;
+				padding:0;
+			}
+
+			body {
+				background-color:#EFEFEF;
+				font: .9em "Lucida Sans Unicode", "Lucida Grande", sans-serif;
+			}
+
+			#wrapper{
+				width:600px;
+				margin:40px auto 0;
+				text-align:center;
+				-moz-box-shadow: 5px 5px 10px rgba(0,0,0,0.3);
+				-webkit-box-shadow: 5px 5px 10px rgba(0,0,0,0.3);
+				box-shadow: 5px 5px 10px rgba(0,0,0,0.3);
+			}
+
+			#wrapper h1{
+				color:#FFF;
+				text-align:center;
+				margin-bottom:20px;
+			}
+
+			#wrapper a{
+				display:block;
+				font-size:.9em;
+				padding-top:20px;
+				color:#FFF;
+				text-decoration:none;
+				text-align:center;
+			}
+
+			#container {
+				width:600px;
+				padding-bottom:15px;
+				background-color:#FFFFFF;
+			}
+
+			.navtop{
+				height:40px;
+				background-color:#24B2EB;
+				padding:13px;
+			}
+
+			.content {
+				padding:10px 10px 25px;
+				background: #FFFFFF;
+				margin:;
+				color:#333;
+			}
+
+			a.button{
+				color:white;
+				padding:15px 20px;
+				text-shadow:1px 1px 0 #00A5FF;
+				font-weight:bold;
+				text-align:center;
+				border:1px solid #24B2EB;
+				margin:0px 200px;
+				clear:both;
+				background-color: #24B2EB;
+				border-radius:100px;
+				-moz-border-radius:100px;
+				-webkit-border-radius:100px;
+			}
+
+			a.button:hover{
+				text-decoration:none;
+				background-color: #24B2EB;
+			}
+
+		</style>
+	</head>
+	<body>
+		<div id="wrapper">
+			<div id="container">
+				<div class="navtop">
+					<h1>{{.Title}}</h1>
+				</div>
+				<div id="content">
+					{{.Content}}
+					<a href="/" title="Home" class="button">Go Home</a><br />
+
+					<br>Powered by beego {{.BeegoVersion}}
+				</div>
+			</div>
+		</div>
+	</body>
+</html>
+`
+
+type errorInfo struct {
+	controllerType reflect.Type
+	handler        http.HandlerFunc
+	method         string
+	errorType      int
+}
+
+// ErrorMaps holds map of http handlers for each error string.
+// there is 10 kinds default error(40x and 50x)
+var ErrorMaps = make(map[string]*errorInfo, 10)
+
+// show 401 unauthorized error.
+func unauthorized(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		401,
+		"<br>The page you have requested can't be authorized."+
+			"<br>Perhaps you are here because:"+
+			"<br><br><ul>"+
+			"<br>The credentials you supplied are incorrect"+
+			"<br>There are errors in the website address"+
+			"</ul>",
+	)
+}
+
+// show 402 Payment Required
+func paymentRequired(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		402,
+		"<br>The page you have requested Payment Required."+
+			"<br>Perhaps you are here because:"+
+			"<br><br><ul>"+
+			"<br>The credentials you supplied are incorrect"+
+			"<br>There are errors in the website address"+
+			"</ul>",
+	)
+}
+
+// show 403 forbidden error.
+func forbidden(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		403,
+		"<br>The page you have requested is forbidden."+
+			"<br>Perhaps you are here because:"+
+			"<br><br><ul>"+
+			"<br>Your address may be blocked"+
+			"<br>The site may be disabled"+
+			"<br>You need to log in"+
+			"</ul>",
+	)
+}
+
+// show 422 missing xsrf token
+func missingxsrf(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		422,
+		"<br>The page you have requested is forbidden."+
+			"<br>Perhaps you are here because:"+
+			"<br><br><ul>"+
+			"<br>'_xsrf' argument missing from POST"+
+			"</ul>",
+	)
+}
+
+// show 417 invalid xsrf token
+func invalidxsrf(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		417,
+		"<br>The page you have requested is forbidden."+
+			"<br>Perhaps you are here because:"+
+			"<br><br><ul>"+
+			"<br>expected XSRF not found"+
+			"</ul>",
+	)
+}
+
+// show 404 not found error.
+func notFound(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		404,
+		"<br>The page you have requested has flown the coop."+
+			"<br>Perhaps you are here because:"+
+			"<br><br><ul>"+
+			"<br>The page has moved"+
+			"<br>The page no longer exists"+
+			"<br>You were looking for your puppy and got lost"+
+			"<br>You like 404 pages"+
+			"</ul>",
+	)
+}
+
+// show 405 Method Not Allowed
+func methodNotAllowed(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		405,
+		"<br>The method you have requested Not Allowed."+
+			"<br>Perhaps you are here because:"+
+			"<br><br><ul>"+
+			"<br>The method specified in the Request-Line is not allowed for the resource identified by the Request-URI"+
+			"<br>The response MUST include an Allow header containing a list of valid methods for the requested resource."+
+			"</ul>",
+	)
+}
+
+// show 500 internal server error.
+func internalServerError(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		500,
+		"<br>The page you have requested is down right now."+
+			"<br><br><ul>"+
+			"<br>Please try again later and report the error to the website administrator"+
+			"<br></ul>",
+	)
+}
+
+// show 501 Not Implemented.
+func notImplemented(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		501,
+		"<br>The page you have requested is Not Implemented."+
+			"<br><br><ul>"+
+			"<br>Please try again later and report the error to the website administrator"+
+			"<br></ul>",
+	)
+}
+
+// show 502 Bad Gateway.
+func badGateway(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		502,
+		"<br>The page you have requested is down right now."+
+			"<br><br><ul>"+
+			"<br>The server, while acting as a gateway or proxy, received an invalid response from the upstream server it accessed in attempting to fulfill the request."+
+			"<br>Please try again later and report the error to the website administrator"+
+			"<br></ul>",
+	)
+}
+
+// show 503 service unavailable error.
+func serviceUnavailable(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		503,
+		"<br>The page you have requested is unavailable."+
+			"<br>Perhaps you are here because:"+
+			"<br><br><ul>"+
+			"<br><br>The page is overloaded"+
+			"<br>Please try again later."+
+			"</ul>",
+	)
+}
+
+// show 504 Gateway Timeout.
+func gatewayTimeout(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		504,
+		"<br>The page you have requested is unavailable"+
+			"<br>Perhaps you are here because:"+
+			"<br><br><ul>"+
+			"<br><br>The server, while acting as a gateway or proxy, did not receive a timely response from the upstream server specified by the URI."+
+			"<br>Please try again later."+
+			"</ul>",
+	)
+}
+
+// show 413 Payload Too Large
+func payloadTooLarge(rw http.ResponseWriter, r *http.Request) {
+	responseError(rw, r,
+		413,
+		`<br>The page you have requested is unavailable.
+		 <br>Perhaps you are here because:<br><br>
+		 <ul>
+			<br>The request entity is larger than limits defined by server.
+			<br>Please change the request entity and try again.
+		 </ul>
+		`,
+	)
+}
+
+func responseError(rw http.ResponseWriter, r *http.Request, errCode int, errContent string) {
+	t, _ := template.New("beegoerrortemp").Parse(errtpl)
+	data := M{
+		"Title":        http.StatusText(errCode),
+		"BeegoVersion": VERSION,
+		"Content":      template.HTML(errContent),
+	}
+	t.Execute(rw, data)
+}
+
+// ErrorHandler registers http.HandlerFunc to each http err code string.
+// usage:
+// 	beego.ErrorHandler("404",NotFound)
+//	beego.ErrorHandler("500",InternalServerError)
+func ErrorHandler(code string, h http.HandlerFunc) *App {
+	ErrorMaps[code] = &errorInfo{
+		errorType: errorTypeHandler,
+		handler:   h,
+		method:    code,
+	}
+	return BeeApp
+}
+
+// ErrorController registers ControllerInterface to each http err code string.
+// usage:
+// 	beego.ErrorController(&controllers.ErrorController{})
+func ErrorController(c ControllerInterface) *App {
+	reflectVal := reflect.ValueOf(c)
+	rt := reflectVal.Type()
+	ct := reflect.Indirect(reflectVal).Type()
+	for i := 0; i < rt.NumMethod(); i++ {
+		methodName := rt.Method(i).Name
+		if !utils.InSlice(methodName, exceptMethod) && strings.HasPrefix(methodName, "Error") {
+			errName := strings.TrimPrefix(methodName, "Error")
+			ErrorMaps[errName] = &errorInfo{
+				errorType:      errorTypeController,
+				controllerType: ct,
+				method:         methodName,
+			}
+		}
+	}
+	return BeeApp
+}
+
+// Exception Write HttpStatus with errCode and Exec error handler if exist.
+func Exception(errCode uint64, ctx *context.Context) {
+	exception(strconv.FormatUint(errCode, 10), ctx)
+}
+
+// show error string as simple text message.
+// if error string is empty, show 503 or 500 error as default.
+func exception(errCode string, ctx *context.Context) {
+	atoi := func(code string) int {
+		v, err := strconv.Atoi(code)
+		if err == nil {
+			return v
+		}
+		if ctx.Output.Status == 0 {
+			return 503
+		}
+		return ctx.Output.Status
+	}
+
+	for _, ec := range []string{errCode, "503", "500"} {
+		if h, ok := ErrorMaps[ec]; ok {
+			executeError(h, ctx, atoi(ec))
+			return
+		}
+	}
+	//if 50x error has been removed from errorMap
+	ctx.ResponseWriter.WriteHeader(atoi(errCode))
+	ctx.WriteString(errCode)
+}
+
+func executeError(err *errorInfo, ctx *context.Context, code int) {
+	//make sure to log the error in the access log
+	LogAccess(ctx, nil, code)
+
+	if err.errorType == errorTypeHandler {
+		ctx.ResponseWriter.WriteHeader(code)
+		err.handler(ctx.ResponseWriter, ctx.Request)
+		return
+	}
+	if err.errorType == errorTypeController {
+		ctx.Output.SetStatus(code)
+		//Invoke the request handler
+		vc := reflect.New(err.controllerType)
+		execController, ok := vc.Interface().(ControllerInterface)
+		if !ok {
+			panic("controller is not ControllerInterface")
+		}
+		//call the controller init function
+		execController.Init(ctx, err.controllerType.Name(), err.method, vc.Interface())
+
+		//call prepare function
+		execController.Prepare()
+
+		execController.URLMapping()
+
+		method := vc.MethodByName(err.method)
+		method.Call([]reflect.Value{})
+
+		//render template
+		if BConfig.WebConfig.AutoRender {
+			if err := execController.Render(); err != nil {
+				panic(err)
+			}
+		}
+
+		// finish all runrouter. release resource
+		execController.Finish()
+	}
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/filter.go

@@ -0,0 +1,44 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import "github.com/astaxie/beego/context"
+
+// FilterFunc defines a filter function which is invoked before the controller handler is executed.
+type FilterFunc func(*context.Context)
+
+// FilterRouter defines a filter operation which is invoked before the controller handler is executed.
+// It can match the URL against a pattern, and execute a filter function
+// when a request with a matching URL arrives.
+type FilterRouter struct {
+	filterFunc     FilterFunc
+	tree           *Tree
+	pattern        string
+	returnOnOutput bool
+	resetParams    bool
+}
+
+// ValidRouter checks if the current request is matched by this filter.
+// If the request is matched, the values of the URL parameters defined
+// by the filter pattern are also returned.
+func (f *FilterRouter) ValidRouter(url string, ctx *context.Context) bool {
+	isOk := f.tree.Match(url, ctx)
+	if isOk != nil {
+		if b, ok := isOk.(bool); ok {
+			return b
+		}
+	}
+	return false
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/flash.go

@@ -0,0 +1,110 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"fmt"
+	"net/url"
+	"strings"
+)
+
+// FlashData is a tools to maintain data when using across request.
+type FlashData struct {
+	Data map[string]string
+}
+
+// NewFlash return a new empty FlashData struct.
+func NewFlash() *FlashData {
+	return &FlashData{
+		Data: make(map[string]string),
+	}
+}
+
+// Set message to flash
+func (fd *FlashData) Set(key string, msg string, args ...interface{}) {
+	if len(args) == 0 {
+		fd.Data[key] = msg
+	} else {
+		fd.Data[key] = fmt.Sprintf(msg, args...)
+	}
+}
+
+// Success writes success message to flash.
+func (fd *FlashData) Success(msg string, args ...interface{}) {
+	if len(args) == 0 {
+		fd.Data["success"] = msg
+	} else {
+		fd.Data["success"] = fmt.Sprintf(msg, args...)
+	}
+}
+
+// Notice writes notice message to flash.
+func (fd *FlashData) Notice(msg string, args ...interface{}) {
+	if len(args) == 0 {
+		fd.Data["notice"] = msg
+	} else {
+		fd.Data["notice"] = fmt.Sprintf(msg, args...)
+	}
+}
+
+// Warning writes warning message to flash.
+func (fd *FlashData) Warning(msg string, args ...interface{}) {
+	if len(args) == 0 {
+		fd.Data["warning"] = msg
+	} else {
+		fd.Data["warning"] = fmt.Sprintf(msg, args...)
+	}
+}
+
+// Error writes error message to flash.
+func (fd *FlashData) Error(msg string, args ...interface{}) {
+	if len(args) == 0 {
+		fd.Data["error"] = msg
+	} else {
+		fd.Data["error"] = fmt.Sprintf(msg, args...)
+	}
+}
+
+// Store does the saving operation of flash data.
+// the data are encoded and saved in cookie.
+func (fd *FlashData) Store(c *Controller) {
+	c.Data["flash"] = fd.Data
+	var flashValue string
+	for key, value := range fd.Data {
+		flashValue += "\x00" + key + "\x23" + BConfig.WebConfig.FlashSeparator + "\x23" + value + "\x00"
+	}
+	c.Ctx.SetCookie(BConfig.WebConfig.FlashName, url.QueryEscape(flashValue), 0, "/")
+}
+
+// ReadFromRequest parsed flash data from encoded values in cookie.
+func ReadFromRequest(c *Controller) *FlashData {
+	flash := NewFlash()
+	if cookie, err := c.Ctx.Request.Cookie(BConfig.WebConfig.FlashName); err == nil {
+		v, _ := url.QueryUnescape(cookie.Value)
+		vals := strings.Split(v, "\x00")
+		for _, v := range vals {
+			if len(v) > 0 {
+				kv := strings.Split(v, "\x23"+BConfig.WebConfig.FlashSeparator+"\x23")
+				if len(kv) == 2 {
+					flash.Data[kv[0]] = kv[1]
+				}
+			}
+		}
+		//read one time then delete it
+		c.Ctx.SetCookie(BConfig.WebConfig.FlashName, "", -1, "/")
+	}
+	c.Data["flash"] = flash.Data
+	return flash
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/fs.go

@@ -0,0 +1,74 @@
+package beego
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+)
+
+type FileSystem struct {
+}
+
+func (d FileSystem) Open(name string) (http.File, error) {
+	return os.Open(name)
+}
+
+// Walk walks the file tree rooted at root in filesystem, calling walkFn for each file or
+// directory in the tree, including root. All errors that arise visiting files
+// and directories are filtered by walkFn.
+func Walk(fs http.FileSystem, root string, walkFn filepath.WalkFunc) error {
+
+	f, err := fs.Open(root)
+	if err != nil {
+		return err
+	}
+	info, err := f.Stat()
+	if err != nil {
+		err = walkFn(root, nil, err)
+	} else {
+		err = walk(fs, root, info, walkFn)
+	}
+	if err == filepath.SkipDir {
+		return nil
+	}
+	return err
+}
+
+// walk recursively descends path, calling walkFn.
+func walk(fs http.FileSystem, path string, info os.FileInfo, walkFn filepath.WalkFunc) error {
+	var err error
+	if !info.IsDir() {
+		return walkFn(path, info, nil)
+	}
+
+	dir, err := fs.Open(path)
+	if err != nil {
+		if err1 := walkFn(path, info, err); err1 != nil {
+			return err1
+		}
+		return err
+	}
+	defer dir.Close()
+	dirs, err := dir.Readdir(-1)
+	err1 := walkFn(path, info, err)
+	// If err != nil, walk can't walk into this directory.
+	// err1 != nil means walkFn want walk to skip this directory or stop walking.
+	// Therefore, if one of err and err1 isn't nil, walk will return.
+	if err != nil || err1 != nil {
+		// The caller's behavior is controlled by the return value, which is decided
+		// by walkFn. walkFn may ignore err and return nil.
+		// If walkFn returns SkipDir, it will be handled by the caller.
+		// So walk should return whatever walkFn returns.
+		return err1
+	}
+
+	for _, fileInfo := range dirs {
+		filename := filepath.Join(path, fileInfo.Name())
+		if err = walk(fs, filename, fileInfo, walkFn); err != nil {
+			if !fileInfo.IsDir() || err != filepath.SkipDir {
+				return err
+			}
+		}
+	}
+	return nil
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/go.mod

@@ -0,0 +1,41 @@
+module github.com/astaxie/beego
+
+require (
+	github.com/Knetic/govaluate v3.0.0+incompatible // indirect
+	github.com/beego/goyaml2 v0.0.0-20130207012346-5545475820dd
+	github.com/beego/x2j v0.0.0-20131220205130-a0352aadc542
+	github.com/bradfitz/gomemcache v0.0.0-20180710155616-bc664df96737
+	github.com/casbin/casbin v1.7.0
+	github.com/cloudflare/golz4 v0.0.0-20150217214814-ef862a3cdc58
+	github.com/couchbase/go-couchbase v0.0.0-20200519150804-63f3cdb75e0d
+	github.com/couchbase/gomemcached v0.0.0-20200526233749-ec430f949808 // indirect
+	github.com/couchbase/goutils v0.0.0-20180530154633-e865a1461c8a // indirect
+	github.com/elastic/go-elasticsearch/v6 v6.8.5
+	github.com/elazarl/go-bindata-assetfs v1.0.0
+	github.com/go-redis/redis v6.14.2+incompatible
+	github.com/go-sql-driver/mysql v1.5.0
+	github.com/gogo/protobuf v1.1.1
+	github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db // indirect
+	github.com/gomodule/redigo v2.0.0+incompatible
+	github.com/hashicorp/golang-lru v0.5.4
+	github.com/ledisdb/ledisdb v0.0.0-20200510135210-d35789ec47e6
+	github.com/lib/pq v1.0.0
+	github.com/mattn/go-sqlite3 v2.0.3+incompatible
+	github.com/pelletier/go-toml v1.2.0 // indirect
+	github.com/pkg/errors v0.9.1
+	github.com/prometheus/client_golang v1.7.0
+	github.com/shiena/ansicolor v0.0.0-20151119151921-a422bbe96644
+	github.com/ssdb/gossdb v0.0.0-20180723034631-88f6b59b84ec
+	github.com/stretchr/testify v1.4.0
+	github.com/syndtr/goleveldb v0.0.0-20181127023241-353a9fca669c // indirect
+	github.com/wendal/errors v0.0.0-20130201093226-f66c77a7882b // indirect
+	golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550
+	golang.org/x/net v0.0.0-20190620200207-3b0461eec859 // indirect
+	gopkg.in/yaml.v2 v2.2.8
+)
+
+replace golang.org/x/crypto v0.0.0-20181127143415-eb0de9b17e85 => github.com/golang/crypto v0.0.0-20181127143415-eb0de9b17e85
+
+replace gopkg.in/yaml.v2 v2.2.1 => github.com/go-yaml/yaml v0.0.0-20180328195020-5420a8b6744d
+
+go 1.13

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/grace/grace.go

@@ -0,0 +1,166 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package grace use to hot reload
+// Description: http://grisha.org/blog/2014/06/03/graceful-restart-in-golang/
+//
+// Usage:
+//
+// import(
+//   "log"
+//	 "net/http"
+//	 "os"
+//
+//   "github.com/astaxie/beego/grace"
+// )
+//
+//  func handler(w http.ResponseWriter, r *http.Request) {
+//	  w.Write([]byte("WORLD!"))
+//  }
+//
+//  func main() {
+//      mux := http.NewServeMux()
+//      mux.HandleFunc("/hello", handler)
+//
+//	    err := grace.ListenAndServe("localhost:8080", mux)
+//      if err != nil {
+//		   log.Println(err)
+//	    }
+//      log.Println("Server on 8080 stopped")
+//	     os.Exit(0)
+//    }
+package grace
+
+import (
+	"flag"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+)
+
+const (
+	// PreSignal is the position to add filter before signal
+	PreSignal = iota
+	// PostSignal is the position to add filter after signal
+	PostSignal
+	// StateInit represent the application inited
+	StateInit
+	// StateRunning represent the application is running
+	StateRunning
+	// StateShuttingDown represent the application is shutting down
+	StateShuttingDown
+	// StateTerminate represent the application is killed
+	StateTerminate
+)
+
+var (
+	regLock              *sync.Mutex
+	runningServers       map[string]*Server
+	runningServersOrder  []string
+	socketPtrOffsetMap   map[string]uint
+	runningServersForked bool
+
+	// DefaultReadTimeOut is the HTTP read timeout
+	DefaultReadTimeOut time.Duration
+	// DefaultWriteTimeOut is the HTTP Write timeout
+	DefaultWriteTimeOut time.Duration
+	// DefaultMaxHeaderBytes is the Max HTTP Header size, default is 0, no limit
+	DefaultMaxHeaderBytes int
+	// DefaultTimeout is the shutdown server's timeout. default is 60s
+	DefaultTimeout = 60 * time.Second
+
+	isChild     bool
+	socketOrder string
+
+	hookableSignals []os.Signal
+)
+
+func init() {
+	flag.BoolVar(&isChild, "graceful", false, "listen on open fd (after forking)")
+	flag.StringVar(&socketOrder, "socketorder", "", "previous initialization order - used when more than one listener was started")
+
+	regLock = &sync.Mutex{}
+	runningServers = make(map[string]*Server)
+	runningServersOrder = []string{}
+	socketPtrOffsetMap = make(map[string]uint)
+
+	hookableSignals = []os.Signal{
+		syscall.SIGHUP,
+		syscall.SIGINT,
+		syscall.SIGTERM,
+	}
+}
+
+// NewServer returns a new graceServer.
+func NewServer(addr string, handler http.Handler) (srv *Server) {
+	regLock.Lock()
+	defer regLock.Unlock()
+
+	if !flag.Parsed() {
+		flag.Parse()
+	}
+	if len(socketOrder) > 0 {
+		for i, addr := range strings.Split(socketOrder, ",") {
+			socketPtrOffsetMap[addr] = uint(i)
+		}
+	} else {
+		socketPtrOffsetMap[addr] = uint(len(runningServersOrder))
+	}
+
+	srv = &Server{
+		sigChan: make(chan os.Signal),
+		isChild: isChild,
+		SignalHooks: map[int]map[os.Signal][]func(){
+			PreSignal: {
+				syscall.SIGHUP:  {},
+				syscall.SIGINT:  {},
+				syscall.SIGTERM: {},
+			},
+			PostSignal: {
+				syscall.SIGHUP:  {},
+				syscall.SIGINT:  {},
+				syscall.SIGTERM: {},
+			},
+		},
+		state:        StateInit,
+		Network:      "tcp",
+		terminalChan: make(chan error), //no cache channel
+	}
+	srv.Server = &http.Server{
+		Addr:           addr,
+		ReadTimeout:    DefaultReadTimeOut,
+		WriteTimeout:   DefaultWriteTimeOut,
+		MaxHeaderBytes: DefaultMaxHeaderBytes,
+		Handler:        handler,
+	}
+
+	runningServersOrder = append(runningServersOrder, addr)
+	runningServers[addr] = srv
+	return srv
+}
+
+// ListenAndServe refer http.ListenAndServe
+func ListenAndServe(addr string, handler http.Handler) error {
+	server := NewServer(addr, handler)
+	return server.ListenAndServe()
+}
+
+// ListenAndServeTLS refer http.ListenAndServeTLS
+func ListenAndServeTLS(addr string, certFile string, keyFile string, handler http.Handler) error {
+	server := NewServer(addr, handler)
+	return server.ListenAndServeTLS(certFile, keyFile)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/grace/server.go

@@ -0,0 +1,356 @@
+package grace
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// Server embedded http.Server
+type Server struct {
+	*http.Server
+	ln           net.Listener
+	SignalHooks  map[int]map[os.Signal][]func()
+	sigChan      chan os.Signal
+	isChild      bool
+	state        uint8
+	Network      string
+	terminalChan chan error
+}
+
+// Serve accepts incoming connections on the Listener l,
+// creating a new service goroutine for each.
+// The service goroutines read requests and then call srv.Handler to reply to them.
+func (srv *Server) Serve() (err error) {
+	srv.state = StateRunning
+	defer func() { srv.state = StateTerminate }()
+
+	// When Shutdown is called, Serve, ListenAndServe, and ListenAndServeTLS
+	// immediately return ErrServerClosed. Make sure the program doesn't exit
+	// and waits instead for Shutdown to return.
+	if err = srv.Server.Serve(srv.ln); err != nil && err != http.ErrServerClosed {
+		log.Println(syscall.Getpid(), "Server.Serve() error:", err)
+		return err
+	}
+
+	log.Println(syscall.Getpid(), srv.ln.Addr(), "Listener closed.")
+	// wait for Shutdown to return
+	if shutdownErr := <-srv.terminalChan; shutdownErr != nil {
+		return shutdownErr
+	}
+	return
+}
+
+// ListenAndServe listens on the TCP network address srv.Addr and then calls Serve
+// to handle requests on incoming connections. If srv.Addr is blank, ":http" is
+// used.
+func (srv *Server) ListenAndServe() (err error) {
+	addr := srv.Addr
+	if addr == "" {
+		addr = ":http"
+	}
+
+	go srv.handleSignals()
+
+	srv.ln, err = srv.getListener(addr)
+	if err != nil {
+		log.Println(err)
+		return err
+	}
+
+	if srv.isChild {
+		process, err := os.FindProcess(os.Getppid())
+		if err != nil {
+			log.Println(err)
+			return err
+		}
+		err = process.Signal(syscall.SIGTERM)
+		if err != nil {
+			return err
+		}
+	}
+
+	log.Println(os.Getpid(), srv.Addr)
+	return srv.Serve()
+}
+
+// ListenAndServeTLS listens on the TCP network address srv.Addr and then calls
+// Serve to handle requests on incoming TLS connections.
+//
+// Filenames containing a certificate and matching private key for the server must
+// be provided. If the certificate is signed by a certificate authority, the
+// certFile should be the concatenation of the server's certificate followed by the
+// CA's certificate.
+//
+// If srv.Addr is blank, ":https" is used.
+func (srv *Server) ListenAndServeTLS(certFile, keyFile string) (err error) {
+	addr := srv.Addr
+	if addr == "" {
+		addr = ":https"
+	}
+
+	if srv.TLSConfig == nil {
+		srv.TLSConfig = &tls.Config{}
+	}
+	if srv.TLSConfig.NextProtos == nil {
+		srv.TLSConfig.NextProtos = []string{"http/1.1"}
+	}
+
+	srv.TLSConfig.Certificates = make([]tls.Certificate, 1)
+	srv.TLSConfig.Certificates[0], err = tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		return
+	}
+
+	go srv.handleSignals()
+
+	ln, err := srv.getListener(addr)
+	if err != nil {
+		log.Println(err)
+		return err
+	}
+	srv.ln = tls.NewListener(tcpKeepAliveListener{ln.(*net.TCPListener)}, srv.TLSConfig)
+
+	if srv.isChild {
+		process, err := os.FindProcess(os.Getppid())
+		if err != nil {
+			log.Println(err)
+			return err
+		}
+		err = process.Signal(syscall.SIGTERM)
+		if err != nil {
+			return err
+		}
+	}
+
+	log.Println(os.Getpid(), srv.Addr)
+	return srv.Serve()
+}
+
+// ListenAndServeMutualTLS listens on the TCP network address srv.Addr and then calls
+// Serve to handle requests on incoming mutual TLS connections.
+func (srv *Server) ListenAndServeMutualTLS(certFile, keyFile, trustFile string) (err error) {
+	addr := srv.Addr
+	if addr == "" {
+		addr = ":https"
+	}
+
+	if srv.TLSConfig == nil {
+		srv.TLSConfig = &tls.Config{}
+	}
+	if srv.TLSConfig.NextProtos == nil {
+		srv.TLSConfig.NextProtos = []string{"http/1.1"}
+	}
+
+	srv.TLSConfig.Certificates = make([]tls.Certificate, 1)
+	srv.TLSConfig.Certificates[0], err = tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		return
+	}
+	srv.TLSConfig.ClientAuth = tls.RequireAndVerifyClientCert
+	pool := x509.NewCertPool()
+	data, err := ioutil.ReadFile(trustFile)
+	if err != nil {
+		log.Println(err)
+		return err
+	}
+	pool.AppendCertsFromPEM(data)
+	srv.TLSConfig.ClientCAs = pool
+	log.Println("Mutual HTTPS")
+	go srv.handleSignals()
+
+	ln, err := srv.getListener(addr)
+	if err != nil {
+		log.Println(err)
+		return err
+	}
+	srv.ln = tls.NewListener(tcpKeepAliveListener{ln.(*net.TCPListener)}, srv.TLSConfig)
+
+	if srv.isChild {
+		process, err := os.FindProcess(os.Getppid())
+		if err != nil {
+			log.Println(err)
+			return err
+		}
+		err = process.Signal(syscall.SIGTERM)
+		if err != nil {
+			return err
+		}
+	}
+
+	log.Println(os.Getpid(), srv.Addr)
+	return srv.Serve()
+}
+
+// getListener either opens a new socket to listen on, or takes the acceptor socket
+// it got passed when restarted.
+func (srv *Server) getListener(laddr string) (l net.Listener, err error) {
+	if srv.isChild {
+		var ptrOffset uint
+		if len(socketPtrOffsetMap) > 0 {
+			ptrOffset = socketPtrOffsetMap[laddr]
+			log.Println("laddr", laddr, "ptr offset", socketPtrOffsetMap[laddr])
+		}
+
+		f := os.NewFile(uintptr(3+ptrOffset), "")
+		l, err = net.FileListener(f)
+		if err != nil {
+			err = fmt.Errorf("net.FileListener error: %v", err)
+			return
+		}
+	} else {
+		l, err = net.Listen(srv.Network, laddr)
+		if err != nil {
+			err = fmt.Errorf("net.Listen error: %v", err)
+			return
+		}
+	}
+	return
+}
+
+type tcpKeepAliveListener struct {
+	*net.TCPListener
+}
+
+func (ln tcpKeepAliveListener) Accept() (c net.Conn, err error) {
+	tc, err := ln.AcceptTCP()
+	if err != nil {
+		return
+	}
+	tc.SetKeepAlive(true)
+	tc.SetKeepAlivePeriod(3 * time.Minute)
+	return tc, nil
+}
+
+// handleSignals listens for os Signals and calls any hooked in function that the
+// user had registered with the signal.
+func (srv *Server) handleSignals() {
+	var sig os.Signal
+
+	signal.Notify(
+		srv.sigChan,
+		hookableSignals...,
+	)
+
+	pid := syscall.Getpid()
+	for {
+		sig = <-srv.sigChan
+		srv.signalHooks(PreSignal, sig)
+		switch sig {
+		case syscall.SIGHUP:
+			log.Println(pid, "Received SIGHUP. forking.")
+			err := srv.fork()
+			if err != nil {
+				log.Println("Fork err:", err)
+			}
+		case syscall.SIGINT:
+			log.Println(pid, "Received SIGINT.")
+			srv.shutdown()
+		case syscall.SIGTERM:
+			log.Println(pid, "Received SIGTERM.")
+			srv.shutdown()
+		default:
+			log.Printf("Received %v: nothing i care about...\n", sig)
+		}
+		srv.signalHooks(PostSignal, sig)
+	}
+}
+
+func (srv *Server) signalHooks(ppFlag int, sig os.Signal) {
+	if _, notSet := srv.SignalHooks[ppFlag][sig]; !notSet {
+		return
+	}
+	for _, f := range srv.SignalHooks[ppFlag][sig] {
+		f()
+	}
+}
+
+// shutdown closes the listener so that no new connections are accepted. it also
+// starts a goroutine that will serverTimeout (stop all running requests) the server
+// after DefaultTimeout.
+func (srv *Server) shutdown() {
+	if srv.state != StateRunning {
+		return
+	}
+
+	srv.state = StateShuttingDown
+	log.Println(syscall.Getpid(), "Waiting for connections to finish...")
+	ctx := context.Background()
+	if DefaultTimeout >= 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(context.Background(), DefaultTimeout)
+		defer cancel()
+	}
+	srv.terminalChan <- srv.Server.Shutdown(ctx)
+}
+
+func (srv *Server) fork() (err error) {
+	regLock.Lock()
+	defer regLock.Unlock()
+	if runningServersForked {
+		return
+	}
+	runningServersForked = true
+
+	var files = make([]*os.File, len(runningServers))
+	var orderArgs = make([]string, len(runningServers))
+	for _, srvPtr := range runningServers {
+		f, _ := srvPtr.ln.(*net.TCPListener).File()
+		files[socketPtrOffsetMap[srvPtr.Server.Addr]] = f
+		orderArgs[socketPtrOffsetMap[srvPtr.Server.Addr]] = srvPtr.Server.Addr
+	}
+
+	log.Println(files)
+	path := os.Args[0]
+	var args []string
+	if len(os.Args) > 1 {
+		for _, arg := range os.Args[1:] {
+			if arg == "-graceful" {
+				break
+			}
+			args = append(args, arg)
+		}
+	}
+	args = append(args, "-graceful")
+	if len(runningServers) > 1 {
+		args = append(args, fmt.Sprintf(`-socketorder=%s`, strings.Join(orderArgs, ",")))
+		log.Println(args)
+	}
+	cmd := exec.Command(path, args...)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.ExtraFiles = files
+	err = cmd.Start()
+	if err != nil {
+		log.Fatalf("Restart: Failed to launch, error: %v", err)
+	}
+
+	return
+}
+
+// RegisterSignalHook registers a function to be run PreSignal or PostSignal for a given signal.
+func (srv *Server) RegisterSignalHook(ppFlag int, sig os.Signal, f func()) (err error) {
+	if ppFlag != PreSignal && ppFlag != PostSignal {
+		err = fmt.Errorf("Invalid ppFlag argument. Must be either grace.PreSignal or grace.PostSignal")
+		return
+	}
+	for _, s := range hookableSignals {
+		if s == sig {
+			srv.SignalHooks[ppFlag][sig] = append(srv.SignalHooks[ppFlag][sig], f)
+			return
+		}
+	}
+	err = fmt.Errorf("Signal '%v' is not supported", sig)
+	return
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/hooks.go

@@ -0,0 +1,105 @@
+package beego
+
+import (
+	"encoding/json"
+	"mime"
+	"net/http"
+	"path/filepath"
+
+	"github.com/astaxie/beego/context"
+	"github.com/astaxie/beego/logs"
+	"github.com/astaxie/beego/session"
+)
+
+// register MIME type with content type
+func registerMime() error {
+	for k, v := range mimemaps {
+		mime.AddExtensionType(k, v)
+	}
+	return nil
+}
+
+// register default error http handlers, 404,401,403,500 and 503.
+func registerDefaultErrorHandler() error {
+	m := map[string]func(http.ResponseWriter, *http.Request){
+		"401": unauthorized,
+		"402": paymentRequired,
+		"403": forbidden,
+		"404": notFound,
+		"405": methodNotAllowed,
+		"500": internalServerError,
+		"501": notImplemented,
+		"502": badGateway,
+		"503": serviceUnavailable,
+		"504": gatewayTimeout,
+		"417": invalidxsrf,
+		"422": missingxsrf,
+		"413": payloadTooLarge,
+	}
+	for e, h := range m {
+		if _, ok := ErrorMaps[e]; !ok {
+			ErrorHandler(e, h)
+		}
+	}
+	return nil
+}
+
+func registerSession() error {
+	if BConfig.WebConfig.Session.SessionOn {
+		var err error
+		sessionConfig := AppConfig.String("sessionConfig")
+		conf := new(session.ManagerConfig)
+		if sessionConfig == "" {
+			conf.CookieName = BConfig.WebConfig.Session.SessionName
+			conf.EnableSetCookie = BConfig.WebConfig.Session.SessionAutoSetCookie
+			conf.Gclifetime = BConfig.WebConfig.Session.SessionGCMaxLifetime
+			conf.Secure = BConfig.Listen.EnableHTTPS
+			conf.CookieLifeTime = BConfig.WebConfig.Session.SessionCookieLifeTime
+			conf.ProviderConfig = filepath.ToSlash(BConfig.WebConfig.Session.SessionProviderConfig)
+			conf.DisableHTTPOnly = BConfig.WebConfig.Session.SessionDisableHTTPOnly
+			conf.Domain = BConfig.WebConfig.Session.SessionDomain
+			conf.EnableSidInHTTPHeader = BConfig.WebConfig.Session.SessionEnableSidInHTTPHeader
+			conf.SessionNameInHTTPHeader = BConfig.WebConfig.Session.SessionNameInHTTPHeader
+			conf.EnableSidInURLQuery = BConfig.WebConfig.Session.SessionEnableSidInURLQuery
+			conf.CookieSameSite = BConfig.WebConfig.Session.SessionCookieSameSite
+		} else {
+			if err = json.Unmarshal([]byte(sessionConfig), conf); err != nil {
+				return err
+			}
+		}
+		if GlobalSessions, err = session.NewManager(BConfig.WebConfig.Session.SessionProvider, conf); err != nil {
+			return err
+		}
+		go GlobalSessions.GC()
+	}
+	return nil
+}
+
+func registerTemplate() error {
+	defer lockViewPaths()
+	if err := AddViewPath(BConfig.WebConfig.ViewsPath); err != nil {
+		if BConfig.RunMode == DEV {
+			logs.Warn(err)
+		}
+		return err
+	}
+	return nil
+}
+
+func registerAdmin() error {
+	if BConfig.Listen.EnableAdmin {
+		go beeAdminApp.Run()
+	}
+	return nil
+}
+
+func registerGzip() error {
+	if BConfig.EnableGzip {
+		context.InitGzip(
+			AppConfig.DefaultInt("gzipMinLength", -1),
+			AppConfig.DefaultInt("gzipCompressLevel", -1),
+			AppConfig.DefaultStrings("includedMethods", []string{"GET"}),
+		)
+	}
+	return nil
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/log.go

@@ -0,0 +1,127 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"strings"
+
+	"github.com/astaxie/beego/logs"
+)
+
+// Log levels to control the logging output.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+const (
+	LevelEmergency = iota
+	LevelAlert
+	LevelCritical
+	LevelError
+	LevelWarning
+	LevelNotice
+	LevelInformational
+	LevelDebug
+)
+
+// BeeLogger references the used application logger.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+var BeeLogger = logs.GetBeeLogger()
+
+// SetLevel sets the global log level used by the simple logger.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func SetLevel(l int) {
+	logs.SetLevel(l)
+}
+
+// SetLogFuncCall set the CallDepth, default is 3
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func SetLogFuncCall(b bool) {
+	logs.SetLogFuncCall(b)
+}
+
+// SetLogger sets a new logger.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func SetLogger(adaptername string, config string) error {
+	return logs.SetLogger(adaptername, config)
+}
+
+// Emergency logs a message at emergency level.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Emergency(v ...interface{}) {
+	logs.Emergency(generateFmtStr(len(v)), v...)
+}
+
+// Alert logs a message at alert level.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Alert(v ...interface{}) {
+	logs.Alert(generateFmtStr(len(v)), v...)
+}
+
+// Critical logs a message at critical level.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Critical(v ...interface{}) {
+	logs.Critical(generateFmtStr(len(v)), v...)
+}
+
+// Error logs a message at error level.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Error(v ...interface{}) {
+	logs.Error(generateFmtStr(len(v)), v...)
+}
+
+// Warning logs a message at warning level.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Warning(v ...interface{}) {
+	logs.Warning(generateFmtStr(len(v)), v...)
+}
+
+// Warn compatibility alias for Warning()
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Warn(v ...interface{}) {
+	logs.Warn(generateFmtStr(len(v)), v...)
+}
+
+// Notice logs a message at notice level.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Notice(v ...interface{}) {
+	logs.Notice(generateFmtStr(len(v)), v...)
+}
+
+// Informational logs a message at info level.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Informational(v ...interface{}) {
+	logs.Informational(generateFmtStr(len(v)), v...)
+}
+
+// Info compatibility alias for Warning()
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Info(v ...interface{}) {
+	logs.Info(generateFmtStr(len(v)), v...)
+}
+
+// Debug logs a message at debug level.
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Debug(v ...interface{}) {
+	logs.Debug(generateFmtStr(len(v)), v...)
+}
+
+// Trace logs a message at trace level.
+// compatibility alias for Warning()
+// Deprecated: use github.com/astaxie/beego/logs instead.
+func Trace(v ...interface{}) {
+	logs.Trace(generateFmtStr(len(v)), v...)
+}
+
+func generateFmtStr(n int) string {
+	return strings.Repeat("%v ", n)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/README.md

@@ -0,0 +1,72 @@
+## logs
+logs is a Go logs manager. It can use many logs adapters. The repo is inspired by `database/sql` .
+
+
+## How to install?
+
+	go get github.com/astaxie/beego/logs
+
+
+## What adapters are supported?
+
+As of now this logs support console, file,smtp and conn.
+
+
+## How to use it?
+
+First you must import it
+
+```golang
+import (
+	"github.com/astaxie/beego/logs"
+)
+```
+
+Then init a Log (example with console adapter)
+
+```golang
+log := logs.NewLogger(10000)
+log.SetLogger("console", "")
+```
+
+> the first params stand for how many channel
+
+Use it like this:
+
+```golang
+log.Trace("trace")
+log.Info("info")
+log.Warn("warning")
+log.Debug("debug")
+log.Critical("critical")
+```
+
+## File adapter
+
+Configure file adapter like this:
+
+```golang
+log := NewLogger(10000)
+log.SetLogger("file", `{"filename":"test.log"}`)
+```
+
+## Conn adapter
+
+Configure like this:
+
+```golang
+log := NewLogger(1000)
+log.SetLogger("conn", `{"net":"tcp","addr":":7020"}`)
+log.Info("info")
+```
+
+## Smtp adapter
+
+Configure like this:
+
+```golang
+log := NewLogger(10000)
+log.SetLogger("smtp", `{"username":"beegotest@gmail.com","password":"xxxxxxxx","host":"smtp.gmail.com:587","sendTos":["xiemengjun@gmail.com"]}`)
+log.Critical("sendmail critical")
+time.Sleep(time.Second * 30)
+```

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/accesslog.go

@@ -0,0 +1,83 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package logs
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+)
+
+const (
+	apacheFormatPattern = "%s - - [%s] \"%s %d %d\" %f %s %s"
+	apacheFormat        = "APACHE_FORMAT"
+	jsonFormat          = "JSON_FORMAT"
+)
+
+// AccessLogRecord struct for holding access log data.
+type AccessLogRecord struct {
+	RemoteAddr     string        `json:"remote_addr"`
+	RequestTime    time.Time     `json:"request_time"`
+	RequestMethod  string        `json:"request_method"`
+	Request        string        `json:"request"`
+	ServerProtocol string        `json:"server_protocol"`
+	Host           string        `json:"host"`
+	Status         int           `json:"status"`
+	BodyBytesSent  int64         `json:"body_bytes_sent"`
+	ElapsedTime    time.Duration `json:"elapsed_time"`
+	HTTPReferrer   string        `json:"http_referrer"`
+	HTTPUserAgent  string        `json:"http_user_agent"`
+	RemoteUser     string        `json:"remote_user"`
+}
+
+func (r *AccessLogRecord) json() ([]byte, error) {
+	buffer := &bytes.Buffer{}
+	encoder := json.NewEncoder(buffer)
+	disableEscapeHTML(encoder)
+
+	err := encoder.Encode(r)
+	return buffer.Bytes(), err
+}
+
+func disableEscapeHTML(i interface{}) {
+	if e, ok := i.(interface {
+		SetEscapeHTML(bool)
+	}); ok {
+		e.SetEscapeHTML(false)
+	}
+}
+
+// AccessLog - Format and print access log.
+func AccessLog(r *AccessLogRecord, format string) {
+	var msg string
+	switch format {
+	case apacheFormat:
+		timeFormatted := r.RequestTime.Format("02/Jan/2006 03:04:05")
+		msg = fmt.Sprintf(apacheFormatPattern, r.RemoteAddr, timeFormatted, r.Request, r.Status, r.BodyBytesSent,
+			r.ElapsedTime.Seconds(), r.HTTPReferrer, r.HTTPUserAgent)
+	case jsonFormat:
+		fallthrough
+	default:
+		jsonData, err := r.json()
+		if err != nil {
+			msg = fmt.Sprintf(`{"Error": "%s"}`, err)
+		} else {
+			msg = string(jsonData)
+		}
+	}
+	beeLogger.writeMsg(levelLoggerImpl, strings.TrimSpace(msg))
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/conn.go

@@ -0,0 +1,119 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package logs
+
+import (
+	"encoding/json"
+	"io"
+	"net"
+	"time"
+)
+
+// connWriter implements LoggerInterface.
+// it writes messages in keep-live tcp connection.
+type connWriter struct {
+	lg             *logWriter
+	innerWriter    io.WriteCloser
+	ReconnectOnMsg bool   `json:"reconnectOnMsg"`
+	Reconnect      bool   `json:"reconnect"`
+	Net            string `json:"net"`
+	Addr           string `json:"addr"`
+	Level          int    `json:"level"`
+}
+
+// NewConn create new ConnWrite returning as LoggerInterface.
+func NewConn() Logger {
+	conn := new(connWriter)
+	conn.Level = LevelTrace
+	return conn
+}
+
+// Init init connection writer with json config.
+// json config only need key "level".
+func (c *connWriter) Init(jsonConfig string) error {
+	return json.Unmarshal([]byte(jsonConfig), c)
+}
+
+// WriteMsg write message in connection.
+// if connection is down, try to re-connect.
+func (c *connWriter) WriteMsg(when time.Time, msg string, level int) error {
+	if level > c.Level {
+		return nil
+	}
+	if c.needToConnectOnMsg() {
+		err := c.connect()
+		if err != nil {
+			return err
+		}
+	}
+
+	if c.ReconnectOnMsg {
+		defer c.innerWriter.Close()
+	}
+
+	_, err := c.lg.writeln(when, msg)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// Flush implementing method. empty.
+func (c *connWriter) Flush() {
+
+}
+
+// Destroy destroy connection writer and close tcp listener.
+func (c *connWriter) Destroy() {
+	if c.innerWriter != nil {
+		c.innerWriter.Close()
+	}
+}
+
+func (c *connWriter) connect() error {
+	if c.innerWriter != nil {
+		c.innerWriter.Close()
+		c.innerWriter = nil
+	}
+
+	conn, err := net.Dial(c.Net, c.Addr)
+	if err != nil {
+		return err
+	}
+
+	if tcpConn, ok := conn.(*net.TCPConn); ok {
+		tcpConn.SetKeepAlive(true)
+	}
+
+	c.innerWriter = conn
+	c.lg = newLogWriter(conn)
+	return nil
+}
+
+func (c *connWriter) needToConnectOnMsg() bool {
+	if c.Reconnect {
+		return true
+	}
+
+	if c.innerWriter == nil {
+		return true
+	}
+
+	return c.ReconnectOnMsg
+}
+
+func init() {
+	Register(AdapterConn, NewConn)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/console.go

@@ -0,0 +1,99 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package logs
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/shiena/ansicolor"
+)
+
+// brush is a color join function
+type brush func(string) string
+
+// newBrush return a fix color Brush
+func newBrush(color string) brush {
+	pre := "\033["
+	reset := "\033[0m"
+	return func(text string) string {
+		return pre + color + "m" + text + reset
+	}
+}
+
+var colors = []brush{
+	newBrush("1;37"), // Emergency          white
+	newBrush("1;36"), // Alert              cyan
+	newBrush("1;35"), // Critical           magenta
+	newBrush("1;31"), // Error              red
+	newBrush("1;33"), // Warning            yellow
+	newBrush("1;32"), // Notice             green
+	newBrush("1;34"), // Informational      blue
+	newBrush("1;44"), // Debug              Background blue
+}
+
+// consoleWriter implements LoggerInterface and writes messages to terminal.
+type consoleWriter struct {
+	lg       *logWriter
+	Level    int  `json:"level"`
+	Colorful bool `json:"color"` //this filed is useful only when system's terminal supports color
+}
+
+// NewConsole create ConsoleWriter returning as LoggerInterface.
+func NewConsole() Logger {
+	cw := &consoleWriter{
+		lg:       newLogWriter(ansicolor.NewAnsiColorWriter(os.Stdout)),
+		Level:    LevelDebug,
+		Colorful: true,
+	}
+	return cw
+}
+
+// Init init console logger.
+// jsonConfig like '{"level":LevelTrace}'.
+func (c *consoleWriter) Init(jsonConfig string) error {
+	if len(jsonConfig) == 0 {
+		return nil
+	}
+	return json.Unmarshal([]byte(jsonConfig), c)
+}
+
+// WriteMsg write message in console.
+func (c *consoleWriter) WriteMsg(when time.Time, msg string, level int) error {
+	if level > c.Level {
+		return nil
+	}
+	if c.Colorful {
+		msg = strings.Replace(msg, levelPrefix[level], colors[level](levelPrefix[level]), 1)
+	}
+	c.lg.writeln(when, msg)
+	return nil
+}
+
+// Destroy implementing method. empty.
+func (c *consoleWriter) Destroy() {
+
+}
+
+// Flush implementing method. empty.
+func (c *consoleWriter) Flush() {
+
+}
+
+func init() {
+	Register(AdapterConsole, NewConsole)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/file.go

@@ -0,0 +1,409 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package logs
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+// fileLogWriter implements LoggerInterface.
+// It writes messages by lines limit, file size limit, or time frequency.
+type fileLogWriter struct {
+	sync.RWMutex // write log order by order and  atomic incr maxLinesCurLines and maxSizeCurSize
+	// The opened file
+	Filename   string `json:"filename"`
+	fileWriter *os.File
+
+	// Rotate at line
+	MaxLines         int `json:"maxlines"`
+	maxLinesCurLines int
+
+	MaxFiles         int `json:"maxfiles"`
+	MaxFilesCurFiles int
+
+	// Rotate at size
+	MaxSize        int `json:"maxsize"`
+	maxSizeCurSize int
+
+	// Rotate daily
+	Daily         bool  `json:"daily"`
+	MaxDays       int64 `json:"maxdays"`
+	dailyOpenDate int
+	dailyOpenTime time.Time
+
+	// Rotate hourly
+	Hourly         bool  `json:"hourly"`
+	MaxHours       int64 `json:"maxhours"`
+	hourlyOpenDate int
+	hourlyOpenTime time.Time
+
+	Rotate bool `json:"rotate"`
+
+	Level int `json:"level"`
+
+	Perm string `json:"perm"`
+
+	RotatePerm string `json:"rotateperm"`
+
+	fileNameOnly, suffix string // like "project.log", project is fileNameOnly and .log is suffix
+}
+
+// newFileWriter create a FileLogWriter returning as LoggerInterface.
+func newFileWriter() Logger {
+	w := &fileLogWriter{
+		Daily:      true,
+		MaxDays:    7,
+		Hourly:     false,
+		MaxHours:   168,
+		Rotate:     true,
+		RotatePerm: "0440",
+		Level:      LevelTrace,
+		Perm:       "0660",
+		MaxLines:   10000000,
+		MaxFiles:   999,
+		MaxSize:    1 << 28,
+	}
+	return w
+}
+
+// Init file logger with json config.
+// jsonConfig like:
+//  {
+//  "filename":"logs/beego.log",
+//  "maxLines":10000,
+//  "maxsize":1024,
+//  "daily":true,
+//  "maxDays":15,
+//  "rotate":true,
+//      "perm":"0600"
+//  }
+func (w *fileLogWriter) Init(jsonConfig string) error {
+	err := json.Unmarshal([]byte(jsonConfig), w)
+	if err != nil {
+		return err
+	}
+	if len(w.Filename) == 0 {
+		return errors.New("jsonconfig must have filename")
+	}
+	w.suffix = filepath.Ext(w.Filename)
+	w.fileNameOnly = strings.TrimSuffix(w.Filename, w.suffix)
+	if w.suffix == "" {
+		w.suffix = ".log"
+	}
+	err = w.startLogger()
+	return err
+}
+
+// start file logger. create log file and set to locker-inside file writer.
+func (w *fileLogWriter) startLogger() error {
+	file, err := w.createLogFile()
+	if err != nil {
+		return err
+	}
+	if w.fileWriter != nil {
+		w.fileWriter.Close()
+	}
+	w.fileWriter = file
+	return w.initFd()
+}
+
+func (w *fileLogWriter) needRotateDaily(size int, day int) bool {
+	return (w.MaxLines > 0 && w.maxLinesCurLines >= w.MaxLines) ||
+		(w.MaxSize > 0 && w.maxSizeCurSize >= w.MaxSize) ||
+		(w.Daily && day != w.dailyOpenDate)
+}
+
+func (w *fileLogWriter) needRotateHourly(size int, hour int) bool {
+	return (w.MaxLines > 0 && w.maxLinesCurLines >= w.MaxLines) ||
+		(w.MaxSize > 0 && w.maxSizeCurSize >= w.MaxSize) ||
+		(w.Hourly && hour != w.hourlyOpenDate)
+
+}
+
+// WriteMsg write logger message into file.
+func (w *fileLogWriter) WriteMsg(when time.Time, msg string, level int) error {
+	if level > w.Level {
+		return nil
+	}
+	hd, d, h := formatTimeHeader(when)
+	msg = string(hd) + msg + "\n"
+	if w.Rotate {
+		w.RLock()
+		if w.needRotateHourly(len(msg), h) {
+			w.RUnlock()
+			w.Lock()
+			if w.needRotateHourly(len(msg), h) {
+				if err := w.doRotate(when); err != nil {
+					fmt.Fprintf(os.Stderr, "FileLogWriter(%q): %s\n", w.Filename, err)
+				}
+			}
+			w.Unlock()
+		} else if w.needRotateDaily(len(msg), d) {
+			w.RUnlock()
+			w.Lock()
+			if w.needRotateDaily(len(msg), d) {
+				if err := w.doRotate(when); err != nil {
+					fmt.Fprintf(os.Stderr, "FileLogWriter(%q): %s\n", w.Filename, err)
+				}
+			}
+			w.Unlock()
+		} else {
+			w.RUnlock()
+		}
+	}
+
+	w.Lock()
+	_, err := w.fileWriter.Write([]byte(msg))
+	if err == nil {
+		w.maxLinesCurLines++
+		w.maxSizeCurSize += len(msg)
+	}
+	w.Unlock()
+	return err
+}
+
+func (w *fileLogWriter) createLogFile() (*os.File, error) {
+	// Open the log file
+	perm, err := strconv.ParseInt(w.Perm, 8, 64)
+	if err != nil {
+		return nil, err
+	}
+
+	filepath := path.Dir(w.Filename)
+	os.MkdirAll(filepath, os.FileMode(perm))
+
+	fd, err := os.OpenFile(w.Filename, os.O_WRONLY|os.O_APPEND|os.O_CREATE, os.FileMode(perm))
+	if err == nil {
+		// Make sure file perm is user set perm cause of `os.OpenFile` will obey umask
+		os.Chmod(w.Filename, os.FileMode(perm))
+	}
+	return fd, err
+}
+
+func (w *fileLogWriter) initFd() error {
+	fd := w.fileWriter
+	fInfo, err := fd.Stat()
+	if err != nil {
+		return fmt.Errorf("get stat err: %s", err)
+	}
+	w.maxSizeCurSize = int(fInfo.Size())
+	w.dailyOpenTime = time.Now()
+	w.dailyOpenDate = w.dailyOpenTime.Day()
+	w.hourlyOpenTime = time.Now()
+	w.hourlyOpenDate = w.hourlyOpenTime.Hour()
+	w.maxLinesCurLines = 0
+	if w.Hourly {
+		go w.hourlyRotate(w.hourlyOpenTime)
+	} else if w.Daily {
+		go w.dailyRotate(w.dailyOpenTime)
+	}
+	if fInfo.Size() > 0 && w.MaxLines > 0 {
+		count, err := w.lines()
+		if err != nil {
+			return err
+		}
+		w.maxLinesCurLines = count
+	}
+	return nil
+}
+
+func (w *fileLogWriter) dailyRotate(openTime time.Time) {
+	y, m, d := openTime.Add(24 * time.Hour).Date()
+	nextDay := time.Date(y, m, d, 0, 0, 0, 0, openTime.Location())
+	tm := time.NewTimer(time.Duration(nextDay.UnixNano() - openTime.UnixNano() + 100))
+	<-tm.C
+	w.Lock()
+	if w.needRotateDaily(0, time.Now().Day()) {
+		if err := w.doRotate(time.Now()); err != nil {
+			fmt.Fprintf(os.Stderr, "FileLogWriter(%q): %s\n", w.Filename, err)
+		}
+	}
+	w.Unlock()
+}
+
+func (w *fileLogWriter) hourlyRotate(openTime time.Time) {
+	y, m, d := openTime.Add(1 * time.Hour).Date()
+	h, _, _ := openTime.Add(1 * time.Hour).Clock()
+	nextHour := time.Date(y, m, d, h, 0, 0, 0, openTime.Location())
+	tm := time.NewTimer(time.Duration(nextHour.UnixNano() - openTime.UnixNano() + 100))
+	<-tm.C
+	w.Lock()
+	if w.needRotateHourly(0, time.Now().Hour()) {
+		if err := w.doRotate(time.Now()); err != nil {
+			fmt.Fprintf(os.Stderr, "FileLogWriter(%q): %s\n", w.Filename, err)
+		}
+	}
+	w.Unlock()
+}
+
+func (w *fileLogWriter) lines() (int, error) {
+	fd, err := os.Open(w.Filename)
+	if err != nil {
+		return 0, err
+	}
+	defer fd.Close()
+
+	buf := make([]byte, 32768) // 32k
+	count := 0
+	lineSep := []byte{'\n'}
+
+	for {
+		c, err := fd.Read(buf)
+		if err != nil && err != io.EOF {
+			return count, err
+		}
+
+		count += bytes.Count(buf[:c], lineSep)
+
+		if err == io.EOF {
+			break
+		}
+	}
+
+	return count, nil
+}
+
+// DoRotate means it need to write file in new file.
+// new file name like xx.2013-01-01.log (daily) or xx.001.log (by line or size)
+func (w *fileLogWriter) doRotate(logTime time.Time) error {
+	// file exists
+	// Find the next available number
+	num := w.MaxFilesCurFiles + 1
+	fName := ""
+	format := ""
+	var openTime time.Time
+	rotatePerm, err := strconv.ParseInt(w.RotatePerm, 8, 64)
+	if err != nil {
+		return err
+	}
+
+	_, err = os.Lstat(w.Filename)
+	if err != nil {
+		//even if the file is not exist or other ,we should RESTART the logger
+		goto RESTART_LOGGER
+	}
+
+	if w.Hourly {
+		format = "2006010215"
+		openTime = w.hourlyOpenTime
+	} else if w.Daily {
+		format = "2006-01-02"
+		openTime = w.dailyOpenTime
+	}
+
+	// only when one of them be setted, then the file would be splited
+	if w.MaxLines > 0 || w.MaxSize > 0 {
+		for ; err == nil && num <= w.MaxFiles; num++ {
+			fName = w.fileNameOnly + fmt.Sprintf(".%s.%03d%s", logTime.Format(format), num, w.suffix)
+			_, err = os.Lstat(fName)
+		}
+	} else {
+		fName = w.fileNameOnly + fmt.Sprintf(".%s.%03d%s", openTime.Format(format), num, w.suffix)
+		_, err = os.Lstat(fName)
+		w.MaxFilesCurFiles = num
+	}
+
+	// return error if the last file checked still existed
+	if err == nil {
+		return fmt.Errorf("Rotate: Cannot find free log number to rename %s", w.Filename)
+	}
+
+	// close fileWriter before rename
+	w.fileWriter.Close()
+
+	// Rename the file to its new found name
+	// even if occurs error,we MUST guarantee to  restart new logger
+	err = os.Rename(w.Filename, fName)
+	if err != nil {
+		goto RESTART_LOGGER
+	}
+
+	err = os.Chmod(fName, os.FileMode(rotatePerm))
+
+RESTART_LOGGER:
+
+	startLoggerErr := w.startLogger()
+	go w.deleteOldLog()
+
+	if startLoggerErr != nil {
+		return fmt.Errorf("Rotate StartLogger: %s", startLoggerErr)
+	}
+	if err != nil {
+		return fmt.Errorf("Rotate: %s", err)
+	}
+	return nil
+}
+
+func (w *fileLogWriter) deleteOldLog() {
+	dir := filepath.Dir(w.Filename)
+	absolutePath, err := filepath.EvalSymlinks(w.Filename)
+	if err == nil {
+		dir = filepath.Dir(absolutePath)
+	}
+	filepath.Walk(dir, func(path string, info os.FileInfo, err error) (returnErr error) {
+		defer func() {
+			if r := recover(); r != nil {
+				fmt.Fprintf(os.Stderr, "Unable to delete old log '%s', error: %v\n", path, r)
+			}
+		}()
+
+		if info == nil {
+			return
+		}
+		if w.Hourly {
+			if !info.IsDir() && info.ModTime().Add(1*time.Hour*time.Duration(w.MaxHours)).Before(time.Now()) {
+				if strings.HasPrefix(filepath.Base(path), filepath.Base(w.fileNameOnly)) &&
+					strings.HasSuffix(filepath.Base(path), w.suffix) {
+					os.Remove(path)
+				}
+			}
+		} else if w.Daily {
+			if !info.IsDir() && info.ModTime().Add(24*time.Hour*time.Duration(w.MaxDays)).Before(time.Now()) {
+				if strings.HasPrefix(filepath.Base(path), filepath.Base(w.fileNameOnly)) &&
+					strings.HasSuffix(filepath.Base(path), w.suffix) {
+					os.Remove(path)
+				}
+			}
+		}
+		return
+	})
+}
+
+// Destroy close the file description, close file writer.
+func (w *fileLogWriter) Destroy() {
+	w.fileWriter.Close()
+}
+
+// Flush flush file logger.
+// there are no buffering messages in file logger in memory.
+// flush file means sync file from disk.
+func (w *fileLogWriter) Flush() {
+	w.fileWriter.Sync()
+}
+
+func init() {
+	Register(AdapterFile, newFileWriter)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/jianliao.go

@@ -0,0 +1,72 @@
+package logs
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// JLWriter implements beego LoggerInterface and is used to send jiaoliao webhook
+type JLWriter struct {
+	AuthorName  string `json:"authorname"`
+	Title       string `json:"title"`
+	WebhookURL  string `json:"webhookurl"`
+	RedirectURL string `json:"redirecturl,omitempty"`
+	ImageURL    string `json:"imageurl,omitempty"`
+	Level       int    `json:"level"`
+}
+
+// newJLWriter create jiaoliao writer.
+func newJLWriter() Logger {
+	return &JLWriter{Level: LevelTrace}
+}
+
+// Init JLWriter with json config string
+func (s *JLWriter) Init(jsonconfig string) error {
+	return json.Unmarshal([]byte(jsonconfig), s)
+}
+
+// WriteMsg write message in smtp writer.
+// it will send an email with subject and only this message.
+func (s *JLWriter) WriteMsg(when time.Time, msg string, level int) error {
+	if level > s.Level {
+		return nil
+	}
+
+	text := fmt.Sprintf("%s %s", when.Format("2006-01-02 15:04:05"), msg)
+
+	form := url.Values{}
+	form.Add("authorName", s.AuthorName)
+	form.Add("title", s.Title)
+	form.Add("text", text)
+	if s.RedirectURL != "" {
+		form.Add("redirectUrl", s.RedirectURL)
+	}
+	if s.ImageURL != "" {
+		form.Add("imageUrl", s.ImageURL)
+	}
+
+	resp, err := http.PostForm(s.WebhookURL, form)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("Post webhook failed %s %d", resp.Status, resp.StatusCode)
+	}
+	return nil
+}
+
+// Flush implementing method. empty.
+func (s *JLWriter) Flush() {
+}
+
+// Destroy implementing method. empty.
+func (s *JLWriter) Destroy() {
+}
+
+func init() {
+	Register(AdapterJianLiao, newJLWriter)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/log.go

@@ -0,0 +1,669 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package logs provide a general log interface
+// Usage:
+//
+// import "github.com/astaxie/beego/logs"
+//
+//	log := NewLogger(10000)
+//	log.SetLogger("console", "")
+//
+//	> the first params stand for how many channel
+//
+// Use it like this:
+//
+//	log.Trace("trace")
+//	log.Info("info")
+//	log.Warn("warning")
+//	log.Debug("debug")
+//	log.Critical("critical")
+//
+//  more docs http://beego.me/docs/module/logs.md
+package logs
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+// RFC5424 log message levels.
+const (
+	LevelEmergency = iota
+	LevelAlert
+	LevelCritical
+	LevelError
+	LevelWarning
+	LevelNotice
+	LevelInformational
+	LevelDebug
+)
+
+// levelLogLogger is defined to implement log.Logger
+// the real log level will be LevelEmergency
+const levelLoggerImpl = -1
+
+// Name for adapter with beego official support
+const (
+	AdapterConsole   = "console"
+	AdapterFile      = "file"
+	AdapterMultiFile = "multifile"
+	AdapterMail      = "smtp"
+	AdapterConn      = "conn"
+	AdapterEs        = "es"
+	AdapterJianLiao  = "jianliao"
+	AdapterSlack     = "slack"
+	AdapterAliLS     = "alils"
+)
+
+// Legacy log level constants to ensure backwards compatibility.
+const (
+	LevelInfo  = LevelInformational
+	LevelTrace = LevelDebug
+	LevelWarn  = LevelWarning
+)
+
+type newLoggerFunc func() Logger
+
+// Logger defines the behavior of a log provider.
+type Logger interface {
+	Init(config string) error
+	WriteMsg(when time.Time, msg string, level int) error
+	Destroy()
+	Flush()
+}
+
+var adapters = make(map[string]newLoggerFunc)
+var levelPrefix = [LevelDebug + 1]string{"[M]", "[A]", "[C]", "[E]", "[W]", "[N]", "[I]", "[D]"}
+
+// Register makes a log provide available by the provided name.
+// If Register is called twice with the same name or if driver is nil,
+// it panics.
+func Register(name string, log newLoggerFunc) {
+	if log == nil {
+		panic("logs: Register provide is nil")
+	}
+	if _, dup := adapters[name]; dup {
+		panic("logs: Register called twice for provider " + name)
+	}
+	adapters[name] = log
+}
+
+// BeeLogger is default logger in beego application.
+// it can contain several providers and log message into all providers.
+type BeeLogger struct {
+	lock                sync.Mutex
+	level               int
+	init                bool
+	enableFuncCallDepth bool
+	loggerFuncCallDepth int
+	asynchronous        bool
+	prefix              string
+	msgChanLen          int64
+	msgChan             chan *logMsg
+	signalChan          chan string
+	wg                  sync.WaitGroup
+	outputs             []*nameLogger
+}
+
+const defaultAsyncMsgLen = 1e3
+
+type nameLogger struct {
+	Logger
+	name string
+}
+
+type logMsg struct {
+	level int
+	msg   string
+	when  time.Time
+}
+
+var logMsgPool *sync.Pool
+
+// NewLogger returns a new BeeLogger.
+// channelLen means the number of messages in chan(used where asynchronous is true).
+// if the buffering chan is full, logger adapters write to file or other way.
+func NewLogger(channelLens ...int64) *BeeLogger {
+	bl := new(BeeLogger)
+	bl.level = LevelDebug
+	bl.loggerFuncCallDepth = 2
+	bl.msgChanLen = append(channelLens, 0)[0]
+	if bl.msgChanLen <= 0 {
+		bl.msgChanLen = defaultAsyncMsgLen
+	}
+	bl.signalChan = make(chan string, 1)
+	bl.setLogger(AdapterConsole)
+	return bl
+}
+
+// Async set the log to asynchronous and start the goroutine
+func (bl *BeeLogger) Async(msgLen ...int64) *BeeLogger {
+	bl.lock.Lock()
+	defer bl.lock.Unlock()
+	if bl.asynchronous {
+		return bl
+	}
+	bl.asynchronous = true
+	if len(msgLen) > 0 && msgLen[0] > 0 {
+		bl.msgChanLen = msgLen[0]
+	}
+	bl.msgChan = make(chan *logMsg, bl.msgChanLen)
+	logMsgPool = &sync.Pool{
+		New: func() interface{} {
+			return &logMsg{}
+		},
+	}
+	bl.wg.Add(1)
+	go bl.startLogger()
+	return bl
+}
+
+// SetLogger provides a given logger adapter into BeeLogger with config string.
+// config need to be correct JSON as string: {"interval":360}.
+func (bl *BeeLogger) setLogger(adapterName string, configs ...string) error {
+	config := append(configs, "{}")[0]
+	for _, l := range bl.outputs {
+		if l.name == adapterName {
+			return fmt.Errorf("logs: duplicate adaptername %q (you have set this logger before)", adapterName)
+		}
+	}
+
+	logAdapter, ok := adapters[adapterName]
+	if !ok {
+		return fmt.Errorf("logs: unknown adaptername %q (forgotten Register?)", adapterName)
+	}
+
+	lg := logAdapter()
+	err := lg.Init(config)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "logs.BeeLogger.SetLogger: "+err.Error())
+		return err
+	}
+	bl.outputs = append(bl.outputs, &nameLogger{name: adapterName, Logger: lg})
+	return nil
+}
+
+// SetLogger provides a given logger adapter into BeeLogger with config string.
+// config need to be correct JSON as string: {"interval":360}.
+func (bl *BeeLogger) SetLogger(adapterName string, configs ...string) error {
+	bl.lock.Lock()
+	defer bl.lock.Unlock()
+	if !bl.init {
+		bl.outputs = []*nameLogger{}
+		bl.init = true
+	}
+	return bl.setLogger(adapterName, configs...)
+}
+
+// DelLogger remove a logger adapter in BeeLogger.
+func (bl *BeeLogger) DelLogger(adapterName string) error {
+	bl.lock.Lock()
+	defer bl.lock.Unlock()
+	outputs := []*nameLogger{}
+	for _, lg := range bl.outputs {
+		if lg.name == adapterName {
+			lg.Destroy()
+		} else {
+			outputs = append(outputs, lg)
+		}
+	}
+	if len(outputs) == len(bl.outputs) {
+		return fmt.Errorf("logs: unknown adaptername %q (forgotten Register?)", adapterName)
+	}
+	bl.outputs = outputs
+	return nil
+}
+
+func (bl *BeeLogger) writeToLoggers(when time.Time, msg string, level int) {
+	for _, l := range bl.outputs {
+		err := l.WriteMsg(when, msg, level)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "unable to WriteMsg to adapter:%v,error:%v\n", l.name, err)
+		}
+	}
+}
+
+func (bl *BeeLogger) Write(p []byte) (n int, err error) {
+	if len(p) == 0 {
+		return 0, nil
+	}
+	// writeMsg will always add a '\n' character
+	if p[len(p)-1] == '\n' {
+		p = p[0 : len(p)-1]
+	}
+	// set levelLoggerImpl to ensure all log message will be write out
+	err = bl.writeMsg(levelLoggerImpl, string(p))
+	if err == nil {
+		return len(p), err
+	}
+	return 0, err
+}
+
+func (bl *BeeLogger) writeMsg(logLevel int, msg string, v ...interface{}) error {
+	if !bl.init {
+		bl.lock.Lock()
+		bl.setLogger(AdapterConsole)
+		bl.lock.Unlock()
+	}
+
+	if len(v) > 0 {
+		msg = fmt.Sprintf(msg, v...)
+	}
+
+	msg = bl.prefix + " " + msg
+
+	when := time.Now()
+	if bl.enableFuncCallDepth {
+		_, file, line, ok := runtime.Caller(bl.loggerFuncCallDepth)
+		if !ok {
+			file = "???"
+			line = 0
+		}
+		_, filename := path.Split(file)
+		msg = "[" + filename + ":" + strconv.Itoa(line) + "] " + msg
+	}
+
+	//set level info in front of filename info
+	if logLevel == levelLoggerImpl {
+		// set to emergency to ensure all log will be print out correctly
+		logLevel = LevelEmergency
+	} else {
+		msg = levelPrefix[logLevel] + " " + msg
+	}
+
+	if bl.asynchronous {
+		lm := logMsgPool.Get().(*logMsg)
+		lm.level = logLevel
+		lm.msg = msg
+		lm.when = when
+		if bl.outputs != nil {
+			bl.msgChan <- lm
+		} else {
+			logMsgPool.Put(lm)
+		}
+	} else {
+		bl.writeToLoggers(when, msg, logLevel)
+	}
+	return nil
+}
+
+// SetLevel Set log message level.
+// If message level (such as LevelDebug) is higher than logger level (such as LevelWarning),
+// log providers will not even be sent the message.
+func (bl *BeeLogger) SetLevel(l int) {
+	bl.level = l
+}
+
+// GetLevel Get Current log message level.
+func (bl *BeeLogger) GetLevel() int {
+	return bl.level
+}
+
+// SetLogFuncCallDepth set log funcCallDepth
+func (bl *BeeLogger) SetLogFuncCallDepth(d int) {
+	bl.loggerFuncCallDepth = d
+}
+
+// GetLogFuncCallDepth return log funcCallDepth for wrapper
+func (bl *BeeLogger) GetLogFuncCallDepth() int {
+	return bl.loggerFuncCallDepth
+}
+
+// EnableFuncCallDepth enable log funcCallDepth
+func (bl *BeeLogger) EnableFuncCallDepth(b bool) {
+	bl.enableFuncCallDepth = b
+}
+
+// set prefix
+func (bl *BeeLogger) SetPrefix(s string) {
+	bl.prefix = s
+}
+
+// start logger chan reading.
+// when chan is not empty, write logs.
+func (bl *BeeLogger) startLogger() {
+	gameOver := false
+	for {
+		select {
+		case bm := <-bl.msgChan:
+			bl.writeToLoggers(bm.when, bm.msg, bm.level)
+			logMsgPool.Put(bm)
+		case sg := <-bl.signalChan:
+			// Now should only send "flush" or "close" to bl.signalChan
+			bl.flush()
+			if sg == "close" {
+				for _, l := range bl.outputs {
+					l.Destroy()
+				}
+				bl.outputs = nil
+				gameOver = true
+			}
+			bl.wg.Done()
+		}
+		if gameOver {
+			break
+		}
+	}
+}
+
+// Emergency Log EMERGENCY level message.
+func (bl *BeeLogger) Emergency(format string, v ...interface{}) {
+	if LevelEmergency > bl.level {
+		return
+	}
+	bl.writeMsg(LevelEmergency, format, v...)
+}
+
+// Alert Log ALERT level message.
+func (bl *BeeLogger) Alert(format string, v ...interface{}) {
+	if LevelAlert > bl.level {
+		return
+	}
+	bl.writeMsg(LevelAlert, format, v...)
+}
+
+// Critical Log CRITICAL level message.
+func (bl *BeeLogger) Critical(format string, v ...interface{}) {
+	if LevelCritical > bl.level {
+		return
+	}
+	bl.writeMsg(LevelCritical, format, v...)
+}
+
+// Error Log ERROR level message.
+func (bl *BeeLogger) Error(format string, v ...interface{}) {
+	if LevelError > bl.level {
+		return
+	}
+	bl.writeMsg(LevelError, format, v...)
+}
+
+// Warning Log WARNING level message.
+func (bl *BeeLogger) Warning(format string, v ...interface{}) {
+	if LevelWarn > bl.level {
+		return
+	}
+	bl.writeMsg(LevelWarn, format, v...)
+}
+
+// Notice Log NOTICE level message.
+func (bl *BeeLogger) Notice(format string, v ...interface{}) {
+	if LevelNotice > bl.level {
+		return
+	}
+	bl.writeMsg(LevelNotice, format, v...)
+}
+
+// Informational Log INFORMATIONAL level message.
+func (bl *BeeLogger) Informational(format string, v ...interface{}) {
+	if LevelInfo > bl.level {
+		return
+	}
+	bl.writeMsg(LevelInfo, format, v...)
+}
+
+// Debug Log DEBUG level message.
+func (bl *BeeLogger) Debug(format string, v ...interface{}) {
+	if LevelDebug > bl.level {
+		return
+	}
+	bl.writeMsg(LevelDebug, format, v...)
+}
+
+// Warn Log WARN level message.
+// compatibility alias for Warning()
+func (bl *BeeLogger) Warn(format string, v ...interface{}) {
+	if LevelWarn > bl.level {
+		return
+	}
+	bl.writeMsg(LevelWarn, format, v...)
+}
+
+// Info Log INFO level message.
+// compatibility alias for Informational()
+func (bl *BeeLogger) Info(format string, v ...interface{}) {
+	if LevelInfo > bl.level {
+		return
+	}
+	bl.writeMsg(LevelInfo, format, v...)
+}
+
+// Trace Log TRACE level message.
+// compatibility alias for Debug()
+func (bl *BeeLogger) Trace(format string, v ...interface{}) {
+	if LevelDebug > bl.level {
+		return
+	}
+	bl.writeMsg(LevelDebug, format, v...)
+}
+
+// Flush flush all chan data.
+func (bl *BeeLogger) Flush() {
+	if bl.asynchronous {
+		bl.signalChan <- "flush"
+		bl.wg.Wait()
+		bl.wg.Add(1)
+		return
+	}
+	bl.flush()
+}
+
+// Close close logger, flush all chan data and destroy all adapters in BeeLogger.
+func (bl *BeeLogger) Close() {
+	if bl.asynchronous {
+		bl.signalChan <- "close"
+		bl.wg.Wait()
+		close(bl.msgChan)
+	} else {
+		bl.flush()
+		for _, l := range bl.outputs {
+			l.Destroy()
+		}
+		bl.outputs = nil
+	}
+	close(bl.signalChan)
+}
+
+// Reset close all outputs, and set bl.outputs to nil
+func (bl *BeeLogger) Reset() {
+	bl.Flush()
+	for _, l := range bl.outputs {
+		l.Destroy()
+	}
+	bl.outputs = nil
+}
+
+func (bl *BeeLogger) flush() {
+	if bl.asynchronous {
+		for {
+			if len(bl.msgChan) > 0 {
+				bm := <-bl.msgChan
+				bl.writeToLoggers(bm.when, bm.msg, bm.level)
+				logMsgPool.Put(bm)
+				continue
+			}
+			break
+		}
+	}
+	for _, l := range bl.outputs {
+		l.Flush()
+	}
+}
+
+// beeLogger references the used application logger.
+var beeLogger = NewLogger()
+
+// GetBeeLogger returns the default BeeLogger
+func GetBeeLogger() *BeeLogger {
+	return beeLogger
+}
+
+var beeLoggerMap = struct {
+	sync.RWMutex
+	logs map[string]*log.Logger
+}{
+	logs: map[string]*log.Logger{},
+}
+
+// GetLogger returns the default BeeLogger
+func GetLogger(prefixes ...string) *log.Logger {
+	prefix := append(prefixes, "")[0]
+	if prefix != "" {
+		prefix = fmt.Sprintf(`[%s] `, strings.ToUpper(prefix))
+	}
+	beeLoggerMap.RLock()
+	l, ok := beeLoggerMap.logs[prefix]
+	if ok {
+		beeLoggerMap.RUnlock()
+		return l
+	}
+	beeLoggerMap.RUnlock()
+	beeLoggerMap.Lock()
+	defer beeLoggerMap.Unlock()
+	l, ok = beeLoggerMap.logs[prefix]
+	if !ok {
+		l = log.New(beeLogger, prefix, 0)
+		beeLoggerMap.logs[prefix] = l
+	}
+	return l
+}
+
+// Reset will remove all the adapter
+func Reset() {
+	beeLogger.Reset()
+}
+
+// Async set the beelogger with Async mode and hold msglen messages
+func Async(msgLen ...int64) *BeeLogger {
+	return beeLogger.Async(msgLen...)
+}
+
+// SetLevel sets the global log level used by the simple logger.
+func SetLevel(l int) {
+	beeLogger.SetLevel(l)
+}
+
+// SetPrefix sets the prefix
+func SetPrefix(s string) {
+	beeLogger.SetPrefix(s)
+}
+
+// EnableFuncCallDepth enable log funcCallDepth
+func EnableFuncCallDepth(b bool) {
+	beeLogger.enableFuncCallDepth = b
+}
+
+// SetLogFuncCall set the CallDepth, default is 4
+func SetLogFuncCall(b bool) {
+	beeLogger.EnableFuncCallDepth(b)
+	beeLogger.SetLogFuncCallDepth(4)
+}
+
+// SetLogFuncCallDepth set log funcCallDepth
+func SetLogFuncCallDepth(d int) {
+	beeLogger.loggerFuncCallDepth = d
+}
+
+// SetLogger sets a new logger.
+func SetLogger(adapter string, config ...string) error {
+	return beeLogger.SetLogger(adapter, config...)
+}
+
+// Emergency logs a message at emergency level.
+func Emergency(f interface{}, v ...interface{}) {
+	beeLogger.Emergency(formatLog(f, v...))
+}
+
+// Alert logs a message at alert level.
+func Alert(f interface{}, v ...interface{}) {
+	beeLogger.Alert(formatLog(f, v...))
+}
+
+// Critical logs a message at critical level.
+func Critical(f interface{}, v ...interface{}) {
+	beeLogger.Critical(formatLog(f, v...))
+}
+
+// Error logs a message at error level.
+func Error(f interface{}, v ...interface{}) {
+	beeLogger.Error(formatLog(f, v...))
+}
+
+// Warning logs a message at warning level.
+func Warning(f interface{}, v ...interface{}) {
+	beeLogger.Warn(formatLog(f, v...))
+}
+
+// Warn compatibility alias for Warning()
+func Warn(f interface{}, v ...interface{}) {
+	beeLogger.Warn(formatLog(f, v...))
+}
+
+// Notice logs a message at notice level.
+func Notice(f interface{}, v ...interface{}) {
+	beeLogger.Notice(formatLog(f, v...))
+}
+
+// Informational logs a message at info level.
+func Informational(f interface{}, v ...interface{}) {
+	beeLogger.Info(formatLog(f, v...))
+}
+
+// Info compatibility alias for Warning()
+func Info(f interface{}, v ...interface{}) {
+	beeLogger.Info(formatLog(f, v...))
+}
+
+// Debug logs a message at debug level.
+func Debug(f interface{}, v ...interface{}) {
+	beeLogger.Debug(formatLog(f, v...))
+}
+
+// Trace logs a message at trace level.
+// compatibility alias for Warning()
+func Trace(f interface{}, v ...interface{}) {
+	beeLogger.Trace(formatLog(f, v...))
+}
+
+func formatLog(f interface{}, v ...interface{}) string {
+	var msg string
+	switch f.(type) {
+	case string:
+		msg = f.(string)
+		if len(v) == 0 {
+			return msg
+		}
+		if strings.Contains(msg, "%") && !strings.Contains(msg, "%%") {
+			//format string
+		} else {
+			//do not contain format char
+			msg += strings.Repeat(" %v", len(v))
+		}
+	default:
+		msg = fmt.Sprint(f)
+		if len(v) == 0 {
+			return msg
+		}
+		msg += strings.Repeat(" %v", len(v))
+	}
+	return fmt.Sprintf(msg, v...)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/logger.go

@@ -0,0 +1,176 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package logs
+
+import (
+	"io"
+	"runtime"
+	"sync"
+	"time"
+)
+
+type logWriter struct {
+	sync.Mutex
+	writer io.Writer
+}
+
+func newLogWriter(wr io.Writer) *logWriter {
+	return &logWriter{writer: wr}
+}
+
+func (lg *logWriter) writeln(when time.Time, msg string) (int, error) {
+	lg.Lock()
+	h, _, _ := formatTimeHeader(when)
+	n, err := lg.writer.Write(append(append(h, msg...), '\n'))
+	lg.Unlock()
+	return n, err
+}
+
+const (
+	y1  = `0123456789`
+	y2  = `0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789`
+	y3  = `0000000000111111111122222222223333333333444444444455555555556666666666777777777788888888889999999999`
+	y4  = `0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789`
+	mo1 = `000000000111`
+	mo2 = `123456789012`
+	d1  = `0000000001111111111222222222233`
+	d2  = `1234567890123456789012345678901`
+	h1  = `000000000011111111112222`
+	h2  = `012345678901234567890123`
+	mi1 = `000000000011111111112222222222333333333344444444445555555555`
+	mi2 = `012345678901234567890123456789012345678901234567890123456789`
+	s1  = `000000000011111111112222222222333333333344444444445555555555`
+	s2  = `012345678901234567890123456789012345678901234567890123456789`
+	ns1 = `0123456789`
+)
+
+func formatTimeHeader(when time.Time) ([]byte, int, int) {
+	y, mo, d := when.Date()
+	h, mi, s := when.Clock()
+	ns := when.Nanosecond() / 1000000
+	//len("2006/01/02 15:04:05.123 ")==24
+	var buf [24]byte
+
+	buf[0] = y1[y/1000%10]
+	buf[1] = y2[y/100]
+	buf[2] = y3[y-y/100*100]
+	buf[3] = y4[y-y/100*100]
+	buf[4] = '/'
+	buf[5] = mo1[mo-1]
+	buf[6] = mo2[mo-1]
+	buf[7] = '/'
+	buf[8] = d1[d-1]
+	buf[9] = d2[d-1]
+	buf[10] = ' '
+	buf[11] = h1[h]
+	buf[12] = h2[h]
+	buf[13] = ':'
+	buf[14] = mi1[mi]
+	buf[15] = mi2[mi]
+	buf[16] = ':'
+	buf[17] = s1[s]
+	buf[18] = s2[s]
+	buf[19] = '.'
+	buf[20] = ns1[ns/100]
+	buf[21] = ns1[ns%100/10]
+	buf[22] = ns1[ns%10]
+
+	buf[23] = ' '
+
+	return buf[0:], d, h
+}
+
+var (
+	green   = string([]byte{27, 91, 57, 55, 59, 52, 50, 109})
+	white   = string([]byte{27, 91, 57, 48, 59, 52, 55, 109})
+	yellow  = string([]byte{27, 91, 57, 55, 59, 52, 51, 109})
+	red     = string([]byte{27, 91, 57, 55, 59, 52, 49, 109})
+	blue    = string([]byte{27, 91, 57, 55, 59, 52, 52, 109})
+	magenta = string([]byte{27, 91, 57, 55, 59, 52, 53, 109})
+	cyan    = string([]byte{27, 91, 57, 55, 59, 52, 54, 109})
+
+	w32Green   = string([]byte{27, 91, 52, 50, 109})
+	w32White   = string([]byte{27, 91, 52, 55, 109})
+	w32Yellow  = string([]byte{27, 91, 52, 51, 109})
+	w32Red     = string([]byte{27, 91, 52, 49, 109})
+	w32Blue    = string([]byte{27, 91, 52, 52, 109})
+	w32Magenta = string([]byte{27, 91, 52, 53, 109})
+	w32Cyan    = string([]byte{27, 91, 52, 54, 109})
+
+	reset = string([]byte{27, 91, 48, 109})
+)
+
+var once sync.Once
+var colorMap map[string]string
+
+func initColor() {
+	if runtime.GOOS == "windows" {
+		green = w32Green
+		white = w32White
+		yellow = w32Yellow
+		red = w32Red
+		blue = w32Blue
+		magenta = w32Magenta
+		cyan = w32Cyan
+	}
+	colorMap = map[string]string{
+		//by color
+		"green":  green,
+		"white":  white,
+		"yellow": yellow,
+		"red":    red,
+		//by method
+		"GET":     blue,
+		"POST":    cyan,
+		"PUT":     yellow,
+		"DELETE":  red,
+		"PATCH":   green,
+		"HEAD":    magenta,
+		"OPTIONS": white,
+	}
+}
+
+// ColorByStatus return color by http code
+// 2xx return Green
+// 3xx return White
+// 4xx return Yellow
+// 5xx return Red
+func ColorByStatus(code int) string {
+	once.Do(initColor)
+	switch {
+	case code >= 200 && code < 300:
+		return colorMap["green"]
+	case code >= 300 && code < 400:
+		return colorMap["white"]
+	case code >= 400 && code < 500:
+		return colorMap["yellow"]
+	default:
+		return colorMap["red"]
+	}
+}
+
+// ColorByMethod return color by http code
+func ColorByMethod(method string) string {
+	once.Do(initColor)
+	if c := colorMap[method]; c != "" {
+		return c
+	}
+	return reset
+}
+
+// ResetColor return reset color
+func ResetColor() string {
+	return reset
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/multifile.go

@@ -0,0 +1,119 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package logs
+
+import (
+	"encoding/json"
+	"time"
+)
+
+// A filesLogWriter manages several fileLogWriter
+// filesLogWriter will write logs to the file in json configuration  and write the same level log to correspond file
+// means if the file name in configuration is project.log filesLogWriter will create project.error.log/project.debug.log
+// and write the error-level logs to project.error.log and write the debug-level logs to project.debug.log
+// the rotate attribute also  acts like fileLogWriter
+type multiFileLogWriter struct {
+	writers       [LevelDebug + 1 + 1]*fileLogWriter // the last one for fullLogWriter
+	fullLogWriter *fileLogWriter
+	Separate      []string `json:"separate"`
+}
+
+var levelNames = [...]string{"emergency", "alert", "critical", "error", "warning", "notice", "info", "debug"}
+
+// Init file logger with json config.
+// jsonConfig like:
+//	{
+//	"filename":"logs/beego.log",
+//	"maxLines":0,
+//	"maxsize":0,
+//	"daily":true,
+//	"maxDays":15,
+//	"rotate":true,
+//  	"perm":0600,
+//	"separate":["emergency", "alert", "critical", "error", "warning", "notice", "info", "debug"],
+//	}
+
+func (f *multiFileLogWriter) Init(config string) error {
+	writer := newFileWriter().(*fileLogWriter)
+	err := writer.Init(config)
+	if err != nil {
+		return err
+	}
+	f.fullLogWriter = writer
+	f.writers[LevelDebug+1] = writer
+
+	//unmarshal "separate" field to f.Separate
+	json.Unmarshal([]byte(config), f)
+
+	jsonMap := map[string]interface{}{}
+	json.Unmarshal([]byte(config), &jsonMap)
+
+	for i := LevelEmergency; i < LevelDebug+1; i++ {
+		for _, v := range f.Separate {
+			if v == levelNames[i] {
+				jsonMap["filename"] = f.fullLogWriter.fileNameOnly + "." + levelNames[i] + f.fullLogWriter.suffix
+				jsonMap["level"] = i
+				bs, _ := json.Marshal(jsonMap)
+				writer = newFileWriter().(*fileLogWriter)
+				err := writer.Init(string(bs))
+				if err != nil {
+					return err
+				}
+				f.writers[i] = writer
+			}
+		}
+	}
+
+	return nil
+}
+
+func (f *multiFileLogWriter) Destroy() {
+	for i := 0; i < len(f.writers); i++ {
+		if f.writers[i] != nil {
+			f.writers[i].Destroy()
+		}
+	}
+}
+
+func (f *multiFileLogWriter) WriteMsg(when time.Time, msg string, level int) error {
+	if f.fullLogWriter != nil {
+		f.fullLogWriter.WriteMsg(when, msg, level)
+	}
+	for i := 0; i < len(f.writers)-1; i++ {
+		if f.writers[i] != nil {
+			if level == f.writers[i].Level {
+				f.writers[i].WriteMsg(when, msg, level)
+			}
+		}
+	}
+	return nil
+}
+
+func (f *multiFileLogWriter) Flush() {
+	for i := 0; i < len(f.writers); i++ {
+		if f.writers[i] != nil {
+			f.writers[i].Flush()
+		}
+	}
+}
+
+// newFilesWriter create a FileLogWriter returning as LoggerInterface.
+func newFilesWriter() Logger {
+	return &multiFileLogWriter{}
+}
+
+func init() {
+	Register(AdapterMultiFile, newFilesWriter)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/slack.go

@@ -0,0 +1,60 @@
+package logs
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// SLACKWriter implements beego LoggerInterface and is used to send jiaoliao webhook
+type SLACKWriter struct {
+	WebhookURL string `json:"webhookurl"`
+	Level      int    `json:"level"`
+}
+
+// newSLACKWriter create jiaoliao writer.
+func newSLACKWriter() Logger {
+	return &SLACKWriter{Level: LevelTrace}
+}
+
+// Init SLACKWriter with json config string
+func (s *SLACKWriter) Init(jsonconfig string) error {
+	return json.Unmarshal([]byte(jsonconfig), s)
+}
+
+// WriteMsg write message in smtp writer.
+// it will send an email with subject and only this message.
+func (s *SLACKWriter) WriteMsg(when time.Time, msg string, level int) error {
+	if level > s.Level {
+		return nil
+	}
+
+	text := fmt.Sprintf("{\"text\": \"%s %s\"}", when.Format("2006-01-02 15:04:05"), msg)
+
+	form := url.Values{}
+	form.Add("payload", text)
+
+	resp, err := http.PostForm(s.WebhookURL, form)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("Post webhook failed %s %d", resp.Status, resp.StatusCode)
+	}
+	return nil
+}
+
+// Flush implementing method. empty.
+func (s *SLACKWriter) Flush() {
+}
+
+// Destroy implementing method. empty.
+func (s *SLACKWriter) Destroy() {
+}
+
+func init() {
+	Register(AdapterSlack, newSLACKWriter)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/smtp.go

@@ -0,0 +1,149 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package logs
+
+import (
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/smtp"
+	"strings"
+	"time"
+)
+
+// SMTPWriter implements LoggerInterface and is used to send emails via given SMTP-server.
+type SMTPWriter struct {
+	Username           string   `json:"username"`
+	Password           string   `json:"password"`
+	Host               string   `json:"host"`
+	Subject            string   `json:"subject"`
+	FromAddress        string   `json:"fromAddress"`
+	RecipientAddresses []string `json:"sendTos"`
+	Level              int      `json:"level"`
+}
+
+// NewSMTPWriter create smtp writer.
+func newSMTPWriter() Logger {
+	return &SMTPWriter{Level: LevelTrace}
+}
+
+// Init smtp writer with json config.
+// config like:
+//	{
+//		"username":"example@gmail.com",
+//		"password:"password",
+//		"host":"smtp.gmail.com:465",
+//		"subject":"email title",
+//		"fromAddress":"from@example.com",
+//		"sendTos":["email1","email2"],
+//		"level":LevelError
+//	}
+func (s *SMTPWriter) Init(jsonconfig string) error {
+	return json.Unmarshal([]byte(jsonconfig), s)
+}
+
+func (s *SMTPWriter) getSMTPAuth(host string) smtp.Auth {
+	if len(strings.Trim(s.Username, " ")) == 0 && len(strings.Trim(s.Password, " ")) == 0 {
+		return nil
+	}
+	return smtp.PlainAuth(
+		"",
+		s.Username,
+		s.Password,
+		host,
+	)
+}
+
+func (s *SMTPWriter) sendMail(hostAddressWithPort string, auth smtp.Auth, fromAddress string, recipients []string, msgContent []byte) error {
+	client, err := smtp.Dial(hostAddressWithPort)
+	if err != nil {
+		return err
+	}
+
+	host, _, _ := net.SplitHostPort(hostAddressWithPort)
+	tlsConn := &tls.Config{
+		InsecureSkipVerify: true,
+		ServerName:         host,
+	}
+	if err = client.StartTLS(tlsConn); err != nil {
+		return err
+	}
+
+	if auth != nil {
+		if err = client.Auth(auth); err != nil {
+			return err
+		}
+	}
+
+	if err = client.Mail(fromAddress); err != nil {
+		return err
+	}
+
+	for _, rec := range recipients {
+		if err = client.Rcpt(rec); err != nil {
+			return err
+		}
+	}
+
+	w, err := client.Data()
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(msgContent)
+	if err != nil {
+		return err
+	}
+
+	err = w.Close()
+	if err != nil {
+		return err
+	}
+
+	return client.Quit()
+}
+
+// WriteMsg write message in smtp writer.
+// it will send an email with subject and only this message.
+func (s *SMTPWriter) WriteMsg(when time.Time, msg string, level int) error {
+	if level > s.Level {
+		return nil
+	}
+
+	hp := strings.Split(s.Host, ":")
+
+	// Set up authentication information.
+	auth := s.getSMTPAuth(hp[0])
+
+	// Connect to the server, authenticate, set the sender and recipient,
+	// and send the email all in one step.
+	contentType := "Content-Type: text/plain" + "; charset=UTF-8"
+	mailmsg := []byte("To: " + strings.Join(s.RecipientAddresses, ";") + "\r\nFrom: " + s.FromAddress + "<" + s.FromAddress +
+		">\r\nSubject: " + s.Subject + "\r\n" + contentType + "\r\n\r\n" + fmt.Sprintf(".%s", when.Format("2006-01-02 15:04:05")) + msg)
+
+	return s.sendMail(s.Host, auth, s.FromAddress, s.RecipientAddresses, mailmsg)
+}
+
+// Flush implementing method. empty.
+func (s *SMTPWriter) Flush() {
+}
+
+// Destroy implementing method. empty.
+func (s *SMTPWriter) Destroy() {
+}
+
+func init() {
+	Register(AdapterMail, newSMTPWriter)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/logs/stub.go

@@ -0,0 +1,96 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for github.com/astaxie/beego/logs, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: github.com/astaxie/beego/logs (exports: ; functions: NewLogger,Alert,Critical,Debug,Emergency,Error,Info,Informational,Notice,Trace,Warn,Warning)
+
+// Package logs is a stub of github.com/astaxie/beego/logs, generated by depstubber.
+package logs
+
+func Alert(_ interface{}, _ ...interface{}) {}
+
+type BeeLogger struct{}
+
+func (_ *BeeLogger) Alert(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) Async(_ ...int64) *BeeLogger {
+	return nil
+}
+
+func (_ *BeeLogger) Close() {}
+
+func (_ *BeeLogger) Critical(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) Debug(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) DelLogger(_ string) error {
+	return nil
+}
+
+func (_ *BeeLogger) Emergency(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) EnableFuncCallDepth(_ bool) {}
+
+func (_ *BeeLogger) Error(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) Flush() {}
+
+func (_ *BeeLogger) GetLevel() int {
+	return 0
+}
+
+func (_ *BeeLogger) GetLogFuncCallDepth() int {
+	return 0
+}
+
+func (_ *BeeLogger) Info(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) Informational(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) Notice(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) Reset() {}
+
+func (_ *BeeLogger) SetLevel(_ int) {}
+
+func (_ *BeeLogger) SetLogFuncCallDepth(_ int) {}
+
+func (_ *BeeLogger) SetLogger(_ string, _ ...string) error {
+	return nil
+}
+
+func (_ *BeeLogger) SetPrefix(_ string) {}
+
+func (_ *BeeLogger) Trace(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) Warn(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) Warning(_ string, _ ...interface{}) {}
+
+func (_ *BeeLogger) Write(_ []byte) (int, error) {
+	return 0, nil
+}
+
+func Critical(_ interface{}, _ ...interface{}) {}
+
+func Debug(_ interface{}, _ ...interface{}) {}
+
+func Emergency(_ interface{}, _ ...interface{}) {}
+
+func Error(_ interface{}, _ ...interface{}) {}
+
+func Info(_ interface{}, _ ...interface{}) {}
+
+func Informational(_ interface{}, _ ...interface{}) {}
+
+func NewLogger(_ ...int64) *BeeLogger {
+	return nil
+}
+
+func Notice(_ interface{}, _ ...interface{}) {}
+
+func Trace(_ interface{}, _ ...interface{}) {}
+
+func Warn(_ interface{}, _ ...interface{}) {}
+
+func Warning(_ interface{}, _ ...interface{}) {}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/mime.go

@@ -0,0 +1,556 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+var mimemaps = map[string]string{
+	".3dm":         "x-world/x-3dmf",
+	".3dmf":        "x-world/x-3dmf",
+	".7z":          "application/x-7z-compressed",
+	".a":           "application/octet-stream",
+	".aab":         "application/x-authorware-bin",
+	".aam":         "application/x-authorware-map",
+	".aas":         "application/x-authorware-seg",
+	".abc":         "text/vndabc",
+	".ace":         "application/x-ace-compressed",
+	".acgi":        "text/html",
+	".afl":         "video/animaflex",
+	".ai":          "application/postscript",
+	".aif":         "audio/aiff",
+	".aifc":        "audio/aiff",
+	".aiff":        "audio/aiff",
+	".aim":         "application/x-aim",
+	".aip":         "text/x-audiosoft-intra",
+	".alz":         "application/x-alz-compressed",
+	".ani":         "application/x-navi-animation",
+	".aos":         "application/x-nokia-9000-communicator-add-on-software",
+	".aps":         "application/mime",
+	".apk":         "application/vnd.android.package-archive",
+	".arc":         "application/x-arc-compressed",
+	".arj":         "application/arj",
+	".art":         "image/x-jg",
+	".asf":         "video/x-ms-asf",
+	".asm":         "text/x-asm",
+	".asp":         "text/asp",
+	".asx":         "application/x-mplayer2",
+	".au":          "audio/basic",
+	".avi":         "video/x-msvideo",
+	".avs":         "video/avs-video",
+	".bcpio":       "application/x-bcpio",
+	".bin":         "application/mac-binary",
+	".bmp":         "image/bmp",
+	".boo":         "application/book",
+	".book":        "application/book",
+	".boz":         "application/x-bzip2",
+	".bsh":         "application/x-bsh",
+	".bz2":         "application/x-bzip2",
+	".bz":          "application/x-bzip",
+	".c++":         "text/plain",
+	".c":           "text/x-c",
+	".cab":         "application/vnd.ms-cab-compressed",
+	".cat":         "application/vndms-pkiseccat",
+	".cc":          "text/x-c",
+	".ccad":        "application/clariscad",
+	".cco":         "application/x-cocoa",
+	".cdf":         "application/cdf",
+	".cer":         "application/pkix-cert",
+	".cha":         "application/x-chat",
+	".chat":        "application/x-chat",
+	".chrt":        "application/vnd.kde.kchart",
+	".class":       "application/java",
+	".com":         "text/plain",
+	".conf":        "text/plain",
+	".cpio":        "application/x-cpio",
+	".cpp":         "text/x-c",
+	".cpt":         "application/mac-compactpro",
+	".crl":         "application/pkcs-crl",
+	".crt":         "application/pkix-cert",
+	".crx":         "application/x-chrome-extension",
+	".csh":         "text/x-scriptcsh",
+	".css":         "text/css",
+	".csv":         "text/csv",
+	".cxx":         "text/plain",
+	".dar":         "application/x-dar",
+	".dcr":         "application/x-director",
+	".deb":         "application/x-debian-package",
+	".deepv":       "application/x-deepv",
+	".def":         "text/plain",
+	".der":         "application/x-x509-ca-cert",
+	".dif":         "video/x-dv",
+	".dir":         "application/x-director",
+	".divx":        "video/divx",
+	".dl":          "video/dl",
+	".dmg":         "application/x-apple-diskimage",
+	".doc":         "application/msword",
+	".dot":         "application/msword",
+	".dp":          "application/commonground",
+	".drw":         "application/drafting",
+	".dump":        "application/octet-stream",
+	".dv":          "video/x-dv",
+	".dvi":         "application/x-dvi",
+	".dwf":         "drawing/x-dwf=(old)",
+	".dwg":         "application/acad",
+	".dxf":         "application/dxf",
+	".dxr":         "application/x-director",
+	".el":          "text/x-scriptelisp",
+	".elc":         "application/x-bytecodeelisp=(compiled=elisp)",
+	".eml":         "message/rfc822",
+	".env":         "application/x-envoy",
+	".eps":         "application/postscript",
+	".es":          "application/x-esrehber",
+	".etx":         "text/x-setext",
+	".evy":         "application/envoy",
+	".exe":         "application/octet-stream",
+	".f77":         "text/x-fortran",
+	".f90":         "text/x-fortran",
+	".f":           "text/x-fortran",
+	".fdf":         "application/vndfdf",
+	".fif":         "application/fractals",
+	".fli":         "video/fli",
+	".flo":         "image/florian",
+	".flv":         "video/x-flv",
+	".flx":         "text/vndfmiflexstor",
+	".fmf":         "video/x-atomic3d-feature",
+	".for":         "text/x-fortran",
+	".fpx":         "image/vndfpx",
+	".frl":         "application/freeloader",
+	".funk":        "audio/make",
+	".g3":          "image/g3fax",
+	".g":           "text/plain",
+	".gif":         "image/gif",
+	".gl":          "video/gl",
+	".gsd":         "audio/x-gsm",
+	".gsm":         "audio/x-gsm",
+	".gsp":         "application/x-gsp",
+	".gss":         "application/x-gss",
+	".gtar":        "application/x-gtar",
+	".gz":          "application/x-compressed",
+	".gzip":        "application/x-gzip",
+	".h":           "text/x-h",
+	".hdf":         "application/x-hdf",
+	".help":        "application/x-helpfile",
+	".hgl":         "application/vndhp-hpgl",
+	".hh":          "text/x-h",
+	".hlb":         "text/x-script",
+	".hlp":         "application/hlp",
+	".hpg":         "application/vndhp-hpgl",
+	".hpgl":        "application/vndhp-hpgl",
+	".hqx":         "application/binhex",
+	".hta":         "application/hta",
+	".htc":         "text/x-component",
+	".htm":         "text/html",
+	".html":        "text/html",
+	".htmls":       "text/html",
+	".htt":         "text/webviewhtml",
+	".htx":         "text/html",
+	".ice":         "x-conference/x-cooltalk",
+	".ico":         "image/x-icon",
+	".ics":         "text/calendar",
+	".icz":         "text/calendar",
+	".idc":         "text/plain",
+	".ief":         "image/ief",
+	".iefs":        "image/ief",
+	".iges":        "application/iges",
+	".igs":         "application/iges",
+	".ima":         "application/x-ima",
+	".imap":        "application/x-httpd-imap",
+	".inf":         "application/inf",
+	".ins":         "application/x-internett-signup",
+	".ip":          "application/x-ip2",
+	".isu":         "video/x-isvideo",
+	".it":          "audio/it",
+	".iv":          "application/x-inventor",
+	".ivr":         "i-world/i-vrml",
+	".ivy":         "application/x-livescreen",
+	".jam":         "audio/x-jam",
+	".jav":         "text/x-java-source",
+	".java":        "text/x-java-source",
+	".jcm":         "application/x-java-commerce",
+	".jfif-tbnl":   "image/jpeg",
+	".jfif":        "image/jpeg",
+	".jnlp":        "application/x-java-jnlp-file",
+	".jpe":         "image/jpeg",
+	".jpeg":        "image/jpeg",
+	".jpg":         "image/jpeg",
+	".jps":         "image/x-jps",
+	".js":          "application/javascript",
+	".json":        "application/json",
+	".jut":         "image/jutvision",
+	".kar":         "audio/midi",
+	".karbon":      "application/vnd.kde.karbon",
+	".kfo":         "application/vnd.kde.kformula",
+	".flw":         "application/vnd.kde.kivio",
+	".kml":         "application/vnd.google-earth.kml+xml",
+	".kmz":         "application/vnd.google-earth.kmz",
+	".kon":         "application/vnd.kde.kontour",
+	".kpr":         "application/vnd.kde.kpresenter",
+	".kpt":         "application/vnd.kde.kpresenter",
+	".ksp":         "application/vnd.kde.kspread",
+	".kwd":         "application/vnd.kde.kword",
+	".kwt":         "application/vnd.kde.kword",
+	".ksh":         "text/x-scriptksh",
+	".la":          "audio/nspaudio",
+	".lam":         "audio/x-liveaudio",
+	".latex":       "application/x-latex",
+	".lha":         "application/lha",
+	".lhx":         "application/octet-stream",
+	".list":        "text/plain",
+	".lma":         "audio/nspaudio",
+	".log":         "text/plain",
+	".lsp":         "text/x-scriptlisp",
+	".lst":         "text/plain",
+	".lsx":         "text/x-la-asf",
+	".ltx":         "application/x-latex",
+	".lzh":         "application/octet-stream",
+	".lzx":         "application/lzx",
+	".m1v":         "video/mpeg",
+	".m2a":         "audio/mpeg",
+	".m2v":         "video/mpeg",
+	".m3u":         "audio/x-mpegurl",
+	".m":           "text/x-m",
+	".man":         "application/x-troff-man",
+	".manifest":    "text/cache-manifest",
+	".map":         "application/x-navimap",
+	".mar":         "text/plain",
+	".mbd":         "application/mbedlet",
+	".mc$":         "application/x-magic-cap-package-10",
+	".mcd":         "application/mcad",
+	".mcf":         "text/mcf",
+	".mcp":         "application/netmc",
+	".me":          "application/x-troff-me",
+	".mht":         "message/rfc822",
+	".mhtml":       "message/rfc822",
+	".mid":         "application/x-midi",
+	".midi":        "application/x-midi",
+	".mif":         "application/x-frame",
+	".mime":        "message/rfc822",
+	".mjf":         "audio/x-vndaudioexplosionmjuicemediafile",
+	".mjpg":        "video/x-motion-jpeg",
+	".mm":          "application/base64",
+	".mme":         "application/base64",
+	".mod":         "audio/mod",
+	".moov":        "video/quicktime",
+	".mov":         "video/quicktime",
+	".movie":       "video/x-sgi-movie",
+	".mp2":         "audio/mpeg",
+	".mp3":         "audio/mpeg3",
+	".mp4":         "video/mp4",
+	".mpa":         "audio/mpeg",
+	".mpc":         "application/x-project",
+	".mpe":         "video/mpeg",
+	".mpeg":        "video/mpeg",
+	".mpg":         "video/mpeg",
+	".mpga":        "audio/mpeg",
+	".mpp":         "application/vndms-project",
+	".mpt":         "application/x-project",
+	".mpv":         "application/x-project",
+	".mpx":         "application/x-project",
+	".mrc":         "application/marc",
+	".ms":          "application/x-troff-ms",
+	".mv":          "video/x-sgi-movie",
+	".my":          "audio/make",
+	".mzz":         "application/x-vndaudioexplosionmzz",
+	".nap":         "image/naplps",
+	".naplps":      "image/naplps",
+	".nc":          "application/x-netcdf",
+	".ncm":         "application/vndnokiaconfiguration-message",
+	".nif":         "image/x-niff",
+	".niff":        "image/x-niff",
+	".nix":         "application/x-mix-transfer",
+	".nsc":         "application/x-conference",
+	".nvd":         "application/x-navidoc",
+	".o":           "application/octet-stream",
+	".oda":         "application/oda",
+	".odb":         "application/vnd.oasis.opendocument.database",
+	".odc":         "application/vnd.oasis.opendocument.chart",
+	".odf":         "application/vnd.oasis.opendocument.formula",
+	".odg":         "application/vnd.oasis.opendocument.graphics",
+	".odi":         "application/vnd.oasis.opendocument.image",
+	".odm":         "application/vnd.oasis.opendocument.text-master",
+	".odp":         "application/vnd.oasis.opendocument.presentation",
+	".ods":         "application/vnd.oasis.opendocument.spreadsheet",
+	".odt":         "application/vnd.oasis.opendocument.text",
+	".oga":         "audio/ogg",
+	".ogg":         "audio/ogg",
+	".ogv":         "video/ogg",
+	".omc":         "application/x-omc",
+	".omcd":        "application/x-omcdatamaker",
+	".omcr":        "application/x-omcregerator",
+	".otc":         "application/vnd.oasis.opendocument.chart-template",
+	".otf":         "application/vnd.oasis.opendocument.formula-template",
+	".otg":         "application/vnd.oasis.opendocument.graphics-template",
+	".oth":         "application/vnd.oasis.opendocument.text-web",
+	".oti":         "application/vnd.oasis.opendocument.image-template",
+	".otm":         "application/vnd.oasis.opendocument.text-master",
+	".otp":         "application/vnd.oasis.opendocument.presentation-template",
+	".ots":         "application/vnd.oasis.opendocument.spreadsheet-template",
+	".ott":         "application/vnd.oasis.opendocument.text-template",
+	".p10":         "application/pkcs10",
+	".p12":         "application/pkcs-12",
+	".p7a":         "application/x-pkcs7-signature",
+	".p7c":         "application/pkcs7-mime",
+	".p7m":         "application/pkcs7-mime",
+	".p7r":         "application/x-pkcs7-certreqresp",
+	".p7s":         "application/pkcs7-signature",
+	".p":           "text/x-pascal",
+	".part":        "application/pro_eng",
+	".pas":         "text/pascal",
+	".pbm":         "image/x-portable-bitmap",
+	".pcl":         "application/vndhp-pcl",
+	".pct":         "image/x-pict",
+	".pcx":         "image/x-pcx",
+	".pdb":         "chemical/x-pdb",
+	".pdf":         "application/pdf",
+	".pfunk":       "audio/make",
+	".pgm":         "image/x-portable-graymap",
+	".pic":         "image/pict",
+	".pict":        "image/pict",
+	".pkg":         "application/x-newton-compatible-pkg",
+	".pko":         "application/vndms-pkipko",
+	".pl":          "text/x-scriptperl",
+	".plx":         "application/x-pixclscript",
+	".pm4":         "application/x-pagemaker",
+	".pm5":         "application/x-pagemaker",
+	".pm":          "text/x-scriptperl-module",
+	".png":         "image/png",
+	".pnm":         "application/x-portable-anymap",
+	".pot":         "application/mspowerpoint",
+	".pov":         "model/x-pov",
+	".ppa":         "application/vndms-powerpoint",
+	".ppm":         "image/x-portable-pixmap",
+	".pps":         "application/mspowerpoint",
+	".ppt":         "application/mspowerpoint",
+	".ppz":         "application/mspowerpoint",
+	".pre":         "application/x-freelance",
+	".prt":         "application/pro_eng",
+	".ps":          "application/postscript",
+	".psd":         "application/octet-stream",
+	".pvu":         "paleovu/x-pv",
+	".pwz":         "application/vndms-powerpoint",
+	".py":          "text/x-scriptphyton",
+	".pyc":         "application/x-bytecodepython",
+	".qcp":         "audio/vndqcelp",
+	".qd3":         "x-world/x-3dmf",
+	".qd3d":        "x-world/x-3dmf",
+	".qif":         "image/x-quicktime",
+	".qt":          "video/quicktime",
+	".qtc":         "video/x-qtc",
+	".qti":         "image/x-quicktime",
+	".qtif":        "image/x-quicktime",
+	".ra":          "audio/x-pn-realaudio",
+	".ram":         "audio/x-pn-realaudio",
+	".rar":         "application/x-rar-compressed",
+	".ras":         "application/x-cmu-raster",
+	".rast":        "image/cmu-raster",
+	".rexx":        "text/x-scriptrexx",
+	".rf":          "image/vndrn-realflash",
+	".rgb":         "image/x-rgb",
+	".rm":          "application/vndrn-realmedia",
+	".rmi":         "audio/mid",
+	".rmm":         "audio/x-pn-realaudio",
+	".rmp":         "audio/x-pn-realaudio",
+	".rng":         "application/ringing-tones",
+	".rnx":         "application/vndrn-realplayer",
+	".roff":        "application/x-troff",
+	".rp":          "image/vndrn-realpix",
+	".rpm":         "audio/x-pn-realaudio-plugin",
+	".rt":          "text/vndrn-realtext",
+	".rtf":         "text/richtext",
+	".rtx":         "text/richtext",
+	".rv":          "video/vndrn-realvideo",
+	".s":           "text/x-asm",
+	".s3m":         "audio/s3m",
+	".s7z":         "application/x-7z-compressed",
+	".saveme":      "application/octet-stream",
+	".sbk":         "application/x-tbook",
+	".scm":         "text/x-scriptscheme",
+	".sdml":        "text/plain",
+	".sdp":         "application/sdp",
+	".sdr":         "application/sounder",
+	".sea":         "application/sea",
+	".set":         "application/set",
+	".sgm":         "text/x-sgml",
+	".sgml":        "text/x-sgml",
+	".sh":          "text/x-scriptsh",
+	".shar":        "application/x-bsh",
+	".shtml":       "text/x-server-parsed-html",
+	".sid":         "audio/x-psid",
+	".skd":         "application/x-koan",
+	".skm":         "application/x-koan",
+	".skp":         "application/x-koan",
+	".skt":         "application/x-koan",
+	".sit":         "application/x-stuffit",
+	".sitx":        "application/x-stuffitx",
+	".sl":          "application/x-seelogo",
+	".smi":         "application/smil",
+	".smil":        "application/smil",
+	".snd":         "audio/basic",
+	".sol":         "application/solids",
+	".spc":         "text/x-speech",
+	".spl":         "application/futuresplash",
+	".spr":         "application/x-sprite",
+	".sprite":      "application/x-sprite",
+	".spx":         "audio/ogg",
+	".src":         "application/x-wais-source",
+	".ssi":         "text/x-server-parsed-html",
+	".ssm":         "application/streamingmedia",
+	".sst":         "application/vndms-pkicertstore",
+	".step":        "application/step",
+	".stl":         "application/sla",
+	".stp":         "application/step",
+	".sv4cpio":     "application/x-sv4cpio",
+	".sv4crc":      "application/x-sv4crc",
+	".svf":         "image/vnddwg",
+	".svg":         "image/svg+xml",
+	".svr":         "application/x-world",
+	".swf":         "application/x-shockwave-flash",
+	".t":           "application/x-troff",
+	".talk":        "text/x-speech",
+	".tar":         "application/x-tar",
+	".tbk":         "application/toolbook",
+	".tcl":         "text/x-scripttcl",
+	".tcsh":        "text/x-scripttcsh",
+	".tex":         "application/x-tex",
+	".texi":        "application/x-texinfo",
+	".texinfo":     "application/x-texinfo",
+	".text":        "text/plain",
+	".tgz":         "application/gnutar",
+	".tif":         "image/tiff",
+	".tiff":        "image/tiff",
+	".tr":          "application/x-troff",
+	".tsi":         "audio/tsp-audio",
+	".tsp":         "application/dsptype",
+	".tsv":         "text/tab-separated-values",
+	".turbot":      "image/florian",
+	".txt":         "text/plain",
+	".uil":         "text/x-uil",
+	".uni":         "text/uri-list",
+	".unis":        "text/uri-list",
+	".unv":         "application/i-deas",
+	".uri":         "text/uri-list",
+	".uris":        "text/uri-list",
+	".ustar":       "application/x-ustar",
+	".uu":          "text/x-uuencode",
+	".uue":         "text/x-uuencode",
+	".vcd":         "application/x-cdlink",
+	".vcf":         "text/x-vcard",
+	".vcard":       "text/x-vcard",
+	".vcs":         "text/x-vcalendar",
+	".vda":         "application/vda",
+	".vdo":         "video/vdo",
+	".vew":         "application/groupwise",
+	".viv":         "video/vivo",
+	".vivo":        "video/vivo",
+	".vmd":         "application/vocaltec-media-desc",
+	".vmf":         "application/vocaltec-media-file",
+	".voc":         "audio/voc",
+	".vos":         "video/vosaic",
+	".vox":         "audio/voxware",
+	".vqe":         "audio/x-twinvq-plugin",
+	".vqf":         "audio/x-twinvq",
+	".vql":         "audio/x-twinvq-plugin",
+	".vrml":        "application/x-vrml",
+	".vrt":         "x-world/x-vrt",
+	".vsd":         "application/x-visio",
+	".vst":         "application/x-visio",
+	".vsw":         "application/x-visio",
+	".w60":         "application/wordperfect60",
+	".w61":         "application/wordperfect61",
+	".w6w":         "application/msword",
+	".wav":         "audio/wav",
+	".wb1":         "application/x-qpro",
+	".wbmp":        "image/vnd.wap.wbmp",
+	".web":         "application/vndxara",
+	".wiz":         "application/msword",
+	".wk1":         "application/x-123",
+	".wmf":         "windows/metafile",
+	".wml":         "text/vnd.wap.wml",
+	".wmlc":        "application/vnd.wap.wmlc",
+	".wmls":        "text/vnd.wap.wmlscript",
+	".wmlsc":       "application/vnd.wap.wmlscriptc",
+	".word":        "application/msword",
+	".wp5":         "application/wordperfect",
+	".wp6":         "application/wordperfect",
+	".wp":          "application/wordperfect",
+	".wpd":         "application/wordperfect",
+	".wq1":         "application/x-lotus",
+	".wri":         "application/mswrite",
+	".wrl":         "application/x-world",
+	".wrz":         "model/vrml",
+	".wsc":         "text/scriplet",
+	".wsrc":        "application/x-wais-source",
+	".wtk":         "application/x-wintalk",
+	".x-png":       "image/png",
+	".xbm":         "image/x-xbitmap",
+	".xdr":         "video/x-amt-demorun",
+	".xgz":         "xgl/drawing",
+	".xif":         "image/vndxiff",
+	".xl":          "application/excel",
+	".xla":         "application/excel",
+	".xlb":         "application/excel",
+	".xlc":         "application/excel",
+	".xld":         "application/excel",
+	".xlk":         "application/excel",
+	".xll":         "application/excel",
+	".xlm":         "application/excel",
+	".xls":         "application/excel",
+	".xlt":         "application/excel",
+	".xlv":         "application/excel",
+	".xlw":         "application/excel",
+	".xm":          "audio/xm",
+	".xml":         "text/xml",
+	".xmz":         "xgl/movie",
+	".xpix":        "application/x-vndls-xpix",
+	".xpm":         "image/x-xpixmap",
+	".xsr":         "video/x-amt-showrun",
+	".xwd":         "image/x-xwd",
+	".xyz":         "chemical/x-pdb",
+	".z":           "application/x-compress",
+	".zip":         "application/zip",
+	".zoo":         "application/octet-stream",
+	".zsh":         "text/x-scriptzsh",
+	".docx":        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	".docm":        "application/vnd.ms-word.document.macroEnabled.12",
+	".dotx":        "application/vnd.openxmlformats-officedocument.wordprocessingml.template",
+	".dotm":        "application/vnd.ms-word.template.macroEnabled.12",
+	".xlsx":        "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+	".xlsm":        "application/vnd.ms-excel.sheet.macroEnabled.12",
+	".xltx":        "application/vnd.openxmlformats-officedocument.spreadsheetml.template",
+	".xltm":        "application/vnd.ms-excel.template.macroEnabled.12",
+	".xlsb":        "application/vnd.ms-excel.sheet.binary.macroEnabled.12",
+	".xlam":        "application/vnd.ms-excel.addin.macroEnabled.12",
+	".pptx":        "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	".pptm":        "application/vnd.ms-powerpoint.presentation.macroEnabled.12",
+	".ppsx":        "application/vnd.openxmlformats-officedocument.presentationml.slideshow",
+	".ppsm":        "application/vnd.ms-powerpoint.slideshow.macroEnabled.12",
+	".potx":        "application/vnd.openxmlformats-officedocument.presentationml.template",
+	".potm":        "application/vnd.ms-powerpoint.template.macroEnabled.12",
+	".ppam":        "application/vnd.ms-powerpoint.addin.macroEnabled.12",
+	".sldx":        "application/vnd.openxmlformats-officedocument.presentationml.slide",
+	".sldm":        "application/vnd.ms-powerpoint.slide.macroEnabled.12",
+	".thmx":        "application/vnd.ms-officetheme",
+	".onetoc":      "application/onenote",
+	".onetoc2":     "application/onenote",
+	".onetmp":      "application/onenote",
+	".onepkg":      "application/onenote",
+	".key":         "application/x-iwork-keynote-sffkey",
+	".kth":         "application/x-iwork-keynote-sffkth",
+	".nmbtemplate": "application/x-iwork-numbers-sfftemplate",
+	".numbers":     "application/x-iwork-numbers-sffnumbers",
+	".pages":       "application/x-iwork-pages-sffpages",
+	".template":    "application/x-iwork-pages-sfftemplate",
+	".xpi":         "application/x-xpinstall",
+	".oex":         "application/x-opera-extension",
+	".mustache":    "text/html",
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/namespace.go

@@ -0,0 +1,396 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"net/http"
+	"strings"
+
+	beecontext "github.com/astaxie/beego/context"
+)
+
+type namespaceCond func(*beecontext.Context) bool
+
+// LinkNamespace used as link action
+type LinkNamespace func(*Namespace)
+
+// Namespace is store all the info
+type Namespace struct {
+	prefix   string
+	handlers *ControllerRegister
+}
+
+// NewNamespace get new Namespace
+func NewNamespace(prefix string, params ...LinkNamespace) *Namespace {
+	ns := &Namespace{
+		prefix:   prefix,
+		handlers: NewControllerRegister(),
+	}
+	for _, p := range params {
+		p(ns)
+	}
+	return ns
+}
+
+// Cond set condition function
+// if cond return true can run this namespace, else can't
+// usage:
+// ns.Cond(func (ctx *context.Context) bool{
+//       if ctx.Input.Domain() == "api.beego.me" {
+//         return true
+//       }
+//       return false
+//   })
+// Cond as the first filter
+func (n *Namespace) Cond(cond namespaceCond) *Namespace {
+	fn := func(ctx *beecontext.Context) {
+		if !cond(ctx) {
+			exception("405", ctx)
+		}
+	}
+	if v := n.handlers.filters[BeforeRouter]; len(v) > 0 {
+		mr := new(FilterRouter)
+		mr.tree = NewTree()
+		mr.pattern = "*"
+		mr.filterFunc = fn
+		mr.tree.AddRouter("*", true)
+		n.handlers.filters[BeforeRouter] = append([]*FilterRouter{mr}, v...)
+	} else {
+		n.handlers.InsertFilter("*", BeforeRouter, fn)
+	}
+	return n
+}
+
+// Filter add filter in the Namespace
+// action has before & after
+// FilterFunc
+// usage:
+// Filter("before", func (ctx *context.Context){
+//       _, ok := ctx.Input.Session("uid").(int)
+//       if !ok && ctx.Request.RequestURI != "/login" {
+//          ctx.Redirect(302, "/login")
+//        }
+//   })
+func (n *Namespace) Filter(action string, filter ...FilterFunc) *Namespace {
+	var a int
+	if action == "before" {
+		a = BeforeRouter
+	} else if action == "after" {
+		a = FinishRouter
+	}
+	for _, f := range filter {
+		n.handlers.InsertFilter("*", a, f)
+	}
+	return n
+}
+
+// Router same as beego.Rourer
+// refer: https://godoc.org/github.com/astaxie/beego#Router
+func (n *Namespace) Router(rootpath string, c ControllerInterface, mappingMethods ...string) *Namespace {
+	n.handlers.Add(rootpath, c, mappingMethods...)
+	return n
+}
+
+// AutoRouter same as beego.AutoRouter
+// refer: https://godoc.org/github.com/astaxie/beego#AutoRouter
+func (n *Namespace) AutoRouter(c ControllerInterface) *Namespace {
+	n.handlers.AddAuto(c)
+	return n
+}
+
+// AutoPrefix same as beego.AutoPrefix
+// refer: https://godoc.org/github.com/astaxie/beego#AutoPrefix
+func (n *Namespace) AutoPrefix(prefix string, c ControllerInterface) *Namespace {
+	n.handlers.AddAutoPrefix(prefix, c)
+	return n
+}
+
+// Get same as beego.Get
+// refer: https://godoc.org/github.com/astaxie/beego#Get
+func (n *Namespace) Get(rootpath string, f FilterFunc) *Namespace {
+	n.handlers.Get(rootpath, f)
+	return n
+}
+
+// Post same as beego.Post
+// refer: https://godoc.org/github.com/astaxie/beego#Post
+func (n *Namespace) Post(rootpath string, f FilterFunc) *Namespace {
+	n.handlers.Post(rootpath, f)
+	return n
+}
+
+// Delete same as beego.Delete
+// refer: https://godoc.org/github.com/astaxie/beego#Delete
+func (n *Namespace) Delete(rootpath string, f FilterFunc) *Namespace {
+	n.handlers.Delete(rootpath, f)
+	return n
+}
+
+// Put same as beego.Put
+// refer: https://godoc.org/github.com/astaxie/beego#Put
+func (n *Namespace) Put(rootpath string, f FilterFunc) *Namespace {
+	n.handlers.Put(rootpath, f)
+	return n
+}
+
+// Head same as beego.Head
+// refer: https://godoc.org/github.com/astaxie/beego#Head
+func (n *Namespace) Head(rootpath string, f FilterFunc) *Namespace {
+	n.handlers.Head(rootpath, f)
+	return n
+}
+
+// Options same as beego.Options
+// refer: https://godoc.org/github.com/astaxie/beego#Options
+func (n *Namespace) Options(rootpath string, f FilterFunc) *Namespace {
+	n.handlers.Options(rootpath, f)
+	return n
+}
+
+// Patch same as beego.Patch
+// refer: https://godoc.org/github.com/astaxie/beego#Patch
+func (n *Namespace) Patch(rootpath string, f FilterFunc) *Namespace {
+	n.handlers.Patch(rootpath, f)
+	return n
+}
+
+// Any same as beego.Any
+// refer: https://godoc.org/github.com/astaxie/beego#Any
+func (n *Namespace) Any(rootpath string, f FilterFunc) *Namespace {
+	n.handlers.Any(rootpath, f)
+	return n
+}
+
+// Handler same as beego.Handler
+// refer: https://godoc.org/github.com/astaxie/beego#Handler
+func (n *Namespace) Handler(rootpath string, h http.Handler) *Namespace {
+	n.handlers.Handler(rootpath, h)
+	return n
+}
+
+// Include add include class
+// refer: https://godoc.org/github.com/astaxie/beego#Include
+func (n *Namespace) Include(cList ...ControllerInterface) *Namespace {
+	n.handlers.Include(cList...)
+	return n
+}
+
+// Namespace add nest Namespace
+// usage:
+//ns := beego.NewNamespace(“/v1”).
+//Namespace(
+//    beego.NewNamespace("/shop").
+//        Get("/:id", func(ctx *context.Context) {
+//            ctx.Output.Body([]byte("shopinfo"))
+//    }),
+//    beego.NewNamespace("/order").
+//        Get("/:id", func(ctx *context.Context) {
+//            ctx.Output.Body([]byte("orderinfo"))
+//    }),
+//    beego.NewNamespace("/crm").
+//        Get("/:id", func(ctx *context.Context) {
+//            ctx.Output.Body([]byte("crminfo"))
+//    }),
+//)
+func (n *Namespace) Namespace(ns ...*Namespace) *Namespace {
+	for _, ni := range ns {
+		for k, v := range ni.handlers.routers {
+			if _, ok := n.handlers.routers[k]; ok {
+				addPrefix(v, ni.prefix)
+				n.handlers.routers[k].AddTree(ni.prefix, v)
+			} else {
+				t := NewTree()
+				t.AddTree(ni.prefix, v)
+				addPrefix(t, ni.prefix)
+				n.handlers.routers[k] = t
+			}
+		}
+		if ni.handlers.enableFilter {
+			for pos, filterList := range ni.handlers.filters {
+				for _, mr := range filterList {
+					t := NewTree()
+					t.AddTree(ni.prefix, mr.tree)
+					mr.tree = t
+					n.handlers.insertFilterRouter(pos, mr)
+				}
+			}
+		}
+	}
+	return n
+}
+
+// AddNamespace register Namespace into beego.Handler
+// support multi Namespace
+func AddNamespace(nl ...*Namespace) {
+	for _, n := range nl {
+		for k, v := range n.handlers.routers {
+			if _, ok := BeeApp.Handlers.routers[k]; ok {
+				addPrefix(v, n.prefix)
+				BeeApp.Handlers.routers[k].AddTree(n.prefix, v)
+			} else {
+				t := NewTree()
+				t.AddTree(n.prefix, v)
+				addPrefix(t, n.prefix)
+				BeeApp.Handlers.routers[k] = t
+			}
+		}
+		if n.handlers.enableFilter {
+			for pos, filterList := range n.handlers.filters {
+				for _, mr := range filterList {
+					t := NewTree()
+					t.AddTree(n.prefix, mr.tree)
+					mr.tree = t
+					BeeApp.Handlers.insertFilterRouter(pos, mr)
+				}
+			}
+		}
+	}
+}
+
+func addPrefix(t *Tree, prefix string) {
+	for _, v := range t.fixrouters {
+		addPrefix(v, prefix)
+	}
+	if t.wildcard != nil {
+		addPrefix(t.wildcard, prefix)
+	}
+	for _, l := range t.leaves {
+		if c, ok := l.runObject.(*ControllerInfo); ok {
+			if !strings.HasPrefix(c.pattern, prefix) {
+				c.pattern = prefix + c.pattern
+			}
+		}
+	}
+}
+
+// NSCond is Namespace Condition
+func NSCond(cond namespaceCond) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Cond(cond)
+	}
+}
+
+// NSBefore Namespace BeforeRouter filter
+func NSBefore(filterList ...FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Filter("before", filterList...)
+	}
+}
+
+// NSAfter add Namespace FinishRouter filter
+func NSAfter(filterList ...FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Filter("after", filterList...)
+	}
+}
+
+// NSInclude Namespace Include ControllerInterface
+func NSInclude(cList ...ControllerInterface) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Include(cList...)
+	}
+}
+
+// NSRouter call Namespace Router
+func NSRouter(rootpath string, c ControllerInterface, mappingMethods ...string) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Router(rootpath, c, mappingMethods...)
+	}
+}
+
+// NSGet call Namespace Get
+func NSGet(rootpath string, f FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Get(rootpath, f)
+	}
+}
+
+// NSPost call Namespace Post
+func NSPost(rootpath string, f FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Post(rootpath, f)
+	}
+}
+
+// NSHead call Namespace Head
+func NSHead(rootpath string, f FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Head(rootpath, f)
+	}
+}
+
+// NSPut call Namespace Put
+func NSPut(rootpath string, f FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Put(rootpath, f)
+	}
+}
+
+// NSDelete call Namespace Delete
+func NSDelete(rootpath string, f FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Delete(rootpath, f)
+	}
+}
+
+// NSAny call Namespace Any
+func NSAny(rootpath string, f FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Any(rootpath, f)
+	}
+}
+
+// NSOptions call Namespace Options
+func NSOptions(rootpath string, f FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Options(rootpath, f)
+	}
+}
+
+// NSPatch call Namespace Patch
+func NSPatch(rootpath string, f FilterFunc) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Patch(rootpath, f)
+	}
+}
+
+// NSAutoRouter call Namespace AutoRouter
+func NSAutoRouter(c ControllerInterface) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.AutoRouter(c)
+	}
+}
+
+// NSAutoPrefix call Namespace AutoPrefix
+func NSAutoPrefix(prefix string, c ControllerInterface) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.AutoPrefix(prefix, c)
+	}
+}
+
+// NSNamespace add sub Namespace
+func NSNamespace(prefix string, params ...LinkNamespace) LinkNamespace {
+	return func(ns *Namespace) {
+		n := NewNamespace(prefix, params...)
+		ns.Namespace(n)
+	}
+}
+
+// NSHandler add handler
+func NSHandler(rootpath string, h http.Handler) LinkNamespace {
+	return func(ns *Namespace) {
+		ns.Handler(rootpath, h)
+	}
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/parser.go

@@ -0,0 +1,591 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"unicode"
+
+	"github.com/astaxie/beego/context/param"
+	"github.com/astaxie/beego/logs"
+	"github.com/astaxie/beego/utils"
+)
+
+var globalRouterTemplate = `package {{.routersDir}}
+
+import (
+	"github.com/astaxie/beego"
+	"github.com/astaxie/beego/context/param"{{.globalimport}}
+)
+
+func init() {
+{{.globalinfo}}
+}
+`
+
+var (
+	lastupdateFilename = "lastupdate.tmp"
+	commentFilename    string
+	pkgLastupdate      map[string]int64
+	genInfoList        map[string][]ControllerComments
+
+	routerHooks = map[string]int{
+		"beego.BeforeStatic": BeforeStatic,
+		"beego.BeforeRouter": BeforeRouter,
+		"beego.BeforeExec":   BeforeExec,
+		"beego.AfterExec":    AfterExec,
+		"beego.FinishRouter": FinishRouter,
+	}
+
+	routerHooksMapping = map[int]string{
+		BeforeStatic: "beego.BeforeStatic",
+		BeforeRouter: "beego.BeforeRouter",
+		BeforeExec:   "beego.BeforeExec",
+		AfterExec:    "beego.AfterExec",
+		FinishRouter: "beego.FinishRouter",
+	}
+)
+
+const commentPrefix = "commentsRouter_"
+
+func init() {
+	pkgLastupdate = make(map[string]int64)
+}
+
+func parserPkg(pkgRealpath, pkgpath string) error {
+	rep := strings.NewReplacer("\\", "_", "/", "_", ".", "_")
+	commentFilename, _ = filepath.Rel(AppPath, pkgRealpath)
+	commentFilename = commentPrefix + rep.Replace(commentFilename) + ".go"
+	if !compareFile(pkgRealpath) {
+		logs.Info(pkgRealpath + " no changed")
+		return nil
+	}
+	genInfoList = make(map[string][]ControllerComments)
+	fileSet := token.NewFileSet()
+	astPkgs, err := parser.ParseDir(fileSet, pkgRealpath, func(info os.FileInfo) bool {
+		name := info.Name()
+		return !info.IsDir() && !strings.HasPrefix(name, ".") && strings.HasSuffix(name, ".go")
+	}, parser.ParseComments)
+
+	if err != nil {
+		return err
+	}
+	for _, pkg := range astPkgs {
+		for _, fl := range pkg.Files {
+			for _, d := range fl.Decls {
+				switch specDecl := d.(type) {
+				case *ast.FuncDecl:
+					if specDecl.Recv != nil {
+						exp, ok := specDecl.Recv.List[0].Type.(*ast.StarExpr) // Check that the type is correct first beforing throwing to parser
+						if ok {
+							parserComments(specDecl, fmt.Sprint(exp.X), pkgpath)
+						}
+					}
+				}
+			}
+		}
+	}
+	genRouterCode(pkgRealpath)
+	savetoFile(pkgRealpath)
+	return nil
+}
+
+type parsedComment struct {
+	routerPath string
+	methods    []string
+	params     map[string]parsedParam
+	filters    []parsedFilter
+	imports    []parsedImport
+}
+
+type parsedImport struct {
+	importPath  string
+	importAlias string
+}
+
+type parsedFilter struct {
+	pattern string
+	pos     int
+	filter  string
+	params  []bool
+}
+
+type parsedParam struct {
+	name     string
+	datatype string
+	location string
+	defValue string
+	required bool
+}
+
+func parserComments(f *ast.FuncDecl, controllerName, pkgpath string) error {
+	if f.Doc != nil {
+		parsedComments, err := parseComment(f.Doc.List)
+		if err != nil {
+			return err
+		}
+		for _, parsedComment := range parsedComments {
+			if parsedComment.routerPath != "" {
+				key := pkgpath + ":" + controllerName
+				cc := ControllerComments{}
+				cc.Method = f.Name.String()
+				cc.Router = parsedComment.routerPath
+				cc.AllowHTTPMethods = parsedComment.methods
+				cc.MethodParams = buildMethodParams(f.Type.Params.List, parsedComment)
+				cc.FilterComments = buildFilters(parsedComment.filters)
+				cc.ImportComments = buildImports(parsedComment.imports)
+				genInfoList[key] = append(genInfoList[key], cc)
+			}
+		}
+	}
+	return nil
+}
+
+func buildImports(pis []parsedImport) []*ControllerImportComments {
+	var importComments []*ControllerImportComments
+
+	for _, pi := range pis {
+		importComments = append(importComments, &ControllerImportComments{
+			ImportPath:  pi.importPath,
+			ImportAlias: pi.importAlias,
+		})
+	}
+
+	return importComments
+}
+
+func buildFilters(pfs []parsedFilter) []*ControllerFilterComments {
+	var filterComments []*ControllerFilterComments
+
+	for _, pf := range pfs {
+		var (
+			returnOnOutput bool
+			resetParams    bool
+		)
+
+		if len(pf.params) >= 1 {
+			returnOnOutput = pf.params[0]
+		}
+
+		if len(pf.params) >= 2 {
+			resetParams = pf.params[1]
+		}
+
+		filterComments = append(filterComments, &ControllerFilterComments{
+			Filter:         pf.filter,
+			Pattern:        pf.pattern,
+			Pos:            pf.pos,
+			ReturnOnOutput: returnOnOutput,
+			ResetParams:    resetParams,
+		})
+	}
+
+	return filterComments
+}
+
+func buildMethodParams(funcParams []*ast.Field, pc *parsedComment) []*param.MethodParam {
+	result := make([]*param.MethodParam, 0, len(funcParams))
+	for _, fparam := range funcParams {
+		for _, pName := range fparam.Names {
+			methodParam := buildMethodParam(fparam, pName.Name, pc)
+			result = append(result, methodParam)
+		}
+	}
+	return result
+}
+
+func buildMethodParam(fparam *ast.Field, name string, pc *parsedComment) *param.MethodParam {
+	options := []param.MethodParamOption{}
+	if cparam, ok := pc.params[name]; ok {
+		//Build param from comment info
+		name = cparam.name
+		if cparam.required {
+			options = append(options, param.IsRequired)
+		}
+		switch cparam.location {
+		case "body":
+			options = append(options, param.InBody)
+		case "header":
+			options = append(options, param.InHeader)
+		case "path":
+			options = append(options, param.InPath)
+		}
+		if cparam.defValue != "" {
+			options = append(options, param.Default(cparam.defValue))
+		}
+	} else {
+		if paramInPath(name, pc.routerPath) {
+			options = append(options, param.InPath)
+		}
+	}
+	return param.New(name, options...)
+}
+
+func paramInPath(name, route string) bool {
+	return strings.HasSuffix(route, ":"+name) ||
+		strings.Contains(route, ":"+name+"/")
+}
+
+var routeRegex = regexp.MustCompile(`@router\s+(\S+)(?:\s+\[(\S+)\])?`)
+
+func parseComment(lines []*ast.Comment) (pcs []*parsedComment, err error) {
+	pcs = []*parsedComment{}
+	params := map[string]parsedParam{}
+	filters := []parsedFilter{}
+	imports := []parsedImport{}
+
+	for _, c := range lines {
+		t := strings.TrimSpace(strings.TrimLeft(c.Text, "//"))
+		if strings.HasPrefix(t, "@Param") {
+			pv := getparams(strings.TrimSpace(strings.TrimLeft(t, "@Param")))
+			if len(pv) < 4 {
+				logs.Error("Invalid @Param format. Needs at least 4 parameters")
+			}
+			p := parsedParam{}
+			names := strings.SplitN(pv[0], "=>", 2)
+			p.name = names[0]
+			funcParamName := p.name
+			if len(names) > 1 {
+				funcParamName = names[1]
+			}
+			p.location = pv[1]
+			p.datatype = pv[2]
+			switch len(pv) {
+			case 5:
+				p.required, _ = strconv.ParseBool(pv[3])
+			case 6:
+				p.defValue = pv[3]
+				p.required, _ = strconv.ParseBool(pv[4])
+			}
+			params[funcParamName] = p
+		}
+	}
+
+	for _, c := range lines {
+		t := strings.TrimSpace(strings.TrimLeft(c.Text, "//"))
+		if strings.HasPrefix(t, "@Import") {
+			iv := getparams(strings.TrimSpace(strings.TrimLeft(t, "@Import")))
+			if len(iv) == 0 || len(iv) > 2 {
+				logs.Error("Invalid @Import format. Only accepts 1 or 2 parameters")
+				continue
+			}
+
+			p := parsedImport{}
+			p.importPath = iv[0]
+
+			if len(iv) == 2 {
+				p.importAlias = iv[1]
+			}
+
+			imports = append(imports, p)
+		}
+	}
+
+filterLoop:
+	for _, c := range lines {
+		t := strings.TrimSpace(strings.TrimLeft(c.Text, "//"))
+		if strings.HasPrefix(t, "@Filter") {
+			fv := getparams(strings.TrimSpace(strings.TrimLeft(t, "@Filter")))
+			if len(fv) < 3 {
+				logs.Error("Invalid @Filter format. Needs at least 3 parameters")
+				continue filterLoop
+			}
+
+			p := parsedFilter{}
+			p.pattern = fv[0]
+			posName := fv[1]
+			if pos, exists := routerHooks[posName]; exists {
+				p.pos = pos
+			} else {
+				logs.Error("Invalid @Filter pos: ", posName)
+				continue filterLoop
+			}
+
+			p.filter = fv[2]
+			fvParams := fv[3:]
+			for _, fvParam := range fvParams {
+				switch fvParam {
+				case "true":
+					p.params = append(p.params, true)
+				case "false":
+					p.params = append(p.params, false)
+				default:
+					logs.Error("Invalid @Filter param: ", fvParam)
+					continue filterLoop
+				}
+			}
+
+			filters = append(filters, p)
+		}
+	}
+
+	for _, c := range lines {
+		var pc = &parsedComment{}
+		pc.params = params
+		pc.filters = filters
+		pc.imports = imports
+
+		t := strings.TrimSpace(strings.TrimLeft(c.Text, "//"))
+		if strings.HasPrefix(t, "@router") {
+			t := strings.TrimSpace(strings.TrimLeft(c.Text, "//"))
+			matches := routeRegex.FindStringSubmatch(t)
+			if len(matches) == 3 {
+				pc.routerPath = matches[1]
+				methods := matches[2]
+				if methods == "" {
+					pc.methods = []string{"get"}
+					//pc.hasGet = true
+				} else {
+					pc.methods = strings.Split(methods, ",")
+					//pc.hasGet = strings.Contains(methods, "get")
+				}
+				pcs = append(pcs, pc)
+			} else {
+				return nil, errors.New("Router information is missing")
+			}
+		}
+	}
+	return
+}
+
+// direct copy from bee\g_docs.go
+// analysis params return []string
+// @Param	query		form	 string	true		"The email for login"
+// [query form string true "The email for login"]
+func getparams(str string) []string {
+	var s []rune
+	var j int
+	var start bool
+	var r []string
+	var quoted int8
+	for _, c := range str {
+		if unicode.IsSpace(c) && quoted == 0 {
+			if !start {
+				continue
+			} else {
+				start = false
+				j++
+				r = append(r, string(s))
+				s = make([]rune, 0)
+				continue
+			}
+		}
+
+		start = true
+		if c == '"' {
+			quoted ^= 1
+			continue
+		}
+		s = append(s, c)
+	}
+	if len(s) > 0 {
+		r = append(r, string(s))
+	}
+	return r
+}
+
+func genRouterCode(pkgRealpath string) {
+	os.Mkdir(getRouterDir(pkgRealpath), 0755)
+	logs.Info("generate router from comments")
+	var (
+		globalinfo   string
+		globalimport string
+		sortKey      []string
+	)
+	for k := range genInfoList {
+		sortKey = append(sortKey, k)
+	}
+	sort.Strings(sortKey)
+	for _, k := range sortKey {
+		cList := genInfoList[k]
+		sort.Sort(ControllerCommentsSlice(cList))
+		for _, c := range cList {
+			allmethod := "nil"
+			if len(c.AllowHTTPMethods) > 0 {
+				allmethod = "[]string{"
+				for _, m := range c.AllowHTTPMethods {
+					allmethod += `"` + m + `",`
+				}
+				allmethod = strings.TrimRight(allmethod, ",") + "}"
+			}
+
+			params := "nil"
+			if len(c.Params) > 0 {
+				params = "[]map[string]string{"
+				for _, p := range c.Params {
+					for k, v := range p {
+						params = params + `map[string]string{` + k + `:"` + v + `"},`
+					}
+				}
+				params = strings.TrimRight(params, ",") + "}"
+			}
+
+			methodParams := "param.Make("
+			if len(c.MethodParams) > 0 {
+				lines := make([]string, 0, len(c.MethodParams))
+				for _, m := range c.MethodParams {
+					lines = append(lines, fmt.Sprint(m))
+				}
+				methodParams += "\n				" +
+					strings.Join(lines, ",\n				") +
+					",\n			"
+			}
+			methodParams += ")"
+
+			imports := ""
+			if len(c.ImportComments) > 0 {
+				for _, i := range c.ImportComments {
+					var s string
+					if i.ImportAlias != "" {
+						s = fmt.Sprintf(`
+	%s "%s"`, i.ImportAlias, i.ImportPath)
+					} else {
+						s = fmt.Sprintf(`
+	"%s"`, i.ImportPath)
+					}
+					if !strings.Contains(globalimport, s) {
+						imports += s
+					}
+				}
+			}
+
+			filters := ""
+			if len(c.FilterComments) > 0 {
+				for _, f := range c.FilterComments {
+					filters += fmt.Sprintf(`                &beego.ControllerFilter{
+                    Pattern: "%s",
+                    Pos: %s,
+                    Filter: %s,
+                    ReturnOnOutput: %v,
+                    ResetParams: %v,
+                },`, f.Pattern, routerHooksMapping[f.Pos], f.Filter, f.ReturnOnOutput, f.ResetParams)
+				}
+			}
+
+			if filters == "" {
+				filters = "nil"
+			} else {
+				filters = fmt.Sprintf(`[]*beego.ControllerFilter{
+%s
+            }`, filters)
+			}
+
+			globalimport += imports
+
+			globalinfo = globalinfo + `
+    beego.GlobalControllerRouter["` + k + `"] = append(beego.GlobalControllerRouter["` + k + `"],
+        beego.ControllerComments{
+            Method: "` + strings.TrimSpace(c.Method) + `",
+            ` + `Router: "` + c.Router + `"` + `,
+            AllowHTTPMethods: ` + allmethod + `,
+            MethodParams: ` + methodParams + `,
+            Filters: ` + filters + `,
+            Params: ` + params + `})
+`
+		}
+	}
+
+	if globalinfo != "" {
+		f, err := os.Create(filepath.Join(getRouterDir(pkgRealpath), commentFilename))
+		if err != nil {
+			panic(err)
+		}
+		defer f.Close()
+
+		routersDir := AppConfig.DefaultString("routersdir", "routers")
+		content := strings.Replace(globalRouterTemplate, "{{.globalinfo}}", globalinfo, -1)
+		content = strings.Replace(content, "{{.routersDir}}", routersDir, -1)
+		content = strings.Replace(content, "{{.globalimport}}", globalimport, -1)
+		f.WriteString(content)
+	}
+}
+
+func compareFile(pkgRealpath string) bool {
+	if !utils.FileExists(filepath.Join(getRouterDir(pkgRealpath), commentFilename)) {
+		return true
+	}
+	if utils.FileExists(lastupdateFilename) {
+		content, err := ioutil.ReadFile(lastupdateFilename)
+		if err != nil {
+			return true
+		}
+		json.Unmarshal(content, &pkgLastupdate)
+		lastupdate, err := getpathTime(pkgRealpath)
+		if err != nil {
+			return true
+		}
+		if v, ok := pkgLastupdate[pkgRealpath]; ok {
+			if lastupdate <= v {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func savetoFile(pkgRealpath string) {
+	lastupdate, err := getpathTime(pkgRealpath)
+	if err != nil {
+		return
+	}
+	pkgLastupdate[pkgRealpath] = lastupdate
+	d, err := json.Marshal(pkgLastupdate)
+	if err != nil {
+		return
+	}
+	ioutil.WriteFile(lastupdateFilename, d, os.ModePerm)
+}
+
+func getpathTime(pkgRealpath string) (lastupdate int64, err error) {
+	fl, err := ioutil.ReadDir(pkgRealpath)
+	if err != nil {
+		return lastupdate, err
+	}
+	for _, f := range fl {
+		if lastupdate < f.ModTime().UnixNano() {
+			lastupdate = f.ModTime().UnixNano()
+		}
+	}
+	return lastupdate, nil
+}
+
+func getRouterDir(pkgRealpath string) string {
+	dir := filepath.Dir(pkgRealpath)
+	for {
+		routersDir := AppConfig.DefaultString("routersdir", "routers")
+		d := filepath.Join(dir, routersDir)
+		if utils.FileExists(d) {
+			return d
+		}
+
+		if r, _ := filepath.Rel(dir, AppPath); r == "." {
+			return d
+		}
+		// Parent dir.
+		dir = filepath.Dir(dir)
+	}
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/policy.go

@@ -0,0 +1,97 @@
+// Copyright 2016 beego authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"strings"
+
+	"github.com/astaxie/beego/context"
+)
+
+// PolicyFunc defines a policy function which is invoked before the controller handler is executed.
+type PolicyFunc func(*context.Context)
+
+// FindPolicy Find Router info for URL
+func (p *ControllerRegister) FindPolicy(cont *context.Context) []PolicyFunc {
+	var urlPath = cont.Input.URL()
+	if !BConfig.RouterCaseSensitive {
+		urlPath = strings.ToLower(urlPath)
+	}
+	httpMethod := cont.Input.Method()
+	isWildcard := false
+	// Find policy for current method
+	t, ok := p.policies[httpMethod]
+	// If not found - find policy for whole controller
+	if !ok {
+		t, ok = p.policies["*"]
+		isWildcard = true
+	}
+	if ok {
+		runObjects := t.Match(urlPath, cont)
+		if r, ok := runObjects.([]PolicyFunc); ok {
+			return r
+		} else if !isWildcard {
+			// If no policies found and we checked not for "*" method - try to find it
+			t, ok = p.policies["*"]
+			if ok {
+				runObjects = t.Match(urlPath, cont)
+				if r, ok = runObjects.([]PolicyFunc); ok {
+					return r
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func (p *ControllerRegister) addToPolicy(method, pattern string, r ...PolicyFunc) {
+	method = strings.ToUpper(method)
+	p.enablePolicy = true
+	if !BConfig.RouterCaseSensitive {
+		pattern = strings.ToLower(pattern)
+	}
+	if t, ok := p.policies[method]; ok {
+		t.AddRouter(pattern, r)
+	} else {
+		t := NewTree()
+		t.AddRouter(pattern, r)
+		p.policies[method] = t
+	}
+}
+
+// Policy Register new policy in beego
+func Policy(pattern, method string, policy ...PolicyFunc) {
+	BeeApp.Handlers.addToPolicy(method, pattern, policy...)
+}
+
+// Find policies and execute if were found
+func (p *ControllerRegister) execPolicy(cont *context.Context, urlPath string) (started bool) {
+	if !p.enablePolicy {
+		return false
+	}
+	// Find Policy for method
+	policyList := p.FindPolicy(cont)
+	if len(policyList) > 0 {
+		// Run policies
+		for _, runPolicy := range policyList {
+			runPolicy(cont)
+			if cont.ResponseWriter.Started {
+				return true
+			}
+		}
+		return false
+	}
+	return false
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/session/README.md

@@ -0,0 +1,114 @@
+session
+==============
+
+session is a Go session manager. It can use many session providers. Just like the `database/sql` and `database/sql/driver`.
+
+## How to install?
+
+	go get github.com/astaxie/beego/session
+
+
+## What providers are supported?
+
+As of now this session manager support memory, file, Redis and MySQL.
+
+
+## How to use it?
+
+First you must import it
+
+	import (
+		"github.com/astaxie/beego/session"
+	)
+
+Then in you web app init the global session manager
+	
+	var globalSessions *session.Manager
+
+* Use **memory** as provider:
+
+		func init() {
+			globalSessions, _ = session.NewManager("memory", `{"cookieName":"gosessionid","gclifetime":3600}`)
+			go globalSessions.GC()
+		}
+
+* Use **file** as provider, the last param is the path where you want file to be stored:
+
+		func init() {
+			globalSessions, _ = session.NewManager("file",`{"cookieName":"gosessionid","gclifetime":3600,"ProviderConfig":"./tmp"}`)
+			go globalSessions.GC()
+		}
+
+* Use **Redis** as provider, the last param is the Redis conn address,poolsize,password:
+
+		func init() {
+			globalSessions, _ = session.NewManager("redis", `{"cookieName":"gosessionid","gclifetime":3600,"ProviderConfig":"127.0.0.1:6379,100,astaxie"}`)
+			go globalSessions.GC()
+		}
+		
+* Use **MySQL** as provider, the last param is the DSN, learn more from [mysql](https://github.com/go-sql-driver/mysql#dsn-data-source-name):
+
+		func init() {
+			globalSessions, _ = session.NewManager(
+				"mysql", `{"cookieName":"gosessionid","gclifetime":3600,"ProviderConfig":"username:password@protocol(address)/dbname?param=value"}`)
+			go globalSessions.GC()
+		}
+
+* Use **Cookie** as provider:
+
+		func init() {
+			globalSessions, _ = session.NewManager(
+				"cookie", `{"cookieName":"gosessionid","enableSetCookie":false,"gclifetime":3600,"ProviderConfig":"{\"cookieName\":\"gosessionid\",\"securityKey\":\"beegocookiehashkey\"}"}`)
+			go globalSessions.GC()
+		}
+
+
+Finally in the handlerfunc you can use it like this
+
+	func login(w http.ResponseWriter, r *http.Request) {
+		sess := globalSessions.SessionStart(w, r)
+		defer sess.SessionRelease(w)
+		username := sess.Get("username")
+		fmt.Println(username)
+		if r.Method == "GET" {
+			t, _ := template.ParseFiles("login.gtpl")
+			t.Execute(w, nil)
+		} else {
+			fmt.Println("username:", r.Form["username"])
+			sess.Set("username", r.Form["username"])
+			fmt.Println("password:", r.Form["password"])
+		}
+	}
+
+
+## How to write own provider?
+
+When you develop a web app, maybe you want to write own provider because you must meet the requirements.
+
+Writing a provider is easy. You only need to define two struct types 
+(Session and Provider), which satisfy the interface definition. 
+Maybe you will find the **memory** provider is a good example.
+
+	type SessionStore interface {
+		Set(key, value interface{}) error     //set session value
+		Get(key interface{}) interface{}      //get session value
+		Delete(key interface{}) error         //delete session value
+		SessionID() string                    //back current sessionID
+		SessionRelease(w http.ResponseWriter) // release the resource & save data to provider & return the data
+		Flush() error                         //delete all data
+	}
+	
+	type Provider interface {
+		SessionInit(gclifetime int64, config string) error
+		SessionRead(sid string) (SessionStore, error)
+		SessionExist(sid string) bool
+		SessionRegenerate(oldsid, sid string) (SessionStore, error)
+		SessionDestroy(sid string) error
+		SessionAll() int //get all active session
+		SessionGC()
+	}
+
+
+## LICENSE
+
+BSD License http://creativecommons.org/licenses/BSD/

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/session/sess_cookie.go

@@ -0,0 +1,180 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package session
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"sync"
+)
+
+var cookiepder = &CookieProvider{}
+
+// CookieSessionStore Cookie SessionStore
+type CookieSessionStore struct {
+	sid    string
+	values map[interface{}]interface{} // session data
+	lock   sync.RWMutex
+}
+
+// Set value to cookie session.
+// the value are encoded as gob with hash block string.
+func (st *CookieSessionStore) Set(key, value interface{}) error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	st.values[key] = value
+	return nil
+}
+
+// Get value from cookie session
+func (st *CookieSessionStore) Get(key interface{}) interface{} {
+	st.lock.RLock()
+	defer st.lock.RUnlock()
+	if v, ok := st.values[key]; ok {
+		return v
+	}
+	return nil
+}
+
+// Delete value in cookie session
+func (st *CookieSessionStore) Delete(key interface{}) error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	delete(st.values, key)
+	return nil
+}
+
+// Flush Clean all values in cookie session
+func (st *CookieSessionStore) Flush() error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	st.values = make(map[interface{}]interface{})
+	return nil
+}
+
+// SessionID Return id of this cookie session
+func (st *CookieSessionStore) SessionID() string {
+	return st.sid
+}
+
+// SessionRelease Write cookie session to http response cookie
+func (st *CookieSessionStore) SessionRelease(w http.ResponseWriter) {
+	st.lock.Lock()
+	encodedCookie, err := encodeCookie(cookiepder.block, cookiepder.config.SecurityKey, cookiepder.config.SecurityName, st.values)
+	st.lock.Unlock()
+	if err == nil {
+		cookie := &http.Cookie{Name: cookiepder.config.CookieName,
+			Value:    url.QueryEscape(encodedCookie),
+			Path:     "/",
+			HttpOnly: true,
+			Secure:   cookiepder.config.Secure,
+			MaxAge:   cookiepder.config.Maxage}
+		http.SetCookie(w, cookie)
+	}
+}
+
+type cookieConfig struct {
+	SecurityKey  string `json:"securityKey"`
+	BlockKey     string `json:"blockKey"`
+	SecurityName string `json:"securityName"`
+	CookieName   string `json:"cookieName"`
+	Secure       bool   `json:"secure"`
+	Maxage       int    `json:"maxage"`
+}
+
+// CookieProvider Cookie session provider
+type CookieProvider struct {
+	maxlifetime int64
+	config      *cookieConfig
+	block       cipher.Block
+}
+
+// SessionInit Init cookie session provider with max lifetime and config json.
+// maxlifetime is ignored.
+// json config:
+// 	securityKey - hash string
+// 	blockKey - gob encode hash string. it's saved as aes crypto.
+// 	securityName - recognized name in encoded cookie string
+// 	cookieName - cookie name
+// 	maxage - cookie max life time.
+func (pder *CookieProvider) SessionInit(maxlifetime int64, config string) error {
+	pder.config = &cookieConfig{}
+	err := json.Unmarshal([]byte(config), pder.config)
+	if err != nil {
+		return err
+	}
+	if pder.config.BlockKey == "" {
+		pder.config.BlockKey = string(generateRandomKey(16))
+	}
+	if pder.config.SecurityName == "" {
+		pder.config.SecurityName = string(generateRandomKey(20))
+	}
+	pder.block, err = aes.NewCipher([]byte(pder.config.BlockKey))
+	if err != nil {
+		return err
+	}
+	pder.maxlifetime = maxlifetime
+	return nil
+}
+
+// SessionRead Get SessionStore in cooke.
+// decode cooke string to map and put into SessionStore with sid.
+func (pder *CookieProvider) SessionRead(sid string) (Store, error) {
+	maps, _ := decodeCookie(pder.block,
+		pder.config.SecurityKey,
+		pder.config.SecurityName,
+		sid, pder.maxlifetime)
+	if maps == nil {
+		maps = make(map[interface{}]interface{})
+	}
+	rs := &CookieSessionStore{sid: sid, values: maps}
+	return rs, nil
+}
+
+// SessionExist Cookie session is always existed
+func (pder *CookieProvider) SessionExist(sid string) bool {
+	return true
+}
+
+// SessionRegenerate Implement method, no used.
+func (pder *CookieProvider) SessionRegenerate(oldsid, sid string) (Store, error) {
+	return nil, nil
+}
+
+// SessionDestroy Implement method, no used.
+func (pder *CookieProvider) SessionDestroy(sid string) error {
+	return nil
+}
+
+// SessionGC Implement method, no used.
+func (pder *CookieProvider) SessionGC() {
+}
+
+// SessionAll Implement method, return 0.
+func (pder *CookieProvider) SessionAll() int {
+	return 0
+}
+
+// SessionUpdate Implement method, no used.
+func (pder *CookieProvider) SessionUpdate(sid string) error {
+	return nil
+}
+
+func init() {
+	Register("cookie", cookiepder)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/session/sess_file.go

@@ -0,0 +1,315 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package session
+
+import (
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+var (
+	filepder      = &FileProvider{}
+	gcmaxlifetime int64
+)
+
+// FileSessionStore File session store
+type FileSessionStore struct {
+	sid    string
+	lock   sync.RWMutex
+	values map[interface{}]interface{}
+}
+
+// Set value to file session
+func (fs *FileSessionStore) Set(key, value interface{}) error {
+	fs.lock.Lock()
+	defer fs.lock.Unlock()
+	fs.values[key] = value
+	return nil
+}
+
+// Get value from file session
+func (fs *FileSessionStore) Get(key interface{}) interface{} {
+	fs.lock.RLock()
+	defer fs.lock.RUnlock()
+	if v, ok := fs.values[key]; ok {
+		return v
+	}
+	return nil
+}
+
+// Delete value in file session by given key
+func (fs *FileSessionStore) Delete(key interface{}) error {
+	fs.lock.Lock()
+	defer fs.lock.Unlock()
+	delete(fs.values, key)
+	return nil
+}
+
+// Flush Clean all values in file session
+func (fs *FileSessionStore) Flush() error {
+	fs.lock.Lock()
+	defer fs.lock.Unlock()
+	fs.values = make(map[interface{}]interface{})
+	return nil
+}
+
+// SessionID Get file session store id
+func (fs *FileSessionStore) SessionID() string {
+	return fs.sid
+}
+
+// SessionRelease Write file session to local file with Gob string
+func (fs *FileSessionStore) SessionRelease(w http.ResponseWriter) {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+	b, err := EncodeGob(fs.values)
+	if err != nil {
+		SLogger.Println(err)
+		return
+	}
+	_, err = os.Stat(path.Join(filepder.savePath, string(fs.sid[0]), string(fs.sid[1]), fs.sid))
+	var f *os.File
+	if err == nil {
+		f, err = os.OpenFile(path.Join(filepder.savePath, string(fs.sid[0]), string(fs.sid[1]), fs.sid), os.O_RDWR, 0777)
+		if err != nil {
+			SLogger.Println(err)
+			return
+		}
+	} else if os.IsNotExist(err) {
+		f, err = os.Create(path.Join(filepder.savePath, string(fs.sid[0]), string(fs.sid[1]), fs.sid))
+		if err != nil {
+			SLogger.Println(err)
+			return
+		}
+	} else {
+		return
+	}
+	f.Truncate(0)
+	f.Seek(0, 0)
+	f.Write(b)
+	f.Close()
+}
+
+// FileProvider File session provider
+type FileProvider struct {
+	lock        sync.RWMutex
+	maxlifetime int64
+	savePath    string
+}
+
+// SessionInit Init file session provider.
+// savePath sets the session files path.
+func (fp *FileProvider) SessionInit(maxlifetime int64, savePath string) error {
+	fp.maxlifetime = maxlifetime
+	fp.savePath = savePath
+	return nil
+}
+
+// SessionRead Read file session by sid.
+// if file is not exist, create it.
+// the file path is generated from sid string.
+func (fp *FileProvider) SessionRead(sid string) (Store, error) {
+	invalidChars := "./"
+	if strings.ContainsAny(sid, invalidChars) {
+		return nil, errors.New("the sid shouldn't have following characters: " + invalidChars)
+	}
+	if len(sid) < 2 {
+		return nil, errors.New("length of the sid is less than 2")
+	}
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+
+	err := os.MkdirAll(path.Join(fp.savePath, string(sid[0]), string(sid[1])), 0755)
+	if err != nil {
+		SLogger.Println(err.Error())
+	}
+	_, err = os.Stat(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid))
+	var f *os.File
+	if err == nil {
+		f, err = os.OpenFile(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid), os.O_RDWR, 0777)
+	} else if os.IsNotExist(err) {
+		f, err = os.Create(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid))
+	} else {
+		return nil, err
+	}
+
+	defer f.Close()
+
+	os.Chtimes(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid), time.Now(), time.Now())
+	var kv map[interface{}]interface{}
+	b, err := ioutil.ReadAll(f)
+	if err != nil {
+		return nil, err
+	}
+	if len(b) == 0 {
+		kv = make(map[interface{}]interface{})
+	} else {
+		kv, err = DecodeGob(b)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	ss := &FileSessionStore{sid: sid, values: kv}
+	return ss, nil
+}
+
+// SessionExist Check file session exist.
+// it checks the file named from sid exist or not.
+func (fp *FileProvider) SessionExist(sid string) bool {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+
+	if len(sid) < 2 {
+		SLogger.Println("min length of session id is 2", sid)
+		return false
+	}
+
+	_, err := os.Stat(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid))
+	return err == nil
+}
+
+// SessionDestroy Remove all files in this save path
+func (fp *FileProvider) SessionDestroy(sid string) error {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+	os.Remove(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid))
+	return nil
+}
+
+// SessionGC Recycle files in save path
+func (fp *FileProvider) SessionGC() {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+
+	gcmaxlifetime = fp.maxlifetime
+	filepath.Walk(fp.savePath, gcpath)
+}
+
+// SessionAll Get active file session number.
+// it walks save path to count files.
+func (fp *FileProvider) SessionAll() int {
+	a := &activeSession{}
+	err := filepath.Walk(fp.savePath, func(path string, f os.FileInfo, err error) error {
+		return a.visit(path, f, err)
+	})
+	if err != nil {
+		SLogger.Printf("filepath.Walk() returned %v\n", err)
+		return 0
+	}
+	return a.total
+}
+
+// SessionRegenerate Generate new sid for file session.
+// it delete old file and create new file named from new sid.
+func (fp *FileProvider) SessionRegenerate(oldsid, sid string) (Store, error) {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+
+	oldPath := path.Join(fp.savePath, string(oldsid[0]), string(oldsid[1]))
+	oldSidFile := path.Join(oldPath, oldsid)
+	newPath := path.Join(fp.savePath, string(sid[0]), string(sid[1]))
+	newSidFile := path.Join(newPath, sid)
+
+	// new sid file is exist
+	_, err := os.Stat(newSidFile)
+	if err == nil {
+		return nil, fmt.Errorf("newsid %s exist", newSidFile)
+	}
+
+	err = os.MkdirAll(newPath, 0755)
+	if err != nil {
+		SLogger.Println(err.Error())
+	}
+
+	// if old sid file exist
+	// 1.read and parse file content
+	// 2.write content to new sid file
+	// 3.remove old sid file, change new sid file atime and ctime
+	// 4.return FileSessionStore
+	_, err = os.Stat(oldSidFile)
+	if err == nil {
+		b, err := ioutil.ReadFile(oldSidFile)
+		if err != nil {
+			return nil, err
+		}
+
+		var kv map[interface{}]interface{}
+		if len(b) == 0 {
+			kv = make(map[interface{}]interface{})
+		} else {
+			kv, err = DecodeGob(b)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		ioutil.WriteFile(newSidFile, b, 0777)
+		os.Remove(oldSidFile)
+		os.Chtimes(newSidFile, time.Now(), time.Now())
+		ss := &FileSessionStore{sid: sid, values: kv}
+		return ss, nil
+	}
+
+	// if old sid file not exist, just create new sid file and return
+	newf, err := os.Create(newSidFile)
+	if err != nil {
+		return nil, err
+	}
+	newf.Close()
+	ss := &FileSessionStore{sid: sid, values: make(map[interface{}]interface{})}
+	return ss, nil
+}
+
+// remove file in save path if expired
+func gcpath(path string, info os.FileInfo, err error) error {
+	if err != nil {
+		return err
+	}
+	if info.IsDir() {
+		return nil
+	}
+	if (info.ModTime().Unix() + gcmaxlifetime) < time.Now().Unix() {
+		os.Remove(path)
+	}
+	return nil
+}
+
+type activeSession struct {
+	total int
+}
+
+func (as *activeSession) visit(paths string, f os.FileInfo, err error) error {
+	if err != nil {
+		return err
+	}
+	if f.IsDir() {
+		return nil
+	}
+	as.total = as.total + 1
+	return nil
+}
+
+func init() {
+	Register("file", filepder)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/session/sess_mem.go

@@ -0,0 +1,196 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package session
+
+import (
+	"container/list"
+	"net/http"
+	"sync"
+	"time"
+)
+
+var mempder = &MemProvider{list: list.New(), sessions: make(map[string]*list.Element)}
+
+// MemSessionStore memory session store.
+// it saved sessions in a map in memory.
+type MemSessionStore struct {
+	sid          string                      //session id
+	timeAccessed time.Time                   //last access time
+	value        map[interface{}]interface{} //session store
+	lock         sync.RWMutex
+}
+
+// Set value to memory session
+func (st *MemSessionStore) Set(key, value interface{}) error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	st.value[key] = value
+	return nil
+}
+
+// Get value from memory session by key
+func (st *MemSessionStore) Get(key interface{}) interface{} {
+	st.lock.RLock()
+	defer st.lock.RUnlock()
+	if v, ok := st.value[key]; ok {
+		return v
+	}
+	return nil
+}
+
+// Delete in memory session by key
+func (st *MemSessionStore) Delete(key interface{}) error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	delete(st.value, key)
+	return nil
+}
+
+// Flush clear all values in memory session
+func (st *MemSessionStore) Flush() error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	st.value = make(map[interface{}]interface{})
+	return nil
+}
+
+// SessionID get this id of memory session store
+func (st *MemSessionStore) SessionID() string {
+	return st.sid
+}
+
+// SessionRelease Implement method, no used.
+func (st *MemSessionStore) SessionRelease(w http.ResponseWriter) {
+}
+
+// MemProvider Implement the provider interface
+type MemProvider struct {
+	lock        sync.RWMutex             // locker
+	sessions    map[string]*list.Element // map in memory
+	list        *list.List               // for gc
+	maxlifetime int64
+	savePath    string
+}
+
+// SessionInit init memory session
+func (pder *MemProvider) SessionInit(maxlifetime int64, savePath string) error {
+	pder.maxlifetime = maxlifetime
+	pder.savePath = savePath
+	return nil
+}
+
+// SessionRead get memory session store by sid
+func (pder *MemProvider) SessionRead(sid string) (Store, error) {
+	pder.lock.RLock()
+	if element, ok := pder.sessions[sid]; ok {
+		go pder.SessionUpdate(sid)
+		pder.lock.RUnlock()
+		return element.Value.(*MemSessionStore), nil
+	}
+	pder.lock.RUnlock()
+	pder.lock.Lock()
+	newsess := &MemSessionStore{sid: sid, timeAccessed: time.Now(), value: make(map[interface{}]interface{})}
+	element := pder.list.PushFront(newsess)
+	pder.sessions[sid] = element
+	pder.lock.Unlock()
+	return newsess, nil
+}
+
+// SessionExist check session store exist in memory session by sid
+func (pder *MemProvider) SessionExist(sid string) bool {
+	pder.lock.RLock()
+	defer pder.lock.RUnlock()
+	if _, ok := pder.sessions[sid]; ok {
+		return true
+	}
+	return false
+}
+
+// SessionRegenerate generate new sid for session store in memory session
+func (pder *MemProvider) SessionRegenerate(oldsid, sid string) (Store, error) {
+	pder.lock.RLock()
+	if element, ok := pder.sessions[oldsid]; ok {
+		go pder.SessionUpdate(oldsid)
+		pder.lock.RUnlock()
+		pder.lock.Lock()
+		element.Value.(*MemSessionStore).sid = sid
+		pder.sessions[sid] = element
+		delete(pder.sessions, oldsid)
+		pder.lock.Unlock()
+		return element.Value.(*MemSessionStore), nil
+	}
+	pder.lock.RUnlock()
+	pder.lock.Lock()
+	newsess := &MemSessionStore{sid: sid, timeAccessed: time.Now(), value: make(map[interface{}]interface{})}
+	element := pder.list.PushFront(newsess)
+	pder.sessions[sid] = element
+	pder.lock.Unlock()
+	return newsess, nil
+}
+
+// SessionDestroy delete session store in memory session by id
+func (pder *MemProvider) SessionDestroy(sid string) error {
+	pder.lock.Lock()
+	defer pder.lock.Unlock()
+	if element, ok := pder.sessions[sid]; ok {
+		delete(pder.sessions, sid)
+		pder.list.Remove(element)
+		return nil
+	}
+	return nil
+}
+
+// SessionGC clean expired session stores in memory session
+func (pder *MemProvider) SessionGC() {
+	pder.lock.RLock()
+	for {
+		element := pder.list.Back()
+		if element == nil {
+			break
+		}
+		if (element.Value.(*MemSessionStore).timeAccessed.Unix() + pder.maxlifetime) < time.Now().Unix() {
+			pder.lock.RUnlock()
+			pder.lock.Lock()
+			pder.list.Remove(element)
+			delete(pder.sessions, element.Value.(*MemSessionStore).sid)
+			pder.lock.Unlock()
+			pder.lock.RLock()
+		} else {
+			break
+		}
+	}
+	pder.lock.RUnlock()
+}
+
+// SessionAll get count number of memory session
+func (pder *MemProvider) SessionAll() int {
+	return pder.list.Len()
+}
+
+// SessionUpdate expand time of session store by id in memory session
+func (pder *MemProvider) SessionUpdate(sid string) error {
+	pder.lock.Lock()
+	defer pder.lock.Unlock()
+	if element, ok := pder.sessions[sid]; ok {
+		element.Value.(*MemSessionStore).timeAccessed = time.Now()
+		pder.list.MoveToFront(element)
+		return nil
+	}
+	return nil
+}
+
+func init() {
+	Register("memory", mempder)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/session/sess_utils.go

@@ -0,0 +1,207 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package session
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/gob"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"time"
+
+	"github.com/astaxie/beego/utils"
+)
+
+func init() {
+	gob.Register([]interface{}{})
+	gob.Register(map[int]interface{}{})
+	gob.Register(map[string]interface{}{})
+	gob.Register(map[interface{}]interface{}{})
+	gob.Register(map[string]string{})
+	gob.Register(map[int]string{})
+	gob.Register(map[int]int{})
+	gob.Register(map[int]int64{})
+}
+
+// EncodeGob encode the obj to gob
+func EncodeGob(obj map[interface{}]interface{}) ([]byte, error) {
+	for _, v := range obj {
+		gob.Register(v)
+	}
+	buf := bytes.NewBuffer(nil)
+	enc := gob.NewEncoder(buf)
+	err := enc.Encode(obj)
+	if err != nil {
+		return []byte(""), err
+	}
+	return buf.Bytes(), nil
+}
+
+// DecodeGob decode data to map
+func DecodeGob(encoded []byte) (map[interface{}]interface{}, error) {
+	buf := bytes.NewBuffer(encoded)
+	dec := gob.NewDecoder(buf)
+	var out map[interface{}]interface{}
+	err := dec.Decode(&out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// generateRandomKey creates a random key with the given strength.
+func generateRandomKey(strength int) []byte {
+	k := make([]byte, strength)
+	if n, err := io.ReadFull(rand.Reader, k); n != strength || err != nil {
+		return utils.RandomCreateBytes(strength)
+	}
+	return k
+}
+
+// Encryption -----------------------------------------------------------------
+
+// encrypt encrypts a value using the given block in counter mode.
+//
+// A random initialization vector (http://goo.gl/zF67k) with the length of the
+// block size is prepended to the resulting ciphertext.
+func encrypt(block cipher.Block, value []byte) ([]byte, error) {
+	iv := generateRandomKey(block.BlockSize())
+	if iv == nil {
+		return nil, errors.New("encrypt: failed to generate random iv")
+	}
+	// Encrypt it.
+	stream := cipher.NewCTR(block, iv)
+	stream.XORKeyStream(value, value)
+	// Return iv + ciphertext.
+	return append(iv, value...), nil
+}
+
+// decrypt decrypts a value using the given block in counter mode.
+//
+// The value to be decrypted must be prepended by a initialization vector
+// (http://goo.gl/zF67k) with the length of the block size.
+func decrypt(block cipher.Block, value []byte) ([]byte, error) {
+	size := block.BlockSize()
+	if len(value) > size {
+		// Extract iv.
+		iv := value[:size]
+		// Extract ciphertext.
+		value = value[size:]
+		// Decrypt it.
+		stream := cipher.NewCTR(block, iv)
+		stream.XORKeyStream(value, value)
+		return value, nil
+	}
+	return nil, errors.New("decrypt: the value could not be decrypted")
+}
+
+func encodeCookie(block cipher.Block, hashKey, name string, value map[interface{}]interface{}) (string, error) {
+	var err error
+	var b []byte
+	// 1. EncodeGob.
+	if b, err = EncodeGob(value); err != nil {
+		return "", err
+	}
+	// 2. Encrypt (optional).
+	if b, err = encrypt(block, b); err != nil {
+		return "", err
+	}
+	b = encode(b)
+	// 3. Create MAC for "name|date|value". Extra pipe to be used later.
+	b = []byte(fmt.Sprintf("%s|%d|%s|", name, time.Now().UTC().Unix(), b))
+	h := hmac.New(sha256.New, []byte(hashKey))
+	h.Write(b)
+	sig := h.Sum(nil)
+	// Append mac, remove name.
+	b = append(b, sig...)[len(name)+1:]
+	// 4. Encode to base64.
+	b = encode(b)
+	// Done.
+	return string(b), nil
+}
+
+func decodeCookie(block cipher.Block, hashKey, name, value string, gcmaxlifetime int64) (map[interface{}]interface{}, error) {
+	// 1. Decode from base64.
+	b, err := decode([]byte(value))
+	if err != nil {
+		return nil, err
+	}
+	// 2. Verify MAC. Value is "date|value|mac".
+	parts := bytes.SplitN(b, []byte("|"), 3)
+	if len(parts) != 3 {
+		return nil, errors.New("Decode: invalid value format")
+	}
+
+	b = append([]byte(name+"|"), b[:len(b)-len(parts[2])]...)
+	h := hmac.New(sha256.New, []byte(hashKey))
+	h.Write(b)
+	sig := h.Sum(nil)
+	if len(sig) != len(parts[2]) || subtle.ConstantTimeCompare(sig, parts[2]) != 1 {
+		return nil, errors.New("Decode: the value is not valid")
+	}
+	// 3. Verify date ranges.
+	var t1 int64
+	if t1, err = strconv.ParseInt(string(parts[0]), 10, 64); err != nil {
+		return nil, errors.New("Decode: invalid timestamp")
+	}
+	t2 := time.Now().UTC().Unix()
+	if t1 > t2 {
+		return nil, errors.New("Decode: timestamp is too new")
+	}
+	if t1 < t2-gcmaxlifetime {
+		return nil, errors.New("Decode: expired timestamp")
+	}
+	// 4. Decrypt (optional).
+	b, err = decode(parts[1])
+	if err != nil {
+		return nil, err
+	}
+	if b, err = decrypt(block, b); err != nil {
+		return nil, err
+	}
+	// 5. DecodeGob.
+	dst, err := DecodeGob(b)
+	if err != nil {
+		return nil, err
+	}
+	return dst, nil
+}
+
+// Encoding -------------------------------------------------------------------
+
+// encode encodes a value using base64.
+func encode(value []byte) []byte {
+	encoded := make([]byte, base64.URLEncoding.EncodedLen(len(value)))
+	base64.URLEncoding.Encode(encoded, value)
+	return encoded
+}
+
+// decode decodes a cookie using base64.
+func decode(value []byte) ([]byte, error) {
+	decoded := make([]byte, base64.URLEncoding.DecodedLen(len(value)))
+	b, err := base64.URLEncoding.Decode(decoded, value)
+	if err != nil {
+		return nil, err
+	}
+	return decoded[:b], nil
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/session/session.go

@@ -0,0 +1,382 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package session provider
+//
+// Usage:
+// import(
+//   "github.com/astaxie/beego/session"
+// )
+//
+//	func init() {
+//      globalSessions, _ = session.NewManager("memory", `{"cookieName":"gosessionid", "enableSetCookie,omitempty": true, "gclifetime":3600, "maxLifetime": 3600, "secure": false, "cookieLifeTime": 3600, "providerConfig": ""}`)
+//		go globalSessions.GC()
+//	}
+//
+// more docs: http://beego.me/docs/module/session.md
+package session
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"os"
+	"time"
+)
+
+// Store contains all data for one session process with specific id.
+type Store interface {
+	Set(key, value interface{}) error     //set session value
+	Get(key interface{}) interface{}      //get session value
+	Delete(key interface{}) error         //delete session value
+	SessionID() string                    //back current sessionID
+	SessionRelease(w http.ResponseWriter) // release the resource & save data to provider & return the data
+	Flush() error                         //delete all data
+}
+
+// Provider contains global session methods and saved SessionStores.
+// it can operate a SessionStore by its id.
+type Provider interface {
+	SessionInit(gclifetime int64, config string) error
+	SessionRead(sid string) (Store, error)
+	SessionExist(sid string) bool
+	SessionRegenerate(oldsid, sid string) (Store, error)
+	SessionDestroy(sid string) error
+	SessionAll() int //get all active session
+	SessionGC()
+}
+
+var provides = make(map[string]Provider)
+
+// SLogger a helpful variable to log information about session
+var SLogger = NewSessionLog(os.Stderr)
+
+// Register makes a session provide available by the provided name.
+// If Register is called twice with the same name or if driver is nil,
+// it panics.
+func Register(name string, provide Provider) {
+	if provide == nil {
+		panic("session: Register provide is nil")
+	}
+	if _, dup := provides[name]; dup {
+		panic("session: Register called twice for provider " + name)
+	}
+	provides[name] = provide
+}
+
+//GetProvider
+func GetProvider(name string) (Provider, error) {
+	provider, ok := provides[name]
+	if !ok {
+		return nil, fmt.Errorf("session: unknown provide %q (forgotten import?)", name)
+	}
+	return provider, nil
+}
+
+// ManagerConfig define the session config
+type ManagerConfig struct {
+	CookieName              string        `json:"cookieName"`
+	EnableSetCookie         bool          `json:"enableSetCookie,omitempty"`
+	Gclifetime              int64         `json:"gclifetime"`
+	Maxlifetime             int64         `json:"maxLifetime"`
+	DisableHTTPOnly         bool          `json:"disableHTTPOnly"`
+	Secure                  bool          `json:"secure"`
+	CookieLifeTime          int           `json:"cookieLifeTime"`
+	ProviderConfig          string        `json:"providerConfig"`
+	Domain                  string        `json:"domain"`
+	SessionIDLength         int64         `json:"sessionIDLength"`
+	EnableSidInHTTPHeader   bool          `json:"EnableSidInHTTPHeader"`
+	SessionNameInHTTPHeader string        `json:"SessionNameInHTTPHeader"`
+	EnableSidInURLQuery     bool          `json:"EnableSidInURLQuery"`
+	SessionIDPrefix         string        `json:"sessionIDPrefix"`
+	CookieSameSite          http.SameSite `json:"cookieSameSite"`
+}
+
+// Manager contains Provider and its configuration.
+type Manager struct {
+	provider Provider
+	config   *ManagerConfig
+}
+
+// NewManager Create new Manager with provider name and json config string.
+// provider name:
+// 1. cookie
+// 2. file
+// 3. memory
+// 4. redis
+// 5. mysql
+// json config:
+// 1. is https  default false
+// 2. hashfunc  default sha1
+// 3. hashkey default beegosessionkey
+// 4. maxage default is none
+func NewManager(provideName string, cf *ManagerConfig) (*Manager, error) {
+	provider, ok := provides[provideName]
+	if !ok {
+		return nil, fmt.Errorf("session: unknown provide %q (forgotten import?)", provideName)
+	}
+
+	if cf.Maxlifetime == 0 {
+		cf.Maxlifetime = cf.Gclifetime
+	}
+
+	if cf.EnableSidInHTTPHeader {
+		if cf.SessionNameInHTTPHeader == "" {
+			panic(errors.New("SessionNameInHTTPHeader is empty"))
+		}
+
+		strMimeHeader := textproto.CanonicalMIMEHeaderKey(cf.SessionNameInHTTPHeader)
+		if cf.SessionNameInHTTPHeader != strMimeHeader {
+			strErrMsg := "SessionNameInHTTPHeader (" + cf.SessionNameInHTTPHeader + ") has the wrong format, it should be like this : " + strMimeHeader
+			panic(errors.New(strErrMsg))
+		}
+	}
+
+	err := provider.SessionInit(cf.Maxlifetime, cf.ProviderConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	if cf.SessionIDLength == 0 {
+		cf.SessionIDLength = 16
+	}
+
+	return &Manager{
+		provider,
+		cf,
+	}, nil
+}
+
+// GetProvider return current manager's provider
+func (manager *Manager) GetProvider() Provider {
+	return manager.provider
+}
+
+// getSid retrieves session identifier from HTTP Request.
+// First try to retrieve id by reading from cookie, session cookie name is configurable,
+// if not exist, then retrieve id from querying parameters.
+//
+// error is not nil when there is anything wrong.
+// sid is empty when need to generate a new session id
+// otherwise return an valid session id.
+func (manager *Manager) getSid(r *http.Request) (string, error) {
+	cookie, errs := r.Cookie(manager.config.CookieName)
+	if errs != nil || cookie.Value == "" {
+		var sid string
+		if manager.config.EnableSidInURLQuery {
+			errs := r.ParseForm()
+			if errs != nil {
+				return "", errs
+			}
+
+			sid = r.FormValue(manager.config.CookieName)
+		}
+
+		// if not found in Cookie / param, then read it from request headers
+		if manager.config.EnableSidInHTTPHeader && sid == "" {
+			sids, isFound := r.Header[manager.config.SessionNameInHTTPHeader]
+			if isFound && len(sids) != 0 {
+				return sids[0], nil
+			}
+		}
+
+		return sid, nil
+	}
+
+	// HTTP Request contains cookie for sessionid info.
+	return url.QueryUnescape(cookie.Value)
+}
+
+// SessionStart generate or read the session id from http request.
+// if session id exists, return SessionStore with this id.
+func (manager *Manager) SessionStart(w http.ResponseWriter, r *http.Request) (session Store, err error) {
+	sid, errs := manager.getSid(r)
+	if errs != nil {
+		return nil, errs
+	}
+
+	if sid != "" && manager.provider.SessionExist(sid) {
+		return manager.provider.SessionRead(sid)
+	}
+
+	// Generate a new session
+	sid, errs = manager.sessionID()
+	if errs != nil {
+		return nil, errs
+	}
+
+	session, err = manager.provider.SessionRead(sid)
+	if err != nil {
+		return nil, err
+	}
+	cookie := &http.Cookie{
+		Name:     manager.config.CookieName,
+		Value:    url.QueryEscape(sid),
+		Path:     "/",
+		HttpOnly: !manager.config.DisableHTTPOnly,
+		Secure:   manager.isSecure(r),
+		Domain:   manager.config.Domain,
+		SameSite: manager.config.CookieSameSite,
+	}
+	if manager.config.CookieLifeTime > 0 {
+		cookie.MaxAge = manager.config.CookieLifeTime
+		cookie.Expires = time.Now().Add(time.Duration(manager.config.CookieLifeTime) * time.Second)
+	}
+	if manager.config.EnableSetCookie {
+		http.SetCookie(w, cookie)
+	}
+	r.AddCookie(cookie)
+
+	if manager.config.EnableSidInHTTPHeader {
+		r.Header.Set(manager.config.SessionNameInHTTPHeader, sid)
+		w.Header().Set(manager.config.SessionNameInHTTPHeader, sid)
+	}
+
+	return
+}
+
+// SessionDestroy Destroy session by its id in http request cookie.
+func (manager *Manager) SessionDestroy(w http.ResponseWriter, r *http.Request) {
+	if manager.config.EnableSidInHTTPHeader {
+		r.Header.Del(manager.config.SessionNameInHTTPHeader)
+		w.Header().Del(manager.config.SessionNameInHTTPHeader)
+	}
+
+	cookie, err := r.Cookie(manager.config.CookieName)
+	if err != nil || cookie.Value == "" {
+		return
+	}
+
+	sid, _ := url.QueryUnescape(cookie.Value)
+	manager.provider.SessionDestroy(sid)
+	if manager.config.EnableSetCookie {
+		expiration := time.Now()
+		cookie = &http.Cookie{Name: manager.config.CookieName,
+			Path:     "/",
+			HttpOnly: !manager.config.DisableHTTPOnly,
+			Expires:  expiration,
+			MaxAge:   -1,
+			Domain:   manager.config.Domain,
+			SameSite: manager.config.CookieSameSite,
+		}
+
+		http.SetCookie(w, cookie)
+	}
+}
+
+// GetSessionStore Get SessionStore by its id.
+func (manager *Manager) GetSessionStore(sid string) (sessions Store, err error) {
+	sessions, err = manager.provider.SessionRead(sid)
+	return
+}
+
+// GC Start session gc process.
+// it can do gc in times after gc lifetime.
+func (manager *Manager) GC() {
+	manager.provider.SessionGC()
+	time.AfterFunc(time.Duration(manager.config.Gclifetime)*time.Second, func() { manager.GC() })
+}
+
+// SessionRegenerateID Regenerate a session id for this SessionStore who's id is saving in http request.
+func (manager *Manager) SessionRegenerateID(w http.ResponseWriter, r *http.Request) (session Store) {
+	sid, err := manager.sessionID()
+	if err != nil {
+		return
+	}
+	cookie, err := r.Cookie(manager.config.CookieName)
+	if err != nil || cookie.Value == "" {
+		//delete old cookie
+		session, _ = manager.provider.SessionRead(sid)
+		cookie = &http.Cookie{Name: manager.config.CookieName,
+			Value:    url.QueryEscape(sid),
+			Path:     "/",
+			HttpOnly: !manager.config.DisableHTTPOnly,
+			Secure:   manager.isSecure(r),
+			Domain:   manager.config.Domain,
+			SameSite: manager.config.CookieSameSite,
+		}
+	} else {
+		oldsid, _ := url.QueryUnescape(cookie.Value)
+		session, _ = manager.provider.SessionRegenerate(oldsid, sid)
+		cookie.Value = url.QueryEscape(sid)
+		cookie.HttpOnly = true
+		cookie.Path = "/"
+	}
+	if manager.config.CookieLifeTime > 0 {
+		cookie.MaxAge = manager.config.CookieLifeTime
+		cookie.Expires = time.Now().Add(time.Duration(manager.config.CookieLifeTime) * time.Second)
+	}
+	if manager.config.EnableSetCookie {
+		http.SetCookie(w, cookie)
+	}
+	r.AddCookie(cookie)
+
+	if manager.config.EnableSidInHTTPHeader {
+		r.Header.Set(manager.config.SessionNameInHTTPHeader, sid)
+		w.Header().Set(manager.config.SessionNameInHTTPHeader, sid)
+	}
+
+	return
+}
+
+// GetActiveSession Get all active sessions count number.
+func (manager *Manager) GetActiveSession() int {
+	return manager.provider.SessionAll()
+}
+
+// SetSecure Set cookie with https.
+func (manager *Manager) SetSecure(secure bool) {
+	manager.config.Secure = secure
+}
+
+func (manager *Manager) sessionID() (string, error) {
+	b := make([]byte, manager.config.SessionIDLength)
+	n, err := rand.Read(b)
+	if n != len(b) || err != nil {
+		return "", fmt.Errorf("Could not successfully read from the system CSPRNG")
+	}
+	return manager.config.SessionIDPrefix + hex.EncodeToString(b), nil
+}
+
+// Set cookie with https.
+func (manager *Manager) isSecure(req *http.Request) bool {
+	if !manager.config.Secure {
+		return false
+	}
+	if req.URL.Scheme != "" {
+		return req.URL.Scheme == "https"
+	}
+	if req.TLS == nil {
+		return false
+	}
+	return true
+}
+
+// Log implement the log.Logger
+type Log struct {
+	*log.Logger
+}
+
+// NewSessionLog set io.Writer to create a Logger for session.
+func NewSessionLog(out io.Writer) *Log {
+	sl := new(Log)
+	sl.Logger = log.New(out, "[SESSION]", 1e9)
+	return sl
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/staticfile.go

@@ -0,0 +1,234 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"bytes"
+	"errors"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/astaxie/beego/context"
+	"github.com/astaxie/beego/logs"
+	"github.com/hashicorp/golang-lru"
+)
+
+var errNotStaticRequest = errors.New("request not a static file request")
+
+func serverStaticRouter(ctx *context.Context) {
+	if ctx.Input.Method() != "GET" && ctx.Input.Method() != "HEAD" {
+		return
+	}
+
+	forbidden, filePath, fileInfo, err := lookupFile(ctx)
+	if err == errNotStaticRequest {
+		return
+	}
+
+	if forbidden {
+		exception("403", ctx)
+		return
+	}
+
+	if filePath == "" || fileInfo == nil {
+		if BConfig.RunMode == DEV {
+			logs.Warn("Can't find/open the file:", filePath, err)
+		}
+		http.NotFound(ctx.ResponseWriter, ctx.Request)
+		return
+	}
+	if fileInfo.IsDir() {
+		requestURL := ctx.Input.URL()
+		if requestURL[len(requestURL)-1] != '/' {
+			redirectURL := requestURL + "/"
+			if ctx.Request.URL.RawQuery != "" {
+				redirectURL = redirectURL + "?" + ctx.Request.URL.RawQuery
+			}
+			ctx.Redirect(302, redirectURL)
+		} else {
+			//serveFile will list dir
+			http.ServeFile(ctx.ResponseWriter, ctx.Request, filePath)
+		}
+		return
+	} else if fileInfo.Size() > int64(BConfig.WebConfig.StaticCacheFileSize) {
+		//over size file serve with http module
+		http.ServeFile(ctx.ResponseWriter, ctx.Request, filePath)
+		return
+	}
+
+	var enableCompress = BConfig.EnableGzip && isStaticCompress(filePath)
+	var acceptEncoding string
+	if enableCompress {
+		acceptEncoding = context.ParseEncoding(ctx.Request)
+	}
+	b, n, sch, reader, err := openFile(filePath, fileInfo, acceptEncoding)
+	if err != nil {
+		if BConfig.RunMode == DEV {
+			logs.Warn("Can't compress the file:", filePath, err)
+		}
+		http.NotFound(ctx.ResponseWriter, ctx.Request)
+		return
+	}
+
+	if b {
+		ctx.Output.Header("Content-Encoding", n)
+	} else {
+		ctx.Output.Header("Content-Length", strconv.FormatInt(sch.size, 10))
+	}
+
+	http.ServeContent(ctx.ResponseWriter, ctx.Request, filePath, sch.modTime, reader)
+}
+
+type serveContentHolder struct {
+	data       []byte
+	modTime    time.Time
+	size       int64
+	originSize int64 //original file size:to judge file changed
+	encoding   string
+}
+
+type serveContentReader struct {
+	*bytes.Reader
+}
+
+var (
+	staticFileLruCache *lru.Cache
+	lruLock            sync.RWMutex
+)
+
+func openFile(filePath string, fi os.FileInfo, acceptEncoding string) (bool, string, *serveContentHolder, *serveContentReader, error) {
+	if staticFileLruCache == nil {
+		//avoid lru cache error
+		if BConfig.WebConfig.StaticCacheFileNum >= 1 {
+			staticFileLruCache, _ = lru.New(BConfig.WebConfig.StaticCacheFileNum)
+		} else {
+			staticFileLruCache, _ = lru.New(1)
+		}
+	}
+	mapKey := acceptEncoding + ":" + filePath
+	lruLock.RLock()
+	var mapFile *serveContentHolder
+	if cacheItem, ok := staticFileLruCache.Get(mapKey); ok {
+		mapFile = cacheItem.(*serveContentHolder)
+	}
+	lruLock.RUnlock()
+	if isOk(mapFile, fi) {
+		reader := &serveContentReader{Reader: bytes.NewReader(mapFile.data)}
+		return mapFile.encoding != "", mapFile.encoding, mapFile, reader, nil
+	}
+	lruLock.Lock()
+	defer lruLock.Unlock()
+	if cacheItem, ok := staticFileLruCache.Get(mapKey); ok {
+		mapFile = cacheItem.(*serveContentHolder)
+	}
+	if !isOk(mapFile, fi) {
+		file, err := os.Open(filePath)
+		if err != nil {
+			return false, "", nil, nil, err
+		}
+		defer file.Close()
+		var bufferWriter bytes.Buffer
+		_, n, err := context.WriteFile(acceptEncoding, &bufferWriter, file)
+		if err != nil {
+			return false, "", nil, nil, err
+		}
+		mapFile = &serveContentHolder{data: bufferWriter.Bytes(), modTime: fi.ModTime(), size: int64(bufferWriter.Len()), originSize: fi.Size(), encoding: n}
+		if isOk(mapFile, fi) {
+			staticFileLruCache.Add(mapKey, mapFile)
+		}
+	}
+
+	reader := &serveContentReader{Reader: bytes.NewReader(mapFile.data)}
+	return mapFile.encoding != "", mapFile.encoding, mapFile, reader, nil
+}
+
+func isOk(s *serveContentHolder, fi os.FileInfo) bool {
+	if s == nil {
+		return false
+	} else if s.size > int64(BConfig.WebConfig.StaticCacheFileSize) {
+		return false
+	}
+	return s.modTime == fi.ModTime() && s.originSize == fi.Size()
+}
+
+// isStaticCompress detect static files
+func isStaticCompress(filePath string) bool {
+	for _, statExtension := range BConfig.WebConfig.StaticExtensionsToGzip {
+		if strings.HasSuffix(strings.ToLower(filePath), strings.ToLower(statExtension)) {
+			return true
+		}
+	}
+	return false
+}
+
+// searchFile search the file by url path
+// if none the static file prefix matches ,return notStaticRequestErr
+func searchFile(ctx *context.Context) (string, os.FileInfo, error) {
+	requestPath := filepath.ToSlash(filepath.Clean(ctx.Request.URL.Path))
+	// special processing : favicon.ico/robots.txt  can be in any static dir
+	if requestPath == "/favicon.ico" || requestPath == "/robots.txt" {
+		file := path.Join(".", requestPath)
+		if fi, _ := os.Stat(file); fi != nil {
+			return file, fi, nil
+		}
+		for _, staticDir := range BConfig.WebConfig.StaticDir {
+			filePath := path.Join(staticDir, requestPath)
+			if fi, _ := os.Stat(filePath); fi != nil {
+				return filePath, fi, nil
+			}
+		}
+		return "", nil, errNotStaticRequest
+	}
+
+	for prefix, staticDir := range BConfig.WebConfig.StaticDir {
+		if !strings.Contains(requestPath, prefix) {
+			continue
+		}
+		if prefix != "/" && len(requestPath) > len(prefix) && requestPath[len(prefix)] != '/' {
+			continue
+		}
+		filePath := path.Join(staticDir, requestPath[len(prefix):])
+		if fi, err := os.Stat(filePath); fi != nil {
+			return filePath, fi, err
+		}
+	}
+	return "", nil, errNotStaticRequest
+}
+
+// lookupFile find the file to serve
+// if the file is dir ,search the index.html as default file( MUST NOT A DIR also)
+// if the index.html not exist or is a dir, give a forbidden response depending on  DirectoryIndex
+func lookupFile(ctx *context.Context) (bool, string, os.FileInfo, error) {
+	fp, fi, err := searchFile(ctx)
+	if fp == "" || fi == nil {
+		return false, "", nil, err
+	}
+	if !fi.IsDir() {
+		return false, fp, fi, err
+	}
+	if requestURL := ctx.Input.URL(); requestURL[len(requestURL)-1] == '/' {
+		ifp := filepath.Join(fp, "index.html")
+		if ifi, _ := os.Stat(ifp); ifi != nil && ifi.Mode().IsRegular() {
+			return false, ifp, ifi, err
+		}
+	}
+	return !BConfig.WebConfig.DirectoryIndex, fp, fi, err
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/stub.go

@@ -0,0 +1,30 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for github.com/astaxie/beego, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: github.com/astaxie/beego (exports: ; functions: Alert,Critical,Debug,Emergency,Error,Info,Informational,Notice,Trace,Warn,Warning)
+
+// Package beego is a stub of github.com/astaxie/beego, generated by depstubber.
+package beego
+
+func Alert(_ ...interface{}) {}
+
+func Critical(_ ...interface{}) {}
+
+func Debug(_ ...interface{}) {}
+
+func Emergency(_ ...interface{}) {}
+
+func Error(_ ...interface{}) {}
+
+func Info(_ ...interface{}) {}
+
+func Informational(_ ...interface{}) {}
+
+func Notice(_ ...interface{}) {}
+
+func Trace(_ ...interface{}) {}
+
+func Warn(_ ...interface{}) {}
+
+func Warning(_ ...interface{}) {}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/template.go

@@ -0,0 +1,406 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"errors"
+	"fmt"
+	"html/template"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"sync"
+
+	"github.com/astaxie/beego/logs"
+	"github.com/astaxie/beego/utils"
+)
+
+var (
+	beegoTplFuncMap           = make(template.FuncMap)
+	beeViewPathTemplateLocked = false
+	// beeViewPathTemplates caching map and supported template file extensions per view
+	beeViewPathTemplates = make(map[string]map[string]*template.Template)
+	templatesLock        sync.RWMutex
+	// beeTemplateExt stores the template extension which will build
+	beeTemplateExt = []string{"tpl", "html", "gohtml"}
+	// beeTemplatePreprocessors stores associations of extension -> preprocessor handler
+	beeTemplateEngines = map[string]templatePreProcessor{}
+	beeTemplateFS      = defaultFSFunc
+)
+
+// ExecuteTemplate applies the template with name  to the specified data object,
+// writing the output to wr.
+// A template will be executed safely in parallel.
+func ExecuteTemplate(wr io.Writer, name string, data interface{}) error {
+	return ExecuteViewPathTemplate(wr, name, BConfig.WebConfig.ViewsPath, data)
+}
+
+// ExecuteViewPathTemplate applies the template with name and from specific viewPath to the specified data object,
+// writing the output to wr.
+// A template will be executed safely in parallel.
+func ExecuteViewPathTemplate(wr io.Writer, name string, viewPath string, data interface{}) error {
+	if BConfig.RunMode == DEV {
+		templatesLock.RLock()
+		defer templatesLock.RUnlock()
+	}
+	if beeTemplates, ok := beeViewPathTemplates[viewPath]; ok {
+		if t, ok := beeTemplates[name]; ok {
+			var err error
+			if t.Lookup(name) != nil {
+				err = t.ExecuteTemplate(wr, name, data)
+			} else {
+				err = t.Execute(wr, data)
+			}
+			if err != nil {
+				logs.Trace("template Execute err:", err)
+			}
+			return err
+		}
+		panic("can't find templatefile in the path:" + viewPath + "/" + name)
+	}
+	panic("Unknown view path:" + viewPath)
+}
+
+func init() {
+	beegoTplFuncMap["dateformat"] = DateFormat
+	beegoTplFuncMap["date"] = Date
+	beegoTplFuncMap["compare"] = Compare
+	beegoTplFuncMap["compare_not"] = CompareNot
+	beegoTplFuncMap["not_nil"] = NotNil
+	beegoTplFuncMap["not_null"] = NotNil
+	beegoTplFuncMap["substr"] = Substr
+	beegoTplFuncMap["html2str"] = HTML2str
+	beegoTplFuncMap["str2html"] = Str2html
+	beegoTplFuncMap["htmlquote"] = Htmlquote
+	beegoTplFuncMap["htmlunquote"] = Htmlunquote
+	beegoTplFuncMap["renderform"] = RenderForm
+	beegoTplFuncMap["assets_js"] = AssetsJs
+	beegoTplFuncMap["assets_css"] = AssetsCSS
+	beegoTplFuncMap["config"] = GetConfig
+	beegoTplFuncMap["map_get"] = MapGet
+
+	// Comparisons
+	beegoTplFuncMap["eq"] = eq // ==
+	beegoTplFuncMap["ge"] = ge // >=
+	beegoTplFuncMap["gt"] = gt // >
+	beegoTplFuncMap["le"] = le // <=
+	beegoTplFuncMap["lt"] = lt // <
+	beegoTplFuncMap["ne"] = ne // !=
+
+	beegoTplFuncMap["urlfor"] = URLFor // build a URL to match a Controller and it's method
+}
+
+// AddFuncMap let user to register a func in the template.
+func AddFuncMap(key string, fn interface{}) error {
+	beegoTplFuncMap[key] = fn
+	return nil
+}
+
+type templatePreProcessor func(root, path string, funcs template.FuncMap) (*template.Template, error)
+
+type templateFile struct {
+	root  string
+	files map[string][]string
+}
+
+// visit will make the paths into two part,the first is subDir (without tf.root),the second is full path(without tf.root).
+// if tf.root="views" and
+// paths is "views/errors/404.html",the subDir will be "errors",the file will be "errors/404.html"
+// paths is "views/admin/errors/404.html",the subDir will be "admin/errors",the file will be "admin/errors/404.html"
+func (tf *templateFile) visit(paths string, f os.FileInfo, err error) error {
+	if f == nil {
+		return err
+	}
+	if f.IsDir() || (f.Mode()&os.ModeSymlink) > 0 {
+		return nil
+	}
+	if !HasTemplateExt(paths) {
+		return nil
+	}
+
+	replace := strings.NewReplacer("\\", "/")
+	file := strings.TrimLeft(replace.Replace(paths[len(tf.root):]), "/")
+	subDir := filepath.Dir(file)
+
+	tf.files[subDir] = append(tf.files[subDir], file)
+	return nil
+}
+
+// HasTemplateExt return this path contains supported template extension of beego or not.
+func HasTemplateExt(paths string) bool {
+	for _, v := range beeTemplateExt {
+		if strings.HasSuffix(paths, "."+v) {
+			return true
+		}
+	}
+	return false
+}
+
+// AddTemplateExt add new extension for template.
+func AddTemplateExt(ext string) {
+	for _, v := range beeTemplateExt {
+		if v == ext {
+			return
+		}
+	}
+	beeTemplateExt = append(beeTemplateExt, ext)
+}
+
+// AddViewPath adds a new path to the supported view paths.
+//Can later be used by setting a controller ViewPath to this folder
+//will panic if called after beego.Run()
+func AddViewPath(viewPath string) error {
+	if beeViewPathTemplateLocked {
+		if _, exist := beeViewPathTemplates[viewPath]; exist {
+			return nil //Ignore if viewpath already exists
+		}
+		panic("Can not add new view paths after beego.Run()")
+	}
+	beeViewPathTemplates[viewPath] = make(map[string]*template.Template)
+	return BuildTemplate(viewPath)
+}
+
+func lockViewPaths() {
+	beeViewPathTemplateLocked = true
+}
+
+// BuildTemplate will build all template files in a directory.
+// it makes beego can render any template file in view directory.
+func BuildTemplate(dir string, files ...string) error {
+	var err error
+	fs := beeTemplateFS()
+	f, err := fs.Open(dir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return errors.New("dir open err")
+	}
+	defer f.Close()
+
+	beeTemplates, ok := beeViewPathTemplates[dir]
+	if !ok {
+		panic("Unknown view path: " + dir)
+	}
+	self := &templateFile{
+		root:  dir,
+		files: make(map[string][]string),
+	}
+	err = Walk(fs, dir, func(path string, f os.FileInfo, err error) error {
+		return self.visit(path, f, err)
+	})
+	if err != nil {
+		fmt.Printf("Walk() returned %v\n", err)
+		return err
+	}
+	buildAllFiles := len(files) == 0
+	for _, v := range self.files {
+		for _, file := range v {
+			if buildAllFiles || utils.InSlice(file, files) {
+				templatesLock.Lock()
+				ext := filepath.Ext(file)
+				var t *template.Template
+				if len(ext) == 0 {
+					t, err = getTemplate(self.root, fs, file, v...)
+				} else if fn, ok := beeTemplateEngines[ext[1:]]; ok {
+					t, err = fn(self.root, file, beegoTplFuncMap)
+				} else {
+					t, err = getTemplate(self.root, fs, file, v...)
+				}
+				if err != nil {
+					logs.Error("parse template err:", file, err)
+					templatesLock.Unlock()
+					return err
+				}
+				beeTemplates[file] = t
+				templatesLock.Unlock()
+			}
+		}
+	}
+	return nil
+}
+
+func getTplDeep(root string, fs http.FileSystem, file string, parent string, t *template.Template) (*template.Template, [][]string, error) {
+	var fileAbsPath string
+	var rParent string
+	var err error
+	if strings.HasPrefix(file, "../") {
+		rParent = filepath.Join(filepath.Dir(parent), file)
+		fileAbsPath = filepath.Join(root, filepath.Dir(parent), file)
+	} else {
+		rParent = file
+		fileAbsPath = filepath.Join(root, file)
+	}
+	f, err := fs.Open(fileAbsPath)
+	if err != nil {
+		panic("can't find template file:" + file)
+	}
+	defer f.Close()
+	data, err := ioutil.ReadAll(f)
+	if err != nil {
+		return nil, [][]string{}, err
+	}
+	t, err = t.New(file).Parse(string(data))
+	if err != nil {
+		return nil, [][]string{}, err
+	}
+	reg := regexp.MustCompile(BConfig.WebConfig.TemplateLeft + "[ ]*template[ ]+\"([^\"]+)\"")
+	allSub := reg.FindAllStringSubmatch(string(data), -1)
+	for _, m := range allSub {
+		if len(m) == 2 {
+			tl := t.Lookup(m[1])
+			if tl != nil {
+				continue
+			}
+			if !HasTemplateExt(m[1]) {
+				continue
+			}
+			_, _, err = getTplDeep(root, fs, m[1], rParent, t)
+			if err != nil {
+				return nil, [][]string{}, err
+			}
+		}
+	}
+	return t, allSub, nil
+}
+
+func getTemplate(root string, fs http.FileSystem, file string, others ...string) (t *template.Template, err error) {
+	t = template.New(file).Delims(BConfig.WebConfig.TemplateLeft, BConfig.WebConfig.TemplateRight).Funcs(beegoTplFuncMap)
+	var subMods [][]string
+	t, subMods, err = getTplDeep(root, fs, file, "", t)
+	if err != nil {
+		return nil, err
+	}
+	t, err = _getTemplate(t, root, fs, subMods, others...)
+
+	if err != nil {
+		return nil, err
+	}
+	return
+}
+
+func _getTemplate(t0 *template.Template, root string, fs http.FileSystem, subMods [][]string, others ...string) (t *template.Template, err error) {
+	t = t0
+	for _, m := range subMods {
+		if len(m) == 2 {
+			tpl := t.Lookup(m[1])
+			if tpl != nil {
+				continue
+			}
+			//first check filename
+			for _, otherFile := range others {
+				if otherFile == m[1] {
+					var subMods1 [][]string
+					t, subMods1, err = getTplDeep(root, fs, otherFile, "", t)
+					if err != nil {
+						logs.Trace("template parse file err:", err)
+					} else if len(subMods1) > 0 {
+						t, err = _getTemplate(t, root, fs, subMods1, others...)
+					}
+					break
+				}
+			}
+			//second check define
+			for _, otherFile := range others {
+				var data []byte
+				fileAbsPath := filepath.Join(root, otherFile)
+				f, err := fs.Open(fileAbsPath)
+				if err != nil {
+					f.Close()
+					logs.Trace("template file parse error, not success open file:", err)
+					continue
+				}
+				data, err = ioutil.ReadAll(f)
+				f.Close()
+				if err != nil {
+					logs.Trace("template file parse error, not success read file:", err)
+					continue
+				}
+				reg := regexp.MustCompile(BConfig.WebConfig.TemplateLeft + "[ ]*define[ ]+\"([^\"]+)\"")
+				allSub := reg.FindAllStringSubmatch(string(data), -1)
+				for _, sub := range allSub {
+					if len(sub) == 2 && sub[1] == m[1] {
+						var subMods1 [][]string
+						t, subMods1, err = getTplDeep(root, fs, otherFile, "", t)
+						if err != nil {
+							logs.Trace("template parse file err:", err)
+						} else if len(subMods1) > 0 {
+							t, err = _getTemplate(t, root, fs, subMods1, others...)
+							if err != nil {
+								logs.Trace("template parse file err:", err)
+							}
+						}
+						break
+					}
+				}
+			}
+		}
+
+	}
+	return
+}
+
+type templateFSFunc func() http.FileSystem
+
+func defaultFSFunc() http.FileSystem {
+	return FileSystem{}
+}
+
+// SetTemplateFSFunc set default filesystem function
+func SetTemplateFSFunc(fnt templateFSFunc) {
+	beeTemplateFS = fnt
+}
+
+// SetViewsPath sets view directory path in beego application.
+func SetViewsPath(path string) *App {
+	BConfig.WebConfig.ViewsPath = path
+	return BeeApp
+}
+
+// SetStaticPath sets static directory path and proper url pattern in beego application.
+// if beego.SetStaticPath("static","public"), visit /static/* to load static file in folder "public".
+func SetStaticPath(url string, path string) *App {
+	if !strings.HasPrefix(url, "/") {
+		url = "/" + url
+	}
+	if url != "/" {
+		url = strings.TrimRight(url, "/")
+	}
+	BConfig.WebConfig.StaticDir[url] = path
+	return BeeApp
+}
+
+// DelStaticPath removes the static folder setting in this url pattern in beego application.
+func DelStaticPath(url string) *App {
+	if !strings.HasPrefix(url, "/") {
+		url = "/" + url
+	}
+	if url != "/" {
+		url = strings.TrimRight(url, "/")
+	}
+	delete(BConfig.WebConfig.StaticDir, url)
+	return BeeApp
+}
+
+// AddTemplateEngine add a new templatePreProcessor which support extension
+func AddTemplateEngine(extension string, fn templatePreProcessor) *App {
+	AddTemplateExt(extension)
+	beeTemplateEngines[extension] = fn
+	return BeeApp
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/templatefunc.go

@@ -0,0 +1,780 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"errors"
+	"fmt"
+	"html"
+	"html/template"
+	"net/url"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const (
+	formatTime      = "15:04:05"
+	formatDate      = "2006-01-02"
+	formatDateTime  = "2006-01-02 15:04:05"
+	formatDateTimeT = "2006-01-02T15:04:05"
+)
+
+// Substr returns the substr from start to length.
+func Substr(s string, start, length int) string {
+	bt := []rune(s)
+	if start < 0 {
+		start = 0
+	}
+	if start > len(bt) {
+		start = start % len(bt)
+	}
+	var end int
+	if (start + length) > (len(bt) - 1) {
+		end = len(bt)
+	} else {
+		end = start + length
+	}
+	return string(bt[start:end])
+}
+
+// HTML2str returns escaping text convert from html.
+func HTML2str(html string) string {
+
+	re := regexp.MustCompile(`\<[\S\s]+?\>`)
+	html = re.ReplaceAllStringFunc(html, strings.ToLower)
+
+	//remove STYLE
+	re = regexp.MustCompile(`\<style[\S\s]+?\</style\>`)
+	html = re.ReplaceAllString(html, "")
+
+	//remove SCRIPT
+	re = regexp.MustCompile(`\<script[\S\s]+?\</script\>`)
+	html = re.ReplaceAllString(html, "")
+
+	re = regexp.MustCompile(`\<[\S\s]+?\>`)
+	html = re.ReplaceAllString(html, "\n")
+
+	re = regexp.MustCompile(`\s{2,}`)
+	html = re.ReplaceAllString(html, "\n")
+
+	return strings.TrimSpace(html)
+}
+
+// DateFormat takes a time and a layout string and returns a string with the formatted date. Used by the template parser as "dateformat"
+func DateFormat(t time.Time, layout string) (datestring string) {
+	datestring = t.Format(layout)
+	return
+}
+
+// DateFormat pattern rules.
+var datePatterns = []string{
+	// year
+	"Y", "2006", // A full numeric representation of a year, 4 digits   Examples: 1999 or 2003
+	"y", "06", //A two digit representation of a year   Examples: 99 or 03
+
+	// month
+	"m", "01", // Numeric representation of a month, with leading zeros 01 through 12
+	"n", "1", // Numeric representation of a month, without leading zeros   1 through 12
+	"M", "Jan", // A short textual representation of a month, three letters Jan through Dec
+	"F", "January", // A full textual representation of a month, such as January or March   January through December
+
+	// day
+	"d", "02", // Day of the month, 2 digits with leading zeros 01 to 31
+	"j", "2", // Day of the month without leading zeros 1 to 31
+
+	// week
+	"D", "Mon", // A textual representation of a day, three letters Mon through Sun
+	"l", "Monday", // A full textual representation of the day of the week  Sunday through Saturday
+
+	// time
+	"g", "3", // 12-hour format of an hour without leading zeros    1 through 12
+	"G", "15", // 24-hour format of an hour without leading zeros   0 through 23
+	"h", "03", // 12-hour format of an hour with leading zeros  01 through 12
+	"H", "15", // 24-hour format of an hour with leading zeros  00 through 23
+
+	"a", "pm", // Lowercase Ante meridiem and Post meridiem am or pm
+	"A", "PM", // Uppercase Ante meridiem and Post meridiem AM or PM
+
+	"i", "04", // Minutes with leading zeros    00 to 59
+	"s", "05", // Seconds, with leading zeros   00 through 59
+
+	// time zone
+	"T", "MST",
+	"P", "-07:00",
+	"O", "-0700",
+
+	// RFC 2822
+	"r", time.RFC1123Z,
+}
+
+// DateParse Parse Date use PHP time format.
+func DateParse(dateString, format string) (time.Time, error) {
+	replacer := strings.NewReplacer(datePatterns...)
+	format = replacer.Replace(format)
+	return time.ParseInLocation(format, dateString, time.Local)
+}
+
+// Date takes a PHP like date func to Go's time format.
+func Date(t time.Time, format string) string {
+	replacer := strings.NewReplacer(datePatterns...)
+	format = replacer.Replace(format)
+	return t.Format(format)
+}
+
+// Compare is a quick and dirty comparison function. It will convert whatever you give it to strings and see if the two values are equal.
+// Whitespace is trimmed. Used by the template parser as "eq".
+func Compare(a, b interface{}) (equal bool) {
+	equal = false
+	if strings.TrimSpace(fmt.Sprintf("%v", a)) == strings.TrimSpace(fmt.Sprintf("%v", b)) {
+		equal = true
+	}
+	return
+}
+
+// CompareNot !Compare
+func CompareNot(a, b interface{}) (equal bool) {
+	return !Compare(a, b)
+}
+
+// NotNil the same as CompareNot
+func NotNil(a interface{}) (isNil bool) {
+	return CompareNot(a, nil)
+}
+
+// GetConfig get the Appconfig
+func GetConfig(returnType, key string, defaultVal interface{}) (value interface{}, err error) {
+	switch returnType {
+	case "String":
+		value = AppConfig.String(key)
+	case "Bool":
+		value, err = AppConfig.Bool(key)
+	case "Int":
+		value, err = AppConfig.Int(key)
+	case "Int64":
+		value, err = AppConfig.Int64(key)
+	case "Float":
+		value, err = AppConfig.Float(key)
+	case "DIY":
+		value, err = AppConfig.DIY(key)
+	default:
+		err = errors.New("config keys must be of type String, Bool, Int, Int64, Float, or DIY")
+	}
+
+	if err != nil {
+		if reflect.TypeOf(returnType) != reflect.TypeOf(defaultVal) {
+			err = errors.New("defaultVal type does not match returnType")
+		} else {
+			value, err = defaultVal, nil
+		}
+	} else if reflect.TypeOf(value).Kind() == reflect.String {
+		if value == "" {
+			if reflect.TypeOf(defaultVal).Kind() != reflect.String {
+				err = errors.New("defaultVal type must be a String if the returnType is a String")
+			} else {
+				value = defaultVal.(string)
+			}
+		}
+	}
+
+	return
+}
+
+// Str2html Convert string to template.HTML type.
+func Str2html(raw string) template.HTML {
+	return template.HTML(raw)
+}
+
+// Htmlquote returns quoted html string.
+func Htmlquote(text string) string {
+	//HTML编码为实体符号
+	/*
+	   Encodes `text` for raw use in HTML.
+	       >>> htmlquote("<'&\\">")
+	       '&lt;&#39;&amp;&quot;&gt;'
+	*/
+
+	text = html.EscapeString(text)
+	text = strings.NewReplacer(
+		`“`, "&ldquo;",
+		`”`, "&rdquo;",
+		` `, "&nbsp;",
+	).Replace(text)
+
+	return strings.TrimSpace(text)
+}
+
+// Htmlunquote returns unquoted html string.
+func Htmlunquote(text string) string {
+	//实体符号解释为HTML
+	/*
+	   Decodes `text` that's HTML quoted.
+	       >>> htmlunquote('&lt;&#39;&amp;&quot;&gt;')
+	       '<\\'&">'
+	*/
+
+	text = html.UnescapeString(text)
+
+	return strings.TrimSpace(text)
+}
+
+// URLFor returns url string with another registered controller handler with params.
+//	usage:
+//
+//	URLFor(".index")
+//	print URLFor("index")
+//  router /login
+//	print URLFor("login")
+//	print URLFor("login", "next","/"")
+//  router /profile/:username
+//	print UrlFor("profile", ":username","John Doe")
+//	result:
+//	/
+//	/login
+//	/login?next=/
+//	/user/John%20Doe
+//
+//  more detail http://beego.me/docs/mvc/controller/urlbuilding.md
+func URLFor(endpoint string, values ...interface{}) string {
+	return BeeApp.Handlers.URLFor(endpoint, values...)
+}
+
+// AssetsJs returns script tag with src string.
+func AssetsJs(text string) template.HTML {
+
+	text = "<script src=\"" + text + "\"></script>"
+
+	return template.HTML(text)
+}
+
+// AssetsCSS returns stylesheet link tag with src string.
+func AssetsCSS(text string) template.HTML {
+
+	text = "<link href=\"" + text + "\" rel=\"stylesheet\" />"
+
+	return template.HTML(text)
+}
+
+// ParseForm will parse form values to struct via tag.
+// Support for anonymous struct.
+func parseFormToStruct(form url.Values, objT reflect.Type, objV reflect.Value) error {
+	for i := 0; i < objT.NumField(); i++ {
+		fieldV := objV.Field(i)
+		if !fieldV.CanSet() {
+			continue
+		}
+
+		fieldT := objT.Field(i)
+		if fieldT.Anonymous && fieldT.Type.Kind() == reflect.Struct {
+			err := parseFormToStruct(form, fieldT.Type, fieldV)
+			if err != nil {
+				return err
+			}
+			continue
+		}
+
+		tags := strings.Split(fieldT.Tag.Get("form"), ",")
+		var tag string
+		if len(tags) == 0 || len(tags[0]) == 0 {
+			tag = fieldT.Name
+		} else if tags[0] == "-" {
+			continue
+		} else {
+			tag = tags[0]
+		}
+
+		formValues := form[tag]
+		var value string
+		if len(formValues) == 0 {
+			defaultValue := fieldT.Tag.Get("default")
+			if defaultValue != "" {
+				value = defaultValue
+			} else {
+				continue
+			}
+		}
+		if len(formValues) == 1 {
+			value = formValues[0]
+			if value == "" {
+				continue
+			}
+		}
+
+		switch fieldT.Type.Kind() {
+		case reflect.Bool:
+			if strings.ToLower(value) == "on" || strings.ToLower(value) == "1" || strings.ToLower(value) == "yes" {
+				fieldV.SetBool(true)
+				continue
+			}
+			if strings.ToLower(value) == "off" || strings.ToLower(value) == "0" || strings.ToLower(value) == "no" {
+				fieldV.SetBool(false)
+				continue
+			}
+			b, err := strconv.ParseBool(value)
+			if err != nil {
+				return err
+			}
+			fieldV.SetBool(b)
+		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+			x, err := strconv.ParseInt(value, 10, 64)
+			if err != nil {
+				return err
+			}
+			fieldV.SetInt(x)
+		case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+			x, err := strconv.ParseUint(value, 10, 64)
+			if err != nil {
+				return err
+			}
+			fieldV.SetUint(x)
+		case reflect.Float32, reflect.Float64:
+			x, err := strconv.ParseFloat(value, 64)
+			if err != nil {
+				return err
+			}
+			fieldV.SetFloat(x)
+		case reflect.Interface:
+			fieldV.Set(reflect.ValueOf(value))
+		case reflect.String:
+			fieldV.SetString(value)
+		case reflect.Struct:
+			switch fieldT.Type.String() {
+			case "time.Time":
+				var (
+					t   time.Time
+					err error
+				)
+				if len(value) >= 25 {
+					value = value[:25]
+					t, err = time.ParseInLocation(time.RFC3339, value, time.Local)
+				} else if strings.HasSuffix(strings.ToUpper(value), "Z") {
+					t, err = time.ParseInLocation(time.RFC3339, value, time.Local)
+				} else if len(value) >= 19 {
+					if strings.Contains(value, "T") {
+						value = value[:19]
+						t, err = time.ParseInLocation(formatDateTimeT, value, time.Local)
+					} else {
+						value = value[:19]
+						t, err = time.ParseInLocation(formatDateTime, value, time.Local)
+					}
+				} else if len(value) >= 10 {
+					if len(value) > 10 {
+						value = value[:10]
+					}
+					t, err = time.ParseInLocation(formatDate, value, time.Local)
+				} else if len(value) >= 8 {
+					if len(value) > 8 {
+						value = value[:8]
+					}
+					t, err = time.ParseInLocation(formatTime, value, time.Local)
+				}
+				if err != nil {
+					return err
+				}
+				fieldV.Set(reflect.ValueOf(t))
+			}
+		case reflect.Slice:
+			if fieldT.Type == sliceOfInts {
+				formVals := form[tag]
+				fieldV.Set(reflect.MakeSlice(reflect.SliceOf(reflect.TypeOf(int(1))), len(formVals), len(formVals)))
+				for i := 0; i < len(formVals); i++ {
+					val, err := strconv.Atoi(formVals[i])
+					if err != nil {
+						return err
+					}
+					fieldV.Index(i).SetInt(int64(val))
+				}
+			} else if fieldT.Type == sliceOfStrings {
+				formVals := form[tag]
+				fieldV.Set(reflect.MakeSlice(reflect.SliceOf(reflect.TypeOf("")), len(formVals), len(formVals)))
+				for i := 0; i < len(formVals); i++ {
+					fieldV.Index(i).SetString(formVals[i])
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// ParseForm will parse form values to struct via tag.
+func ParseForm(form url.Values, obj interface{}) error {
+	objT := reflect.TypeOf(obj)
+	objV := reflect.ValueOf(obj)
+	if !isStructPtr(objT) {
+		return fmt.Errorf("%v must be  a struct pointer", obj)
+	}
+	objT = objT.Elem()
+	objV = objV.Elem()
+
+	return parseFormToStruct(form, objT, objV)
+}
+
+var sliceOfInts = reflect.TypeOf([]int(nil))
+var sliceOfStrings = reflect.TypeOf([]string(nil))
+
+var unKind = map[reflect.Kind]bool{
+	reflect.Uintptr:       true,
+	reflect.Complex64:     true,
+	reflect.Complex128:    true,
+	reflect.Array:         true,
+	reflect.Chan:          true,
+	reflect.Func:          true,
+	reflect.Map:           true,
+	reflect.Ptr:           true,
+	reflect.Slice:         true,
+	reflect.Struct:        true,
+	reflect.UnsafePointer: true,
+}
+
+// RenderForm will render object to form html.
+// obj must be a struct pointer.
+func RenderForm(obj interface{}) template.HTML {
+	objT := reflect.TypeOf(obj)
+	objV := reflect.ValueOf(obj)
+	if !isStructPtr(objT) {
+		return template.HTML("")
+	}
+	objT = objT.Elem()
+	objV = objV.Elem()
+
+	var raw []string
+	for i := 0; i < objT.NumField(); i++ {
+		fieldV := objV.Field(i)
+		if !fieldV.CanSet() || unKind[fieldV.Kind()] {
+			continue
+		}
+
+		fieldT := objT.Field(i)
+
+		label, name, fType, id, class, ignored, required := parseFormTag(fieldT)
+		if ignored {
+			continue
+		}
+
+		raw = append(raw, renderFormField(label, name, fType, fieldV.Interface(), id, class, required))
+	}
+	return template.HTML(strings.Join(raw, "</br>"))
+}
+
+// renderFormField returns a string containing HTML of a single form field.
+func renderFormField(label, name, fType string, value interface{}, id string, class string, required bool) string {
+	if id != "" {
+		id = " id=\"" + id + "\""
+	}
+
+	if class != "" {
+		class = " class=\"" + class + "\""
+	}
+
+	requiredString := ""
+	if required {
+		requiredString = " required"
+	}
+
+	if isValidForInput(fType) {
+		return fmt.Sprintf(`%v<input%v%v name="%v" type="%v" value="%v"%v>`, label, id, class, name, fType, value, requiredString)
+	}
+
+	return fmt.Sprintf(`%v<%v%v%v name="%v"%v>%v</%v>`, label, fType, id, class, name, requiredString, value, fType)
+}
+
+// isValidForInput checks if fType is a valid value for the `type` property of an HTML input element.
+func isValidForInput(fType string) bool {
+	validInputTypes := strings.Fields("text password checkbox radio submit reset hidden image file button search email url tel number range date month week time datetime datetime-local color")
+	for _, validType := range validInputTypes {
+		if fType == validType {
+			return true
+		}
+	}
+	return false
+}
+
+// parseFormTag takes the stuct-tag of a StructField and parses the `form` value.
+// returned are the form label, name-property, type and wether the field should be ignored.
+func parseFormTag(fieldT reflect.StructField) (label, name, fType string, id string, class string, ignored bool, required bool) {
+	tags := strings.Split(fieldT.Tag.Get("form"), ",")
+	label = fieldT.Name + ": "
+	name = fieldT.Name
+	fType = "text"
+	ignored = false
+	id = fieldT.Tag.Get("id")
+	class = fieldT.Tag.Get("class")
+
+	required = false
+	requiredField := fieldT.Tag.Get("required")
+	if requiredField != "-" && requiredField != "" {
+		required, _ = strconv.ParseBool(requiredField)
+	}
+
+	switch len(tags) {
+	case 1:
+		if tags[0] == "-" {
+			ignored = true
+		}
+		if len(tags[0]) > 0 {
+			name = tags[0]
+		}
+	case 2:
+		if len(tags[0]) > 0 {
+			name = tags[0]
+		}
+		if len(tags[1]) > 0 {
+			fType = tags[1]
+		}
+	case 3:
+		if len(tags[0]) > 0 {
+			name = tags[0]
+		}
+		if len(tags[1]) > 0 {
+			fType = tags[1]
+		}
+		if len(tags[2]) > 0 {
+			label = tags[2]
+		}
+	}
+
+	return
+}
+
+func isStructPtr(t reflect.Type) bool {
+	return t.Kind() == reflect.Ptr && t.Elem().Kind() == reflect.Struct
+}
+
+// go1.2 added template funcs. begin
+var (
+	errBadComparisonType = errors.New("invalid type for comparison")
+	errBadComparison     = errors.New("incompatible types for comparison")
+	errNoComparison      = errors.New("missing argument for comparison")
+)
+
+type kind int
+
+const (
+	invalidKind kind = iota
+	boolKind
+	complexKind
+	intKind
+	floatKind
+	stringKind
+	uintKind
+)
+
+func basicKind(v reflect.Value) (kind, error) {
+	switch v.Kind() {
+	case reflect.Bool:
+		return boolKind, nil
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return intKind, nil
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return uintKind, nil
+	case reflect.Float32, reflect.Float64:
+		return floatKind, nil
+	case reflect.Complex64, reflect.Complex128:
+		return complexKind, nil
+	case reflect.String:
+		return stringKind, nil
+	}
+	return invalidKind, errBadComparisonType
+}
+
+// eq evaluates the comparison a == b || a == c || ...
+func eq(arg1 interface{}, arg2 ...interface{}) (bool, error) {
+	v1 := reflect.ValueOf(arg1)
+	k1, err := basicKind(v1)
+	if err != nil {
+		return false, err
+	}
+	if len(arg2) == 0 {
+		return false, errNoComparison
+	}
+	for _, arg := range arg2 {
+		v2 := reflect.ValueOf(arg)
+		k2, err := basicKind(v2)
+		if err != nil {
+			return false, err
+		}
+		if k1 != k2 {
+			return false, errBadComparison
+		}
+		truth := false
+		switch k1 {
+		case boolKind:
+			truth = v1.Bool() == v2.Bool()
+		case complexKind:
+			truth = v1.Complex() == v2.Complex()
+		case floatKind:
+			truth = v1.Float() == v2.Float()
+		case intKind:
+			truth = v1.Int() == v2.Int()
+		case stringKind:
+			truth = v1.String() == v2.String()
+		case uintKind:
+			truth = v1.Uint() == v2.Uint()
+		default:
+			panic("invalid kind")
+		}
+		if truth {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// ne evaluates the comparison a != b.
+func ne(arg1, arg2 interface{}) (bool, error) {
+	// != is the inverse of ==.
+	equal, err := eq(arg1, arg2)
+	return !equal, err
+}
+
+// lt evaluates the comparison a < b.
+func lt(arg1, arg2 interface{}) (bool, error) {
+	v1 := reflect.ValueOf(arg1)
+	k1, err := basicKind(v1)
+	if err != nil {
+		return false, err
+	}
+	v2 := reflect.ValueOf(arg2)
+	k2, err := basicKind(v2)
+	if err != nil {
+		return false, err
+	}
+	if k1 != k2 {
+		return false, errBadComparison
+	}
+	truth := false
+	switch k1 {
+	case boolKind, complexKind:
+		return false, errBadComparisonType
+	case floatKind:
+		truth = v1.Float() < v2.Float()
+	case intKind:
+		truth = v1.Int() < v2.Int()
+	case stringKind:
+		truth = v1.String() < v2.String()
+	case uintKind:
+		truth = v1.Uint() < v2.Uint()
+	default:
+		panic("invalid kind")
+	}
+	return truth, nil
+}
+
+// le evaluates the comparison <= b.
+func le(arg1, arg2 interface{}) (bool, error) {
+	// <= is < or ==.
+	lessThan, err := lt(arg1, arg2)
+	if lessThan || err != nil {
+		return lessThan, err
+	}
+	return eq(arg1, arg2)
+}
+
+// gt evaluates the comparison a > b.
+func gt(arg1, arg2 interface{}) (bool, error) {
+	// > is the inverse of <=.
+	lessOrEqual, err := le(arg1, arg2)
+	if err != nil {
+		return false, err
+	}
+	return !lessOrEqual, nil
+}
+
+// ge evaluates the comparison a >= b.
+func ge(arg1, arg2 interface{}) (bool, error) {
+	// >= is the inverse of <.
+	lessThan, err := lt(arg1, arg2)
+	if err != nil {
+		return false, err
+	}
+	return !lessThan, nil
+}
+
+// MapGet getting value from map by keys
+// usage:
+// Data["m"] = M{
+//     "a": 1,
+//     "1": map[string]float64{
+//         "c": 4,
+//     },
+// }
+//
+// {{ map_get m "a" }} // return 1
+// {{ map_get m 1 "c" }} // return 4
+func MapGet(arg1 interface{}, arg2 ...interface{}) (interface{}, error) {
+	arg1Type := reflect.TypeOf(arg1)
+	arg1Val := reflect.ValueOf(arg1)
+
+	if arg1Type.Kind() == reflect.Map && len(arg2) > 0 {
+		// check whether arg2[0] type equals to arg1 key type
+		// if they are different, make conversion
+		arg2Val := reflect.ValueOf(arg2[0])
+		arg2Type := reflect.TypeOf(arg2[0])
+		if arg2Type.Kind() != arg1Type.Key().Kind() {
+			// convert arg2Value to string
+			var arg2ConvertedVal interface{}
+			arg2String := fmt.Sprintf("%v", arg2[0])
+
+			// convert string representation to any other type
+			switch arg1Type.Key().Kind() {
+			case reflect.Bool:
+				arg2ConvertedVal, _ = strconv.ParseBool(arg2String)
+			case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+				arg2ConvertedVal, _ = strconv.ParseInt(arg2String, 0, 64)
+			case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+				arg2ConvertedVal, _ = strconv.ParseUint(arg2String, 0, 64)
+			case reflect.Float32, reflect.Float64:
+				arg2ConvertedVal, _ = strconv.ParseFloat(arg2String, 64)
+			case reflect.String:
+				arg2ConvertedVal = arg2String
+			default:
+				arg2ConvertedVal = arg2Val.Interface()
+			}
+			arg2Val = reflect.ValueOf(arg2ConvertedVal)
+		}
+
+		storedVal := arg1Val.MapIndex(arg2Val)
+
+		if storedVal.IsValid() {
+			var result interface{}
+
+			switch arg1Type.Elem().Kind() {
+			case reflect.Bool:
+				result = storedVal.Bool()
+			case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+				result = storedVal.Int()
+			case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+				result = storedVal.Uint()
+			case reflect.Float32, reflect.Float64:
+				result = storedVal.Float()
+			case reflect.String:
+				result = storedVal.String()
+			default:
+				result = storedVal.Interface()
+			}
+
+			// if there is more keys, handle this recursively
+			if len(arg2) > 1 {
+				return MapGet(result, arg2[1:]...)
+			}
+			return result, nil
+		}
+		return nil, nil
+
+	}
+	return nil, nil
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/test.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+docker-compose -f test_docker_compose.yaml up -d
+
+export ORM_DRIVER=mysql
+export TZ=UTC
+export ORM_SOURCE="beego:test@tcp(localhost:13306)/orm_test?charset=utf8"
+
+go test ./...
+
+# clear all container
+docker-compose -f test_docker_compose.yaml down
+
+

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/test_docker_compose.yaml

@@ -0,0 +1,39 @@
+version: "3.8"
+services:
+  redis:
+    container_name: "beego-redis"
+    image: redis
+    environment:
+      - ALLOW_EMPTY_PASSWORD=yes
+    ports:
+      - "6379:6379"
+
+  mysql:
+    container_name: "beego-mysql"
+    image: mysql:5.7.30
+    ports:
+    - "13306:3306"
+    environment:
+      - MYSQL_ROOT_PASSWORD=1q2w3e
+      - MYSQL_DATABASE=orm_test
+      - MYSQL_USER=beego
+      - MYSQL_PASSWORD=test
+
+  postgresql:
+    container_name: "beego-postgresql"
+    image: bitnami/postgresql:latest
+    ports:
+    - "5432:5432"
+    environment:
+      - ALLOW_EMPTY_PASSWORD=yes
+  ssdb:
+    container_name: "beego-ssdb"
+    image: wendal/ssdb
+    ports:
+    - "8888:8888"
+  memcache:
+    container_name: "beego-memcache"
+    image: memcached
+    ports:
+    - "11211:11211"
+

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/toolbox/healthcheck.go

@@ -0,0 +1,48 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package toolbox healthcheck
+//
+// type DatabaseCheck struct {
+// }
+//
+// func (dc *DatabaseCheck) Check() error {
+//	if dc.isConnected() {
+//		return nil
+//	} else {
+//		return errors.New("can't connect database")
+// 	 }
+// }
+//
+// AddHealthCheck("database",&DatabaseCheck{})
+//
+// more docs: http://beego.me/docs/module/toolbox.md
+package toolbox
+
+// AdminCheckList holds health checker map
+var AdminCheckList map[string]HealthChecker
+
+// HealthChecker health checker interface
+type HealthChecker interface {
+	Check() error
+}
+
+// AddHealthCheck add health checker with name string
+func AddHealthCheck(name string, hc HealthChecker) {
+	AdminCheckList[name] = hc
+}
+
+func init() {
+	AdminCheckList = make(map[string]HealthChecker)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/toolbox/profile.go

@@ -0,0 +1,184 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package toolbox
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"path"
+	"runtime"
+	"runtime/debug"
+	"runtime/pprof"
+	"strconv"
+	"time"
+)
+
+var startTime = time.Now()
+var pid int
+
+func init() {
+	pid = os.Getpid()
+}
+
+// ProcessInput parse input command string
+func ProcessInput(input string, w io.Writer) {
+	switch input {
+	case "lookup goroutine":
+		p := pprof.Lookup("goroutine")
+		p.WriteTo(w, 2)
+	case "lookup heap":
+		p := pprof.Lookup("heap")
+		p.WriteTo(w, 2)
+	case "lookup threadcreate":
+		p := pprof.Lookup("threadcreate")
+		p.WriteTo(w, 2)
+	case "lookup block":
+		p := pprof.Lookup("block")
+		p.WriteTo(w, 2)
+	case "get cpuprof":
+		GetCPUProfile(w)
+	case "get memprof":
+		MemProf(w)
+	case "gc summary":
+		PrintGCSummary(w)
+	}
+}
+
+// MemProf record memory profile in pprof
+func MemProf(w io.Writer) {
+	filename := "mem-" + strconv.Itoa(pid) + ".memprof"
+	if f, err := os.Create(filename); err != nil {
+		fmt.Fprintf(w, "create file %s error %s\n", filename, err.Error())
+		log.Fatal("record heap profile failed: ", err)
+	} else {
+		runtime.GC()
+		pprof.WriteHeapProfile(f)
+		f.Close()
+		fmt.Fprintf(w, "create heap profile %s \n", filename)
+		_, fl := path.Split(os.Args[0])
+		fmt.Fprintf(w, "Now you can use this to check it: go tool pprof %s %s\n", fl, filename)
+	}
+}
+
+// GetCPUProfile start cpu profile monitor
+func GetCPUProfile(w io.Writer) {
+	sec := 30
+	filename := "cpu-" + strconv.Itoa(pid) + ".pprof"
+	f, err := os.Create(filename)
+	if err != nil {
+		fmt.Fprintf(w, "Could not enable CPU profiling: %s\n", err)
+		log.Fatal("record cpu profile failed: ", err)
+	}
+	pprof.StartCPUProfile(f)
+	time.Sleep(time.Duration(sec) * time.Second)
+	pprof.StopCPUProfile()
+
+	fmt.Fprintf(w, "create cpu profile %s \n", filename)
+	_, fl := path.Split(os.Args[0])
+	fmt.Fprintf(w, "Now you can use this to check it: go tool pprof %s %s\n", fl, filename)
+}
+
+// PrintGCSummary print gc information to io.Writer
+func PrintGCSummary(w io.Writer) {
+	memStats := &runtime.MemStats{}
+	runtime.ReadMemStats(memStats)
+	gcstats := &debug.GCStats{PauseQuantiles: make([]time.Duration, 100)}
+	debug.ReadGCStats(gcstats)
+
+	printGC(memStats, gcstats, w)
+}
+
+func printGC(memStats *runtime.MemStats, gcstats *debug.GCStats, w io.Writer) {
+
+	if gcstats.NumGC > 0 {
+		lastPause := gcstats.Pause[0]
+		elapsed := time.Now().Sub(startTime)
+		overhead := float64(gcstats.PauseTotal) / float64(elapsed) * 100
+		allocatedRate := float64(memStats.TotalAlloc) / elapsed.Seconds()
+
+		fmt.Fprintf(w, "NumGC:%d Pause:%s Pause(Avg):%s Overhead:%3.2f%% Alloc:%s Sys:%s Alloc(Rate):%s/s Histogram:%s %s %s \n",
+			gcstats.NumGC,
+			toS(lastPause),
+			toS(avg(gcstats.Pause)),
+			overhead,
+			toH(memStats.Alloc),
+			toH(memStats.Sys),
+			toH(uint64(allocatedRate)),
+			toS(gcstats.PauseQuantiles[94]),
+			toS(gcstats.PauseQuantiles[98]),
+			toS(gcstats.PauseQuantiles[99]))
+	} else {
+		// while GC has disabled
+		elapsed := time.Now().Sub(startTime)
+		allocatedRate := float64(memStats.TotalAlloc) / elapsed.Seconds()
+
+		fmt.Fprintf(w, "Alloc:%s Sys:%s Alloc(Rate):%s/s\n",
+			toH(memStats.Alloc),
+			toH(memStats.Sys),
+			toH(uint64(allocatedRate)))
+	}
+}
+
+func avg(items []time.Duration) time.Duration {
+	var sum time.Duration
+	for _, item := range items {
+		sum += item
+	}
+	return time.Duration(int64(sum) / int64(len(items)))
+}
+
+// format bytes number friendly
+func toH(bytes uint64) string {
+	switch {
+	case bytes < 1024:
+		return fmt.Sprintf("%dB", bytes)
+	case bytes < 1024*1024:
+		return fmt.Sprintf("%.2fK", float64(bytes)/1024)
+	case bytes < 1024*1024*1024:
+		return fmt.Sprintf("%.2fM", float64(bytes)/1024/1024)
+	default:
+		return fmt.Sprintf("%.2fG", float64(bytes)/1024/1024/1024)
+	}
+}
+
+// short string format
+func toS(d time.Duration) string {
+
+	u := uint64(d)
+	if u < uint64(time.Second) {
+		switch {
+		case u == 0:
+			return "0"
+		case u < uint64(time.Microsecond):
+			return fmt.Sprintf("%.2fns", float64(u))
+		case u < uint64(time.Millisecond):
+			return fmt.Sprintf("%.2fus", float64(u)/1000)
+		default:
+			return fmt.Sprintf("%.2fms", float64(u)/1000/1000)
+		}
+	} else {
+		switch {
+		case u < uint64(time.Minute):
+			return fmt.Sprintf("%.2fs", float64(u)/1000/1000/1000)
+		case u < uint64(time.Hour):
+			return fmt.Sprintf("%.2fm", float64(u)/1000/1000/1000/60)
+		default:
+			return fmt.Sprintf("%.2fh", float64(u)/1000/1000/1000/60/60)
+		}
+	}
+
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/toolbox/statistics.go

@@ -0,0 +1,149 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package toolbox
+
+import (
+	"fmt"
+	"sync"
+	"time"
+)
+
+// Statistics struct
+type Statistics struct {
+	RequestURL        string
+	RequestController string
+	RequestNum        int64
+	MinTime           time.Duration
+	MaxTime           time.Duration
+	TotalTime         time.Duration
+}
+
+// URLMap contains several statistics struct to log different data
+type URLMap struct {
+	lock        sync.RWMutex
+	LengthLimit int //limit the urlmap's length if it's equal to 0 there's no limit
+	urlmap      map[string]map[string]*Statistics
+}
+
+// AddStatistics add statistics task.
+// it needs request method, request url, request controller and statistics time duration
+func (m *URLMap) AddStatistics(requestMethod, requestURL, requestController string, requesttime time.Duration) {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+	if method, ok := m.urlmap[requestURL]; ok {
+		if s, ok := method[requestMethod]; ok {
+			s.RequestNum++
+			if s.MaxTime < requesttime {
+				s.MaxTime = requesttime
+			}
+			if s.MinTime > requesttime {
+				s.MinTime = requesttime
+			}
+			s.TotalTime += requesttime
+		} else {
+			nb := &Statistics{
+				RequestURL:        requestURL,
+				RequestController: requestController,
+				RequestNum:        1,
+				MinTime:           requesttime,
+				MaxTime:           requesttime,
+				TotalTime:         requesttime,
+			}
+			m.urlmap[requestURL][requestMethod] = nb
+		}
+
+	} else {
+		if m.LengthLimit > 0 && m.LengthLimit <= len(m.urlmap) {
+			return
+		}
+		methodmap := make(map[string]*Statistics)
+		nb := &Statistics{
+			RequestURL:        requestURL,
+			RequestController: requestController,
+			RequestNum:        1,
+			MinTime:           requesttime,
+			MaxTime:           requesttime,
+			TotalTime:         requesttime,
+		}
+		methodmap[requestMethod] = nb
+		m.urlmap[requestURL] = methodmap
+	}
+}
+
+// GetMap put url statistics result in io.Writer
+func (m *URLMap) GetMap() map[string]interface{} {
+	m.lock.RLock()
+	defer m.lock.RUnlock()
+
+	var fields = []string{"requestUrl", "method", "times", "used", "max used", "min used", "avg used"}
+
+	var resultLists [][]string
+	content := make(map[string]interface{})
+	content["Fields"] = fields
+
+	for k, v := range m.urlmap {
+		for kk, vv := range v {
+			result := []string{
+				fmt.Sprintf("% -50s", k),
+				fmt.Sprintf("% -10s", kk),
+				fmt.Sprintf("% -16d", vv.RequestNum),
+				fmt.Sprintf("%d", vv.TotalTime),
+				fmt.Sprintf("% -16s", toS(vv.TotalTime)),
+				fmt.Sprintf("%d", vv.MaxTime),
+				fmt.Sprintf("% -16s", toS(vv.MaxTime)),
+				fmt.Sprintf("%d", vv.MinTime),
+				fmt.Sprintf("% -16s", toS(vv.MinTime)),
+				fmt.Sprintf("%d", time.Duration(int64(vv.TotalTime)/vv.RequestNum)),
+				fmt.Sprintf("% -16s", toS(time.Duration(int64(vv.TotalTime)/vv.RequestNum))),
+			}
+			resultLists = append(resultLists, result)
+		}
+	}
+	content["Data"] = resultLists
+	return content
+}
+
+// GetMapData return all mapdata
+func (m *URLMap) GetMapData() []map[string]interface{} {
+	m.lock.RLock()
+	defer m.lock.RUnlock()
+
+	var resultLists []map[string]interface{}
+
+	for k, v := range m.urlmap {
+		for kk, vv := range v {
+			result := map[string]interface{}{
+				"request_url": k,
+				"method":      kk,
+				"times":       vv.RequestNum,
+				"total_time":  toS(vv.TotalTime),
+				"max_time":    toS(vv.MaxTime),
+				"min_time":    toS(vv.MinTime),
+				"avg_time":    toS(time.Duration(int64(vv.TotalTime) / vv.RequestNum)),
+			}
+			resultLists = append(resultLists, result)
+		}
+	}
+	return resultLists
+}
+
+// StatisticsMap hosld global statistics data map
+var StatisticsMap *URLMap
+
+func init() {
+	StatisticsMap = &URLMap{
+		urlmap: make(map[string]map[string]*Statistics),
+	}
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/toolbox/task.go

@@ -0,0 +1,634 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package toolbox
+
+import (
+	"log"
+	"math"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+// bounds provides a range of acceptable values (plus a map of name to value).
+type bounds struct {
+	min, max uint
+	names    map[string]uint
+}
+
+// The bounds for each field.
+var (
+	AdminTaskList map[string]Tasker
+	taskLock      sync.RWMutex
+	stop          chan bool
+	changed       chan bool
+	isstart       bool
+	seconds       = bounds{0, 59, nil}
+	minutes       = bounds{0, 59, nil}
+	hours         = bounds{0, 23, nil}
+	days          = bounds{1, 31, nil}
+	months        = bounds{1, 12, map[string]uint{
+		"jan": 1,
+		"feb": 2,
+		"mar": 3,
+		"apr": 4,
+		"may": 5,
+		"jun": 6,
+		"jul": 7,
+		"aug": 8,
+		"sep": 9,
+		"oct": 10,
+		"nov": 11,
+		"dec": 12,
+	}}
+	weeks = bounds{0, 6, map[string]uint{
+		"sun": 0,
+		"mon": 1,
+		"tue": 2,
+		"wed": 3,
+		"thu": 4,
+		"fri": 5,
+		"sat": 6,
+	}}
+)
+
+const (
+	// Set the top bit if a star was included in the expression.
+	starBit = 1 << 63
+)
+
+// Schedule time taks schedule
+type Schedule struct {
+	Second uint64
+	Minute uint64
+	Hour   uint64
+	Day    uint64
+	Month  uint64
+	Week   uint64
+}
+
+// TaskFunc task func type
+type TaskFunc func() error
+
+// Tasker task interface
+type Tasker interface {
+	GetSpec() string
+	GetStatus() string
+	Run() error
+	SetNext(time.Time)
+	GetNext() time.Time
+	SetPrev(time.Time)
+	GetPrev() time.Time
+}
+
+// task error
+type taskerr struct {
+	t       time.Time
+	errinfo string
+}
+
+// Task task struct
+type Task struct {
+	Taskname string
+	Spec     *Schedule
+	SpecStr  string
+	DoFunc   TaskFunc
+	Prev     time.Time
+	Next     time.Time
+	Errlist  []*taskerr // like errtime:errinfo
+	ErrLimit int        // max length for the errlist, 0 stand for no limit
+}
+
+// NewTask add new task with name, time and func
+func NewTask(tname string, spec string, f TaskFunc) *Task {
+
+	task := &Task{
+		Taskname: tname,
+		DoFunc:   f,
+		ErrLimit: 100,
+		SpecStr:  spec,
+	}
+	task.SetCron(spec)
+	return task
+}
+
+// GetSpec get spec string
+func (t *Task) GetSpec() string {
+	return t.SpecStr
+}
+
+// GetStatus get current task status
+func (t *Task) GetStatus() string {
+	var str string
+	for _, v := range t.Errlist {
+		str += v.t.String() + ":" + v.errinfo + "<br>"
+	}
+	return str
+}
+
+// Run run all tasks
+func (t *Task) Run() error {
+	err := t.DoFunc()
+	if err != nil {
+		if t.ErrLimit > 0 && t.ErrLimit > len(t.Errlist) {
+			t.Errlist = append(t.Errlist, &taskerr{t: t.Next, errinfo: err.Error()})
+		}
+	}
+	return err
+}
+
+// SetNext set next time for this task
+func (t *Task) SetNext(now time.Time) {
+	t.Next = t.Spec.Next(now)
+}
+
+// GetNext get the next call time of this task
+func (t *Task) GetNext() time.Time {
+	return t.Next
+}
+
+// SetPrev set prev time of this task
+func (t *Task) SetPrev(now time.Time) {
+	t.Prev = now
+}
+
+// GetPrev get prev time of this task
+func (t *Task) GetPrev() time.Time {
+	return t.Prev
+}
+
+// six columns mean：
+//       second：0-59
+//       minute：0-59
+//       hour：1-23
+//       day：1-31
+//       month：1-12
+//       week：0-6（0 means Sunday）
+
+// SetCron some signals：
+//       *： any time
+//       ,：　 separate signal
+//　　    －：duration
+//       /n : do as n times of time duration
+/////////////////////////////////////////////////////////
+//	0/30 * * * * *                        every 30s
+//	0 43 21 * * *                         21:43
+//	0 15 05 * * * 　　                     05:15
+//	0 0 17 * * *                          17:00
+//	0 0 17 * * 1                           17:00 in every Monday
+//	0 0,10 17 * * 0,2,3                   17:00 and 17:10 in every Sunday, Tuesday and Wednesday
+//	0 0-10 17 1 * *                       17:00 to 17:10 in 1 min duration each time on the first day of month
+//	0 0 0 1,15 * 1                        0:00 on the 1st day and 15th day of month
+//	0 42 4 1 * * 　 　                     4:42 on the 1st day of month
+//	0 0 21 * * 1-6　　                     21:00 from Monday to Saturday
+//	0 0,10,20,30,40,50 * * * *　           every 10 min duration
+//	0 */10 * * * * 　　　　　　              every 10 min duration
+//	0 * 1 * * *　　　　　　　　               1:00 to 1:59 in 1 min duration each time
+//	0 0 1 * * *　　　　　　　　               1:00
+//	0 0 */1 * * *　　　　　　　               0 min of hour in 1 hour duration
+//	0 0 * * * *　　　　　　　　               0 min of hour in 1 hour duration
+//	0 2 8-20/3 * * *　　　　　　             8:02, 11:02, 14:02, 17:02, 20:02
+//	0 30 5 1,15 * *　　　　　　              5:30 on the 1st day and 15th day of month
+func (t *Task) SetCron(spec string) {
+	t.Spec = t.parse(spec)
+}
+
+func (t *Task) parse(spec string) *Schedule {
+	if len(spec) > 0 && spec[0] == '@' {
+		return t.parseSpec(spec)
+	}
+	// Split on whitespace.  We require 5 or 6 fields.
+	// (second) (minute) (hour) (day of month) (month) (day of week, optional)
+	fields := strings.Fields(spec)
+	if len(fields) != 5 && len(fields) != 6 {
+		log.Panicf("Expected 5 or 6 fields, found %d: %s", len(fields), spec)
+	}
+
+	// If a sixth field is not provided (DayOfWeek), then it is equivalent to star.
+	if len(fields) == 5 {
+		fields = append(fields, "*")
+	}
+
+	schedule := &Schedule{
+		Second: getField(fields[0], seconds),
+		Minute: getField(fields[1], minutes),
+		Hour:   getField(fields[2], hours),
+		Day:    getField(fields[3], days),
+		Month:  getField(fields[4], months),
+		Week:   getField(fields[5], weeks),
+	}
+
+	return schedule
+}
+
+func (t *Task) parseSpec(spec string) *Schedule {
+	switch spec {
+	case "@yearly", "@annually":
+		return &Schedule{
+			Second: 1 << seconds.min,
+			Minute: 1 << minutes.min,
+			Hour:   1 << hours.min,
+			Day:    1 << days.min,
+			Month:  1 << months.min,
+			Week:   all(weeks),
+		}
+
+	case "@monthly":
+		return &Schedule{
+			Second: 1 << seconds.min,
+			Minute: 1 << minutes.min,
+			Hour:   1 << hours.min,
+			Day:    1 << days.min,
+			Month:  all(months),
+			Week:   all(weeks),
+		}
+
+	case "@weekly":
+		return &Schedule{
+			Second: 1 << seconds.min,
+			Minute: 1 << minutes.min,
+			Hour:   1 << hours.min,
+			Day:    all(days),
+			Month:  all(months),
+			Week:   1 << weeks.min,
+		}
+
+	case "@daily", "@midnight":
+		return &Schedule{
+			Second: 1 << seconds.min,
+			Minute: 1 << minutes.min,
+			Hour:   1 << hours.min,
+			Day:    all(days),
+			Month:  all(months),
+			Week:   all(weeks),
+		}
+
+	case "@hourly":
+		return &Schedule{
+			Second: 1 << seconds.min,
+			Minute: 1 << minutes.min,
+			Hour:   all(hours),
+			Day:    all(days),
+			Month:  all(months),
+			Week:   all(weeks),
+		}
+	}
+	log.Panicf("Unrecognized descriptor: %s", spec)
+	return nil
+}
+
+// Next set schedule to next time
+func (s *Schedule) Next(t time.Time) time.Time {
+
+	// Start at the earliest possible time (the upcoming second).
+	t = t.Add(1*time.Second - time.Duration(t.Nanosecond())*time.Nanosecond)
+
+	// This flag indicates whether a field has been incremented.
+	added := false
+
+	// If no time is found within five years, return zero.
+	yearLimit := t.Year() + 5
+
+WRAP:
+	if t.Year() > yearLimit {
+		return time.Time{}
+	}
+
+	// Find the first applicable month.
+	// If it's this month, then do nothing.
+	for 1<<uint(t.Month())&s.Month == 0 {
+		// If we have to add a month, reset the other parts to 0.
+		if !added {
+			added = true
+			// Otherwise, set the date at the beginning (since the current time is irrelevant).
+			t = time.Date(t.Year(), t.Month(), 1, 0, 0, 0, 0, t.Location())
+		}
+		t = t.AddDate(0, 1, 0)
+
+		// Wrapped around.
+		if t.Month() == time.January {
+			goto WRAP
+		}
+	}
+
+	// Now get a day in that month.
+	for !dayMatches(s, t) {
+		if !added {
+			added = true
+			t = time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, t.Location())
+		}
+		t = t.AddDate(0, 0, 1)
+
+		if t.Day() == 1 {
+			goto WRAP
+		}
+	}
+
+	for 1<<uint(t.Hour())&s.Hour == 0 {
+		if !added {
+			added = true
+			t = time.Date(t.Year(), t.Month(), t.Day(), t.Hour(), 0, 0, 0, t.Location())
+		}
+		t = t.Add(1 * time.Hour)
+
+		if t.Hour() == 0 {
+			goto WRAP
+		}
+	}
+
+	for 1<<uint(t.Minute())&s.Minute == 0 {
+		if !added {
+			added = true
+			t = time.Date(t.Year(), t.Month(), t.Day(), t.Hour(), t.Minute(), 0, 0, t.Location())
+		}
+		t = t.Add(1 * time.Minute)
+
+		if t.Minute() == 0 {
+			goto WRAP
+		}
+	}
+
+	for 1<<uint(t.Second())&s.Second == 0 {
+		if !added {
+			added = true
+			t = time.Date(t.Year(), t.Month(), t.Day(), t.Hour(), t.Minute(), t.Second(), 0, t.Location())
+		}
+		t = t.Add(1 * time.Second)
+
+		if t.Second() == 0 {
+			goto WRAP
+		}
+	}
+
+	return t
+}
+
+func dayMatches(s *Schedule, t time.Time) bool {
+	var (
+		domMatch = 1<<uint(t.Day())&s.Day > 0
+		dowMatch = 1<<uint(t.Weekday())&s.Week > 0
+	)
+
+	if s.Day&starBit > 0 || s.Week&starBit > 0 {
+		return domMatch && dowMatch
+	}
+	return domMatch || dowMatch
+}
+
+// StartTask start all tasks
+func StartTask() {
+	taskLock.Lock()
+	defer taskLock.Unlock()
+	if isstart {
+		//If already started， no need to start another goroutine.
+		return
+	}
+	isstart = true
+	go run()
+}
+
+func run() {
+	now := time.Now().Local()
+	for _, t := range AdminTaskList {
+		t.SetNext(now)
+	}
+
+	for {
+		// we only use RLock here because NewMapSorter copy the reference, do not change any thing
+		taskLock.RLock()
+		sortList := NewMapSorter(AdminTaskList)
+		taskLock.RUnlock()
+		sortList.Sort()
+		var effective time.Time
+		if len(AdminTaskList) == 0 || sortList.Vals[0].GetNext().IsZero() {
+			// If there are no entries yet, just sleep - it still handles new entries
+			// and stop requests.
+			effective = now.AddDate(10, 0, 0)
+		} else {
+			effective = sortList.Vals[0].GetNext()
+		}
+		select {
+		case now = <-time.After(effective.Sub(now)):
+			// Run every entry whose next time was this effective time.
+			for _, e := range sortList.Vals {
+				if e.GetNext() != effective {
+					break
+				}
+				go e.Run()
+				e.SetPrev(e.GetNext())
+				e.SetNext(effective)
+			}
+			continue
+		case <-changed:
+			now = time.Now().Local()
+			taskLock.Lock()
+			for _, t := range AdminTaskList {
+				t.SetNext(now)
+			}
+			taskLock.Unlock()
+			continue
+		case <-stop:
+			return
+		}
+	}
+}
+
+// StopTask stop all tasks
+func StopTask() {
+	taskLock.Lock()
+	defer taskLock.Unlock()
+	if isstart {
+		isstart = false
+		stop <- true
+	}
+
+}
+
+// AddTask add task with name
+func AddTask(taskname string, t Tasker) {
+	taskLock.Lock()
+	defer taskLock.Unlock()
+	t.SetNext(time.Now().Local())
+	AdminTaskList[taskname] = t
+	if isstart {
+		changed <- true
+	}
+}
+
+// DeleteTask delete task with name
+func DeleteTask(taskname string) {
+	taskLock.Lock()
+	defer taskLock.Unlock()
+	delete(AdminTaskList, taskname)
+	if isstart {
+		changed <- true
+	}
+}
+
+// MapSorter sort map for tasker
+type MapSorter struct {
+	Keys []string
+	Vals []Tasker
+}
+
+// NewMapSorter create new tasker map
+func NewMapSorter(m map[string]Tasker) *MapSorter {
+	ms := &MapSorter{
+		Keys: make([]string, 0, len(m)),
+		Vals: make([]Tasker, 0, len(m)),
+	}
+	for k, v := range m {
+		ms.Keys = append(ms.Keys, k)
+		ms.Vals = append(ms.Vals, v)
+	}
+	return ms
+}
+
+// Sort sort tasker map
+func (ms *MapSorter) Sort() {
+	sort.Sort(ms)
+}
+
+func (ms *MapSorter) Len() int { return len(ms.Keys) }
+func (ms *MapSorter) Less(i, j int) bool {
+	if ms.Vals[i].GetNext().IsZero() {
+		return false
+	}
+	if ms.Vals[j].GetNext().IsZero() {
+		return true
+	}
+	return ms.Vals[i].GetNext().Before(ms.Vals[j].GetNext())
+}
+func (ms *MapSorter) Swap(i, j int) {
+	ms.Vals[i], ms.Vals[j] = ms.Vals[j], ms.Vals[i]
+	ms.Keys[i], ms.Keys[j] = ms.Keys[j], ms.Keys[i]
+}
+
+func getField(field string, r bounds) uint64 {
+	// list = range {"," range}
+	var bits uint64
+	ranges := strings.FieldsFunc(field, func(r rune) bool { return r == ',' })
+	for _, expr := range ranges {
+		bits |= getRange(expr, r)
+	}
+	return bits
+}
+
+// getRange returns the bits indicated by the given expression:
+//   number | number "-" number [ "/" number ]
+func getRange(expr string, r bounds) uint64 {
+
+	var (
+		start, end, step uint
+		rangeAndStep     = strings.Split(expr, "/")
+		lowAndHigh       = strings.Split(rangeAndStep[0], "-")
+		singleDigit      = len(lowAndHigh) == 1
+	)
+
+	var extrastar uint64
+	if lowAndHigh[0] == "*" || lowAndHigh[0] == "?" {
+		start = r.min
+		end = r.max
+		extrastar = starBit
+	} else {
+		start = parseIntOrName(lowAndHigh[0], r.names)
+		switch len(lowAndHigh) {
+		case 1:
+			end = start
+		case 2:
+			end = parseIntOrName(lowAndHigh[1], r.names)
+		default:
+			log.Panicf("Too many hyphens: %s", expr)
+		}
+	}
+
+	switch len(rangeAndStep) {
+	case 1:
+		step = 1
+	case 2:
+		step = mustParseInt(rangeAndStep[1])
+
+		// Special handling: "N/step" means "N-max/step".
+		if singleDigit {
+			end = r.max
+		}
+	default:
+		log.Panicf("Too many slashes: %s", expr)
+	}
+
+	if start < r.min {
+		log.Panicf("Beginning of range (%d) below minimum (%d): %s", start, r.min, expr)
+	}
+	if end > r.max {
+		log.Panicf("End of range (%d) above maximum (%d): %s", end, r.max, expr)
+	}
+	if start > end {
+		log.Panicf("Beginning of range (%d) beyond end of range (%d): %s", start, end, expr)
+	}
+
+	return getBits(start, end, step) | extrastar
+}
+
+// parseIntOrName returns the (possibly-named) integer contained in expr.
+func parseIntOrName(expr string, names map[string]uint) uint {
+	if names != nil {
+		if namedInt, ok := names[strings.ToLower(expr)]; ok {
+			return namedInt
+		}
+	}
+	return mustParseInt(expr)
+}
+
+// mustParseInt parses the given expression as an int or panics.
+func mustParseInt(expr string) uint {
+	num, err := strconv.Atoi(expr)
+	if err != nil {
+		log.Panicf("Failed to parse int from %s: %s", expr, err)
+	}
+	if num < 0 {
+		log.Panicf("Negative number (%d) not allowed: %s", num, expr)
+	}
+
+	return uint(num)
+}
+
+// getBits sets all bits in the range [min, max], modulo the given step size.
+func getBits(min, max, step uint) uint64 {
+	var bits uint64
+
+	// If step is 1, use shifts.
+	if step == 1 {
+		return ^(math.MaxUint64 << (max + 1)) & (math.MaxUint64 << min)
+	}
+
+	// Else, use a simple loop.
+	for i := min; i <= max; i += step {
+		bits |= 1 << i
+	}
+	return bits
+}
+
+// all returns all bits within the given bounds.  (plus the star bit)
+func all(r bounds) uint64 {
+	return getBits(r.min, r.max, 1) | starBit
+}
+
+func init() {
+	AdminTaskList = make(map[string]Tasker)
+	stop = make(chan bool)
+	changed = make(chan bool)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/tree.go

@@ -0,0 +1,585 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package beego
+
+import (
+	"path"
+	"regexp"
+	"strings"
+
+	"github.com/astaxie/beego/context"
+	"github.com/astaxie/beego/utils"
+)
+
+var (
+	allowSuffixExt = []string{".json", ".xml", ".html"}
+)
+
+// Tree has three elements: FixRouter/wildcard/leaves
+// fixRouter stores Fixed Router
+// wildcard stores params
+// leaves store the endpoint information
+type Tree struct {
+	//prefix set for static router
+	prefix string
+	//search fix route first
+	fixrouters []*Tree
+	//if set, failure to match fixrouters search then search wildcard
+	wildcard *Tree
+	//if set, failure to match wildcard search
+	leaves []*leafInfo
+}
+
+// NewTree return a new Tree
+func NewTree() *Tree {
+	return &Tree{}
+}
+
+// AddTree will add tree to the exist Tree
+// prefix should has no params
+func (t *Tree) AddTree(prefix string, tree *Tree) {
+	t.addtree(splitPath(prefix), tree, nil, "")
+}
+
+func (t *Tree) addtree(segments []string, tree *Tree, wildcards []string, reg string) {
+	if len(segments) == 0 {
+		panic("prefix should has path")
+	}
+	seg := segments[0]
+	iswild, params, regexpStr := splitSegment(seg)
+	// if it's ? meaning can igone this, so add one more rule for it
+	if len(params) > 0 && params[0] == ":" {
+		params = params[1:]
+		if len(segments[1:]) > 0 {
+			t.addtree(segments[1:], tree, append(wildcards, params...), reg)
+		} else {
+			filterTreeWithPrefix(tree, wildcards, reg)
+		}
+	}
+	//Rule: /login/*/access match /login/2009/11/access
+	//if already has *, and when loop the access, should as a regexpStr
+	if !iswild && utils.InSlice(":splat", wildcards) {
+		iswild = true
+		regexpStr = seg
+	}
+	//Rule: /user/:id/*
+	if seg == "*" && len(wildcards) > 0 && reg == "" {
+		regexpStr = "(.+)"
+	}
+	if len(segments) == 1 {
+		if iswild {
+			if regexpStr != "" {
+				if reg == "" {
+					rr := ""
+					for _, w := range wildcards {
+						if w == ":splat" {
+							rr = rr + "(.+)/"
+						} else {
+							rr = rr + "([^/]+)/"
+						}
+					}
+					regexpStr = rr + regexpStr
+				} else {
+					regexpStr = "/" + regexpStr
+				}
+			} else if reg != "" {
+				if seg == "*.*" {
+					regexpStr = "([^.]+).(.+)"
+				} else {
+					for _, w := range params {
+						if w == "." || w == ":" {
+							continue
+						}
+						regexpStr = "([^/]+)/" + regexpStr
+					}
+				}
+			}
+			reg = strings.Trim(reg+"/"+regexpStr, "/")
+			filterTreeWithPrefix(tree, append(wildcards, params...), reg)
+			t.wildcard = tree
+		} else {
+			reg = strings.Trim(reg+"/"+regexpStr, "/")
+			filterTreeWithPrefix(tree, append(wildcards, params...), reg)
+			tree.prefix = seg
+			t.fixrouters = append(t.fixrouters, tree)
+		}
+		return
+	}
+
+	if iswild {
+		if t.wildcard == nil {
+			t.wildcard = NewTree()
+		}
+		if regexpStr != "" {
+			if reg == "" {
+				rr := ""
+				for _, w := range wildcards {
+					if w == ":splat" {
+						rr = rr + "(.+)/"
+					} else {
+						rr = rr + "([^/]+)/"
+					}
+				}
+				regexpStr = rr + regexpStr
+			} else {
+				regexpStr = "/" + regexpStr
+			}
+		} else if reg != "" {
+			if seg == "*.*" {
+				regexpStr = "([^.]+).(.+)"
+				params = params[1:]
+			} else {
+				for range params {
+					regexpStr = "([^/]+)/" + regexpStr
+				}
+			}
+		} else {
+			if seg == "*.*" {
+				params = params[1:]
+			}
+		}
+		reg = strings.TrimRight(strings.TrimRight(reg, "/")+"/"+regexpStr, "/")
+		t.wildcard.addtree(segments[1:], tree, append(wildcards, params...), reg)
+	} else {
+		subTree := NewTree()
+		subTree.prefix = seg
+		t.fixrouters = append(t.fixrouters, subTree)
+		subTree.addtree(segments[1:], tree, append(wildcards, params...), reg)
+	}
+}
+
+func filterTreeWithPrefix(t *Tree, wildcards []string, reg string) {
+	for _, v := range t.fixrouters {
+		filterTreeWithPrefix(v, wildcards, reg)
+	}
+	if t.wildcard != nil {
+		filterTreeWithPrefix(t.wildcard, wildcards, reg)
+	}
+	for _, l := range t.leaves {
+		if reg != "" {
+			if l.regexps != nil {
+				l.wildcards = append(wildcards, l.wildcards...)
+				l.regexps = regexp.MustCompile("^" + reg + "/" + strings.Trim(l.regexps.String(), "^$") + "$")
+			} else {
+				for _, v := range l.wildcards {
+					if v == ":splat" {
+						reg = reg + "/(.+)"
+					} else {
+						reg = reg + "/([^/]+)"
+					}
+				}
+				l.regexps = regexp.MustCompile("^" + reg + "$")
+				l.wildcards = append(wildcards, l.wildcards...)
+			}
+		} else {
+			l.wildcards = append(wildcards, l.wildcards...)
+			if l.regexps != nil {
+				for _, w := range wildcards {
+					if w == ":splat" {
+						reg = "(.+)/" + reg
+					} else {
+						reg = "([^/]+)/" + reg
+					}
+				}
+				l.regexps = regexp.MustCompile("^" + reg + strings.Trim(l.regexps.String(), "^$") + "$")
+			}
+		}
+	}
+}
+
+// AddRouter call addseg function
+func (t *Tree) AddRouter(pattern string, runObject interface{}) {
+	t.addseg(splitPath(pattern), runObject, nil, "")
+}
+
+// "/"
+// "admin" ->
+func (t *Tree) addseg(segments []string, route interface{}, wildcards []string, reg string) {
+	if len(segments) == 0 {
+		if reg != "" {
+			t.leaves = append(t.leaves, &leafInfo{runObject: route, wildcards: wildcards, regexps: regexp.MustCompile("^" + reg + "$")})
+		} else {
+			t.leaves = append(t.leaves, &leafInfo{runObject: route, wildcards: wildcards})
+		}
+	} else {
+		seg := segments[0]
+		iswild, params, regexpStr := splitSegment(seg)
+		// if it's ? meaning can igone this, so add one more rule for it
+		if len(params) > 0 && params[0] == ":" {
+			t.addseg(segments[1:], route, wildcards, reg)
+			params = params[1:]
+		}
+		//Rule: /login/*/access match /login/2009/11/access
+		//if already has *, and when loop the access, should as a regexpStr
+		if !iswild && utils.InSlice(":splat", wildcards) {
+			iswild = true
+			regexpStr = seg
+		}
+		//Rule: /user/:id/*
+		if seg == "*" && len(wildcards) > 0 && reg == "" {
+			regexpStr = "(.+)"
+		}
+		if iswild {
+			if t.wildcard == nil {
+				t.wildcard = NewTree()
+			}
+			if regexpStr != "" {
+				if reg == "" {
+					rr := ""
+					for _, w := range wildcards {
+						if w == ":splat" {
+							rr = rr + "(.+)/"
+						} else {
+							rr = rr + "([^/]+)/"
+						}
+					}
+					regexpStr = rr + regexpStr
+				} else {
+					regexpStr = "/" + regexpStr
+				}
+			} else if reg != "" {
+				if seg == "*.*" {
+					regexpStr = "/([^.]+).(.+)"
+					params = params[1:]
+				} else {
+					for range params {
+						regexpStr = "/([^/]+)" + regexpStr
+					}
+				}
+			} else {
+				if seg == "*.*" {
+					params = params[1:]
+				}
+			}
+			t.wildcard.addseg(segments[1:], route, append(wildcards, params...), reg+regexpStr)
+		} else {
+			var subTree *Tree
+			for _, sub := range t.fixrouters {
+				if sub.prefix == seg {
+					subTree = sub
+					break
+				}
+			}
+			if subTree == nil {
+				subTree = NewTree()
+				subTree.prefix = seg
+				t.fixrouters = append(t.fixrouters, subTree)
+			}
+			subTree.addseg(segments[1:], route, wildcards, reg)
+		}
+	}
+}
+
+// Match router to runObject & params
+func (t *Tree) Match(pattern string, ctx *context.Context) (runObject interface{}) {
+	if len(pattern) == 0 || pattern[0] != '/' {
+		return nil
+	}
+	w := make([]string, 0, 20)
+	return t.match(pattern[1:], pattern, w, ctx)
+}
+
+func (t *Tree) match(treePattern string, pattern string, wildcardValues []string, ctx *context.Context) (runObject interface{}) {
+	if len(pattern) > 0 {
+		i := 0
+		for ; i < len(pattern) && pattern[i] == '/'; i++ {
+		}
+		pattern = pattern[i:]
+	}
+	// Handle leaf nodes:
+	if len(pattern) == 0 {
+		for _, l := range t.leaves {
+			if ok := l.match(treePattern, wildcardValues, ctx); ok {
+				return l.runObject
+			}
+		}
+		if t.wildcard != nil {
+			for _, l := range t.wildcard.leaves {
+				if ok := l.match(treePattern, wildcardValues, ctx); ok {
+					return l.runObject
+				}
+			}
+		}
+		return nil
+	}
+	var seg string
+	i, l := 0, len(pattern)
+	for ; i < l && pattern[i] != '/'; i++ {
+	}
+	if i == 0 {
+		seg = pattern
+		pattern = ""
+	} else {
+		seg = pattern[:i]
+		pattern = pattern[i:]
+	}
+	for _, subTree := range t.fixrouters {
+		if subTree.prefix == seg {
+			if len(pattern) != 0 && pattern[0] == '/' {
+				treePattern = pattern[1:]
+			} else {
+				treePattern = pattern
+			}
+			runObject = subTree.match(treePattern, pattern, wildcardValues, ctx)
+			if runObject != nil {
+				break
+			}
+		}
+	}
+	if runObject == nil && len(t.fixrouters) > 0 {
+		// Filter the .json .xml .html extension
+		for _, str := range allowSuffixExt {
+			if strings.HasSuffix(seg, str) {
+				for _, subTree := range t.fixrouters {
+					if subTree.prefix == seg[:len(seg)-len(str)] {
+						runObject = subTree.match(treePattern, pattern, wildcardValues, ctx)
+						if runObject != nil {
+							ctx.Input.SetParam(":ext", str[1:])
+						}
+					}
+				}
+			}
+		}
+	}
+	if runObject == nil && t.wildcard != nil {
+		runObject = t.wildcard.match(treePattern, pattern, append(wildcardValues, seg), ctx)
+	}
+
+	if runObject == nil && len(t.leaves) > 0 {
+		wildcardValues = append(wildcardValues, seg)
+		start, i := 0, 0
+		for ; i < len(pattern); i++ {
+			if pattern[i] == '/' {
+				if i != 0 && start < len(pattern) {
+					wildcardValues = append(wildcardValues, pattern[start:i])
+				}
+				start = i + 1
+				continue
+			}
+		}
+		if start > 0 {
+			wildcardValues = append(wildcardValues, pattern[start:i])
+		}
+		for _, l := range t.leaves {
+			if ok := l.match(treePattern, wildcardValues, ctx); ok {
+				return l.runObject
+			}
+		}
+	}
+	return runObject
+}
+
+type leafInfo struct {
+	// names of wildcards that lead to this leaf. eg, ["id" "name"] for the wildcard ":id" and ":name"
+	wildcards []string
+
+	// if the leaf is regexp
+	regexps *regexp.Regexp
+
+	runObject interface{}
+}
+
+func (leaf *leafInfo) match(treePattern string, wildcardValues []string, ctx *context.Context) (ok bool) {
+	//fmt.Println("Leaf:", wildcardValues, leaf.wildcards, leaf.regexps)
+	if leaf.regexps == nil {
+		if len(wildcardValues) == 0 && len(leaf.wildcards) == 0 { // static path
+			return true
+		}
+		// match *
+		if len(leaf.wildcards) == 1 && leaf.wildcards[0] == ":splat" {
+			ctx.Input.SetParam(":splat", treePattern)
+			return true
+		}
+		// match *.* or :id
+		if len(leaf.wildcards) >= 2 && leaf.wildcards[len(leaf.wildcards)-2] == ":path" && leaf.wildcards[len(leaf.wildcards)-1] == ":ext" {
+			if len(leaf.wildcards) == 2 {
+				lastone := wildcardValues[len(wildcardValues)-1]
+				strs := strings.SplitN(lastone, ".", 2)
+				if len(strs) == 2 {
+					ctx.Input.SetParam(":ext", strs[1])
+				}
+				ctx.Input.SetParam(":path", path.Join(path.Join(wildcardValues[:len(wildcardValues)-1]...), strs[0]))
+				return true
+			} else if len(wildcardValues) < 2 {
+				return false
+			}
+			var index int
+			for index = 0; index < len(leaf.wildcards)-2; index++ {
+				ctx.Input.SetParam(leaf.wildcards[index], wildcardValues[index])
+			}
+			lastone := wildcardValues[len(wildcardValues)-1]
+			strs := strings.SplitN(lastone, ".", 2)
+			if len(strs) == 2 {
+				ctx.Input.SetParam(":ext", strs[1])
+			}
+			if index > (len(wildcardValues) - 1) {
+				ctx.Input.SetParam(":path", "")
+			} else {
+				ctx.Input.SetParam(":path", path.Join(path.Join(wildcardValues[index:len(wildcardValues)-1]...), strs[0]))
+			}
+			return true
+		}
+		// match :id
+		if len(leaf.wildcards) != len(wildcardValues) {
+			return false
+		}
+		for j, v := range leaf.wildcards {
+			ctx.Input.SetParam(v, wildcardValues[j])
+		}
+		return true
+	}
+
+	if !leaf.regexps.MatchString(path.Join(wildcardValues...)) {
+		return false
+	}
+	matches := leaf.regexps.FindStringSubmatch(path.Join(wildcardValues...))
+	for i, match := range matches[1:] {
+		if i < len(leaf.wildcards) {
+			ctx.Input.SetParam(leaf.wildcards[i], match)
+		}
+	}
+	return true
+}
+
+// "/" -> []
+// "/admin" -> ["admin"]
+// "/admin/" -> ["admin"]
+// "/admin/users" -> ["admin", "users"]
+func splitPath(key string) []string {
+	key = strings.Trim(key, "/ ")
+	if key == "" {
+		return []string{}
+	}
+	return strings.Split(key, "/")
+}
+
+// "admin" -> false, nil, ""
+// ":id" -> true, [:id], ""
+// "?:id" -> true, [: :id], ""        : meaning can empty
+// ":id:int" -> true, [:id], ([0-9]+)
+// ":name:string" -> true, [:name], ([\w]+)
+// ":id([0-9]+)" -> true, [:id], ([0-9]+)
+// ":id([0-9]+)_:name" -> true, [:id :name], ([0-9]+)_(.+)
+// "cms_:id_:page.html" -> true, [:id_ :page], cms_(.+)(.+).html
+// "cms_:id(.+)_:page.html" -> true, [:id :page], cms_(.+)_(.+).html
+// "*" -> true, [:splat], ""
+// "*.*" -> true,[. :path :ext], ""      . meaning separator
+func splitSegment(key string) (bool, []string, string) {
+	if strings.HasPrefix(key, "*") {
+		if key == "*.*" {
+			return true, []string{".", ":path", ":ext"}, ""
+		}
+		return true, []string{":splat"}, ""
+	}
+	if strings.ContainsAny(key, ":") {
+		var paramsNum int
+		var out []rune
+		var start bool
+		var startexp bool
+		var param []rune
+		var expt []rune
+		var skipnum int
+		params := []string{}
+		reg := regexp.MustCompile(`[a-zA-Z0-9_]+`)
+		for i, v := range key {
+			if skipnum > 0 {
+				skipnum--
+				continue
+			}
+			if start {
+				//:id:int and :name:string
+				if v == ':' {
+					if len(key) >= i+4 {
+						if key[i+1:i+4] == "int" {
+							out = append(out, []rune("([0-9]+)")...)
+							params = append(params, ":"+string(param))
+							start = false
+							startexp = false
+							skipnum = 3
+							param = make([]rune, 0)
+							paramsNum++
+							continue
+						}
+					}
+					if len(key) >= i+7 {
+						if key[i+1:i+7] == "string" {
+							out = append(out, []rune(`([\w]+)`)...)
+							params = append(params, ":"+string(param))
+							paramsNum++
+							start = false
+							startexp = false
+							skipnum = 6
+							param = make([]rune, 0)
+							continue
+						}
+					}
+				}
+				// params only support a-zA-Z0-9
+				if reg.MatchString(string(v)) {
+					param = append(param, v)
+					continue
+				}
+				if v != '(' {
+					out = append(out, []rune(`(.+)`)...)
+					params = append(params, ":"+string(param))
+					param = make([]rune, 0)
+					paramsNum++
+					start = false
+					startexp = false
+				}
+			}
+			if startexp {
+				if v != ')' {
+					expt = append(expt, v)
+					continue
+				}
+			}
+			// Escape Sequence '\'
+			if i > 0 && key[i-1] == '\\' {
+				out = append(out, v)
+			} else if v == ':' {
+				param = make([]rune, 0)
+				start = true
+			} else if v == '(' {
+				startexp = true
+				start = false
+				if len(param) > 0 {
+					params = append(params, ":"+string(param))
+					param = make([]rune, 0)
+				}
+				paramsNum++
+				expt = make([]rune, 0)
+				expt = append(expt, '(')
+			} else if v == ')' {
+				startexp = false
+				expt = append(expt, ')')
+				out = append(out, expt...)
+				param = make([]rune, 0)
+			} else if v == '?' {
+				params = append(params, ":")
+			} else {
+				out = append(out, v)
+			}
+		}
+		if len(param) > 0 {
+			if paramsNum > 0 {
+				out = append(out, []rune(`(.+)`)...)
+			}
+			params = append(params, ":"+string(param))
+		}
+		return true, params, string(out)
+	}
+	return false, nil, ""
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/utils/caller.go

@@ -0,0 +1,25 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package utils
+
+import (
+	"reflect"
+	"runtime"
+)
+
+// GetFuncName get function name
+func GetFuncName(i interface{}) string {
+	return runtime.FuncForPC(reflect.ValueOf(i).Pointer()).Name()
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/utils/debug.go

@@ -0,0 +1,478 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package utils
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"reflect"
+	"runtime"
+)
+
+var (
+	dunno     = []byte("???")
+	centerDot = []byte("·")
+	dot       = []byte(".")
+)
+
+type pointerInfo struct {
+	prev *pointerInfo
+	n    int
+	addr uintptr
+	pos  int
+	used []int
+}
+
+// Display print the data in console
+func Display(data ...interface{}) {
+	display(true, data...)
+}
+
+// GetDisplayString return data print string
+func GetDisplayString(data ...interface{}) string {
+	return display(false, data...)
+}
+
+func display(displayed bool, data ...interface{}) string {
+	var pc, file, line, ok = runtime.Caller(2)
+
+	if !ok {
+		return ""
+	}
+
+	var buf = new(bytes.Buffer)
+
+	fmt.Fprintf(buf, "[Debug] at %s() [%s:%d]\n", function(pc), file, line)
+
+	fmt.Fprintf(buf, "\n[Variables]\n")
+
+	for i := 0; i < len(data); i += 2 {
+		var output = fomateinfo(len(data[i].(string))+3, data[i+1])
+		fmt.Fprintf(buf, "%s = %s", data[i], output)
+	}
+
+	if displayed {
+		log.Print(buf)
+	}
+	return buf.String()
+}
+
+// return data dump and format bytes
+func fomateinfo(headlen int, data ...interface{}) []byte {
+	var buf = new(bytes.Buffer)
+
+	if len(data) > 1 {
+		fmt.Fprint(buf, "    ")
+
+		fmt.Fprint(buf, "[")
+
+		fmt.Fprintln(buf)
+	}
+
+	for k, v := range data {
+		var buf2 = new(bytes.Buffer)
+		var pointers *pointerInfo
+		var interfaces = make([]reflect.Value, 0, 10)
+
+		printKeyValue(buf2, reflect.ValueOf(v), &pointers, &interfaces, nil, true, "    ", 1)
+
+		if k < len(data)-1 {
+			fmt.Fprint(buf2, ", ")
+		}
+
+		fmt.Fprintln(buf2)
+
+		buf.Write(buf2.Bytes())
+	}
+
+	if len(data) > 1 {
+		fmt.Fprintln(buf)
+
+		fmt.Fprint(buf, "    ")
+
+		fmt.Fprint(buf, "]")
+	}
+
+	return buf.Bytes()
+}
+
+// check data is golang basic type
+func isSimpleType(val reflect.Value, kind reflect.Kind, pointers **pointerInfo, interfaces *[]reflect.Value) bool {
+	switch kind {
+	case reflect.Bool:
+		return true
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return true
+	case reflect.Uint8, reflect.Uint16, reflect.Uint, reflect.Uint32, reflect.Uint64:
+		return true
+	case reflect.Float32, reflect.Float64:
+		return true
+	case reflect.Complex64, reflect.Complex128:
+		return true
+	case reflect.String:
+		return true
+	case reflect.Chan:
+		return true
+	case reflect.Invalid:
+		return true
+	case reflect.Interface:
+		for _, in := range *interfaces {
+			if reflect.DeepEqual(in, val) {
+				return true
+			}
+		}
+		return false
+	case reflect.UnsafePointer:
+		if val.IsNil() {
+			return true
+		}
+
+		var elem = val.Elem()
+
+		if isSimpleType(elem, elem.Kind(), pointers, interfaces) {
+			return true
+		}
+
+		var addr = val.Elem().UnsafeAddr()
+
+		for p := *pointers; p != nil; p = p.prev {
+			if addr == p.addr {
+				return true
+			}
+		}
+
+		return false
+	}
+
+	return false
+}
+
+// dump value
+func printKeyValue(buf *bytes.Buffer, val reflect.Value, pointers **pointerInfo, interfaces *[]reflect.Value, structFilter func(string, string) bool, formatOutput bool, indent string, level int) {
+	var t = val.Kind()
+
+	switch t {
+	case reflect.Bool:
+		fmt.Fprint(buf, val.Bool())
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		fmt.Fprint(buf, val.Int())
+	case reflect.Uint8, reflect.Uint16, reflect.Uint, reflect.Uint32, reflect.Uint64:
+		fmt.Fprint(buf, val.Uint())
+	case reflect.Float32, reflect.Float64:
+		fmt.Fprint(buf, val.Float())
+	case reflect.Complex64, reflect.Complex128:
+		fmt.Fprint(buf, val.Complex())
+	case reflect.UnsafePointer:
+		fmt.Fprintf(buf, "unsafe.Pointer(0x%X)", val.Pointer())
+	case reflect.Ptr:
+		if val.IsNil() {
+			fmt.Fprint(buf, "nil")
+			return
+		}
+
+		var addr = val.Elem().UnsafeAddr()
+
+		for p := *pointers; p != nil; p = p.prev {
+			if addr == p.addr {
+				p.used = append(p.used, buf.Len())
+				fmt.Fprintf(buf, "0x%X", addr)
+				return
+			}
+		}
+
+		*pointers = &pointerInfo{
+			prev: *pointers,
+			addr: addr,
+			pos:  buf.Len(),
+			used: make([]int, 0),
+		}
+
+		fmt.Fprint(buf, "&")
+
+		printKeyValue(buf, val.Elem(), pointers, interfaces, structFilter, formatOutput, indent, level)
+	case reflect.String:
+		fmt.Fprint(buf, "\"", val.String(), "\"")
+	case reflect.Interface:
+		var value = val.Elem()
+
+		if !value.IsValid() {
+			fmt.Fprint(buf, "nil")
+		} else {
+			for _, in := range *interfaces {
+				if reflect.DeepEqual(in, val) {
+					fmt.Fprint(buf, "repeat")
+					return
+				}
+			}
+
+			*interfaces = append(*interfaces, val)
+
+			printKeyValue(buf, value, pointers, interfaces, structFilter, formatOutput, indent, level+1)
+		}
+	case reflect.Struct:
+		var t = val.Type()
+
+		fmt.Fprint(buf, t)
+		fmt.Fprint(buf, "{")
+
+		for i := 0; i < val.NumField(); i++ {
+			if formatOutput {
+				fmt.Fprintln(buf)
+			} else {
+				fmt.Fprint(buf, " ")
+			}
+
+			var name = t.Field(i).Name
+
+			if formatOutput {
+				for ind := 0; ind < level; ind++ {
+					fmt.Fprint(buf, indent)
+				}
+			}
+
+			fmt.Fprint(buf, name)
+			fmt.Fprint(buf, ": ")
+
+			if structFilter != nil && structFilter(t.String(), name) {
+				fmt.Fprint(buf, "ignore")
+			} else {
+				printKeyValue(buf, val.Field(i), pointers, interfaces, structFilter, formatOutput, indent, level+1)
+			}
+
+			fmt.Fprint(buf, ",")
+		}
+
+		if formatOutput {
+			fmt.Fprintln(buf)
+
+			for ind := 0; ind < level-1; ind++ {
+				fmt.Fprint(buf, indent)
+			}
+		} else {
+			fmt.Fprint(buf, " ")
+		}
+
+		fmt.Fprint(buf, "}")
+	case reflect.Array, reflect.Slice:
+		fmt.Fprint(buf, val.Type())
+		fmt.Fprint(buf, "{")
+
+		var allSimple = true
+
+		for i := 0; i < val.Len(); i++ {
+			var elem = val.Index(i)
+
+			var isSimple = isSimpleType(elem, elem.Kind(), pointers, interfaces)
+
+			if !isSimple {
+				allSimple = false
+			}
+
+			if formatOutput && !isSimple {
+				fmt.Fprintln(buf)
+			} else {
+				fmt.Fprint(buf, " ")
+			}
+
+			if formatOutput && !isSimple {
+				for ind := 0; ind < level; ind++ {
+					fmt.Fprint(buf, indent)
+				}
+			}
+
+			printKeyValue(buf, elem, pointers, interfaces, structFilter, formatOutput, indent, level+1)
+
+			if i != val.Len()-1 || !allSimple {
+				fmt.Fprint(buf, ",")
+			}
+		}
+
+		if formatOutput && !allSimple {
+			fmt.Fprintln(buf)
+
+			for ind := 0; ind < level-1; ind++ {
+				fmt.Fprint(buf, indent)
+			}
+		} else {
+			fmt.Fprint(buf, " ")
+		}
+
+		fmt.Fprint(buf, "}")
+	case reflect.Map:
+		var t = val.Type()
+		var keys = val.MapKeys()
+
+		fmt.Fprint(buf, t)
+		fmt.Fprint(buf, "{")
+
+		var allSimple = true
+
+		for i := 0; i < len(keys); i++ {
+			var elem = val.MapIndex(keys[i])
+
+			var isSimple = isSimpleType(elem, elem.Kind(), pointers, interfaces)
+
+			if !isSimple {
+				allSimple = false
+			}
+
+			if formatOutput && !isSimple {
+				fmt.Fprintln(buf)
+			} else {
+				fmt.Fprint(buf, " ")
+			}
+
+			if formatOutput && !isSimple {
+				for ind := 0; ind <= level; ind++ {
+					fmt.Fprint(buf, indent)
+				}
+			}
+
+			printKeyValue(buf, keys[i], pointers, interfaces, structFilter, formatOutput, indent, level+1)
+			fmt.Fprint(buf, ": ")
+			printKeyValue(buf, elem, pointers, interfaces, structFilter, formatOutput, indent, level+1)
+
+			if i != val.Len()-1 || !allSimple {
+				fmt.Fprint(buf, ",")
+			}
+		}
+
+		if formatOutput && !allSimple {
+			fmt.Fprintln(buf)
+
+			for ind := 0; ind < level-1; ind++ {
+				fmt.Fprint(buf, indent)
+			}
+		} else {
+			fmt.Fprint(buf, " ")
+		}
+
+		fmt.Fprint(buf, "}")
+	case reflect.Chan:
+		fmt.Fprint(buf, val.Type())
+	case reflect.Invalid:
+		fmt.Fprint(buf, "invalid")
+	default:
+		fmt.Fprint(buf, "unknow")
+	}
+}
+
+// PrintPointerInfo dump pointer value
+func PrintPointerInfo(buf *bytes.Buffer, headlen int, pointers *pointerInfo) {
+	var anyused = false
+	var pointerNum = 0
+
+	for p := pointers; p != nil; p = p.prev {
+		if len(p.used) > 0 {
+			anyused = true
+		}
+		pointerNum++
+		p.n = pointerNum
+	}
+
+	if anyused {
+		var pointerBufs = make([][]rune, pointerNum+1)
+
+		for i := 0; i < len(pointerBufs); i++ {
+			var pointerBuf = make([]rune, buf.Len()+headlen)
+
+			for j := 0; j < len(pointerBuf); j++ {
+				pointerBuf[j] = ' '
+			}
+
+			pointerBufs[i] = pointerBuf
+		}
+
+		for pn := 0; pn <= pointerNum; pn++ {
+			for p := pointers; p != nil; p = p.prev {
+				if len(p.used) > 0 && p.n >= pn {
+					if pn == p.n {
+						pointerBufs[pn][p.pos+headlen] = '└'
+
+						var maxpos = 0
+
+						for i, pos := range p.used {
+							if i < len(p.used)-1 {
+								pointerBufs[pn][pos+headlen] = '┴'
+							} else {
+								pointerBufs[pn][pos+headlen] = '┘'
+							}
+
+							maxpos = pos
+						}
+
+						for i := 0; i < maxpos-p.pos-1; i++ {
+							if pointerBufs[pn][i+p.pos+headlen+1] == ' ' {
+								pointerBufs[pn][i+p.pos+headlen+1] = '─'
+							}
+						}
+					} else {
+						pointerBufs[pn][p.pos+headlen] = '│'
+
+						for _, pos := range p.used {
+							if pointerBufs[pn][pos+headlen] == ' ' {
+								pointerBufs[pn][pos+headlen] = '│'
+							} else {
+								pointerBufs[pn][pos+headlen] = '┼'
+							}
+						}
+					}
+				}
+			}
+
+			buf.WriteString(string(pointerBufs[pn]) + "\n")
+		}
+	}
+}
+
+// Stack get stack bytes
+func Stack(skip int, indent string) []byte {
+	var buf = new(bytes.Buffer)
+
+	for i := skip; ; i++ {
+		var pc, file, line, ok = runtime.Caller(i)
+
+		if !ok {
+			break
+		}
+
+		buf.WriteString(indent)
+
+		fmt.Fprintf(buf, "at %s() [%s:%d]\n", function(pc), file, line)
+	}
+
+	return buf.Bytes()
+}
+
+// return the name of the function containing the PC if possible,
+func function(pc uintptr) []byte {
+	fn := runtime.FuncForPC(pc)
+	if fn == nil {
+		return dunno
+	}
+	name := []byte(fn.Name())
+	// The name includes the path name to the package, which is unnecessary
+	// since the file name is already included.  Plus, it has center dots.
+	// That is, we see
+	//	runtime/debug.*T·ptrmethod
+	// and want
+	//	*T.ptrmethod
+	if period := bytes.Index(name, dot); period >= 0 {
+		name = name[period+1:]
+	}
+	name = bytes.Replace(name, centerDot, dot, -1)
+	return name
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/utils/file.go

@@ -0,0 +1,101 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package utils
+
+import (
+	"bufio"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"regexp"
+)
+
+// SelfPath gets compiled executable file absolute path
+func SelfPath() string {
+	path, _ := filepath.Abs(os.Args[0])
+	return path
+}
+
+// SelfDir gets compiled executable file directory
+func SelfDir() string {
+	return filepath.Dir(SelfPath())
+}
+
+// FileExists reports whether the named file or directory exists.
+func FileExists(name string) bool {
+	if _, err := os.Stat(name); err != nil {
+		if os.IsNotExist(err) {
+			return false
+		}
+	}
+	return true
+}
+
+// SearchFile Search a file in paths.
+// this is often used in search config file in /etc ~/
+func SearchFile(filename string, paths ...string) (fullpath string, err error) {
+	for _, path := range paths {
+		if fullpath = filepath.Join(path, filename); FileExists(fullpath) {
+			return
+		}
+	}
+	err = errors.New(fullpath + " not found in paths")
+	return
+}
+
+// GrepFile like command grep -E
+// for example: GrepFile(`^hello`, "hello.txt")
+// \n is striped while read
+func GrepFile(patten string, filename string) (lines []string, err error) {
+	re, err := regexp.Compile(patten)
+	if err != nil {
+		return
+	}
+
+	fd, err := os.Open(filename)
+	if err != nil {
+		return
+	}
+	lines = make([]string, 0)
+	reader := bufio.NewReader(fd)
+	prefix := ""
+	var isLongLine bool
+	for {
+		byteLine, isPrefix, er := reader.ReadLine()
+		if er != nil && er != io.EOF {
+			return nil, er
+		}
+		if er == io.EOF {
+			break
+		}
+		line := string(byteLine)
+		if isPrefix {
+			prefix += line
+			continue
+		} else {
+			isLongLine = true
+		}
+
+		line = prefix + line
+		if isLongLine {
+			prefix = ""
+		}
+		if re.MatchString(line) {
+			lines = append(lines, line)
+		}
+	}
+	return lines, nil
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/utils/mail.go

@@ -0,0 +1,424 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package utils
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"mime/multipart"
+	"net/mail"
+	"net/smtp"
+	"net/textproto"
+	"os"
+	"path"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+const (
+	maxLineLength = 76
+
+	upperhex = "0123456789ABCDEF"
+)
+
+// Email is the type used for email messages
+type Email struct {
+	Auth        smtp.Auth
+	Identity    string `json:"identity"`
+	Username    string `json:"username"`
+	Password    string `json:"password"`
+	Host        string `json:"host"`
+	Port        int    `json:"port"`
+	From        string `json:"from"`
+	To          []string
+	Bcc         []string
+	Cc          []string
+	Subject     string
+	Text        string // Plaintext message (optional)
+	HTML        string // Html message (optional)
+	Headers     textproto.MIMEHeader
+	Attachments []*Attachment
+	ReadReceipt []string
+}
+
+// Attachment is a struct representing an email attachment.
+// Based on the mime/multipart.FileHeader struct, Attachment contains the name, MIMEHeader, and content of the attachment in question
+type Attachment struct {
+	Filename string
+	Header   textproto.MIMEHeader
+	Content  []byte
+}
+
+// NewEMail create new Email struct with config json.
+// config json is followed from Email struct fields.
+func NewEMail(config string) *Email {
+	e := new(Email)
+	e.Headers = textproto.MIMEHeader{}
+	err := json.Unmarshal([]byte(config), e)
+	if err != nil {
+		return nil
+	}
+	return e
+}
+
+// Bytes Make all send information to byte
+func (e *Email) Bytes() ([]byte, error) {
+	buff := &bytes.Buffer{}
+	w := multipart.NewWriter(buff)
+	// Set the appropriate headers (overwriting any conflicts)
+	// Leave out Bcc (only included in envelope headers)
+	e.Headers.Set("To", strings.Join(e.To, ","))
+	if e.Cc != nil {
+		e.Headers.Set("Cc", strings.Join(e.Cc, ","))
+	}
+	e.Headers.Set("From", e.From)
+	e.Headers.Set("Subject", e.Subject)
+	if len(e.ReadReceipt) != 0 {
+		e.Headers.Set("Disposition-Notification-To", strings.Join(e.ReadReceipt, ","))
+	}
+	e.Headers.Set("MIME-Version", "1.0")
+
+	// Write the envelope headers (including any custom headers)
+	if err := headerToBytes(buff, e.Headers); err != nil {
+		return nil, fmt.Errorf("Failed to render message headers: %s", err)
+	}
+
+	e.Headers.Set("Content-Type", fmt.Sprintf("multipart/mixed;\r\n boundary=%s\r\n", w.Boundary()))
+	fmt.Fprintf(buff, "%s:", "Content-Type")
+	fmt.Fprintf(buff, " %s\r\n", fmt.Sprintf("multipart/mixed;\r\n boundary=%s\r\n", w.Boundary()))
+
+	// Start the multipart/mixed part
+	fmt.Fprintf(buff, "--%s\r\n", w.Boundary())
+	header := textproto.MIMEHeader{}
+	// Check to see if there is a Text or HTML field
+	if e.Text != "" || e.HTML != "" {
+		subWriter := multipart.NewWriter(buff)
+		// Create the multipart alternative part
+		header.Set("Content-Type", fmt.Sprintf("multipart/alternative;\r\n boundary=%s\r\n", subWriter.Boundary()))
+		// Write the header
+		if err := headerToBytes(buff, header); err != nil {
+			return nil, fmt.Errorf("Failed to render multipart message headers: %s", err)
+		}
+		// Create the body sections
+		if e.Text != "" {
+			header.Set("Content-Type", fmt.Sprintf("text/plain; charset=UTF-8"))
+			header.Set("Content-Transfer-Encoding", "quoted-printable")
+			if _, err := subWriter.CreatePart(header); err != nil {
+				return nil, err
+			}
+			// Write the text
+			if err := quotePrintEncode(buff, e.Text); err != nil {
+				return nil, err
+			}
+		}
+		if e.HTML != "" {
+			header.Set("Content-Type", fmt.Sprintf("text/html; charset=UTF-8"))
+			header.Set("Content-Transfer-Encoding", "quoted-printable")
+			if _, err := subWriter.CreatePart(header); err != nil {
+				return nil, err
+			}
+			// Write the text
+			if err := quotePrintEncode(buff, e.HTML); err != nil {
+				return nil, err
+			}
+		}
+		if err := subWriter.Close(); err != nil {
+			return nil, err
+		}
+	}
+	// Create attachment part, if necessary
+	for _, a := range e.Attachments {
+		ap, err := w.CreatePart(a.Header)
+		if err != nil {
+			return nil, err
+		}
+		// Write the base64Wrapped content to the part
+		base64Wrap(ap, a.Content)
+	}
+	if err := w.Close(); err != nil {
+		return nil, err
+	}
+	return buff.Bytes(), nil
+}
+
+// AttachFile Add attach file to the send mail
+func (e *Email) AttachFile(args ...string) (a *Attachment, err error) {
+	if len(args) < 1 || len(args) > 2 { // change && to ||
+		err = errors.New("Must specify a file name and number of parameters can not exceed at least two")
+		return
+	}
+	filename := args[0]
+	id := ""
+	if len(args) > 1 {
+		id = args[1]
+	}
+	f, err := os.Open(filename)
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	ct := mime.TypeByExtension(filepath.Ext(filename))
+	basename := path.Base(filename)
+	return e.Attach(f, basename, ct, id)
+}
+
+// Attach is used to attach content from an io.Reader to the email.
+// Parameters include an io.Reader, the desired filename for the attachment, and the Content-Type.
+func (e *Email) Attach(r io.Reader, filename string, args ...string) (a *Attachment, err error) {
+	if len(args) < 1 || len(args) > 2 { // change && to ||
+		err = errors.New("Must specify the file type and number of parameters can not exceed at least two")
+		return
+	}
+	c := args[0] //Content-Type
+	id := ""
+	if len(args) > 1 {
+		id = args[1] //Content-ID
+	}
+	var buffer bytes.Buffer
+	if _, err = io.Copy(&buffer, r); err != nil {
+		return
+	}
+	at := &Attachment{
+		Filename: filename,
+		Header:   textproto.MIMEHeader{},
+		Content:  buffer.Bytes(),
+	}
+	// Get the Content-Type to be used in the MIMEHeader
+	if c != "" {
+		at.Header.Set("Content-Type", c)
+	} else {
+		// If the Content-Type is blank, set the Content-Type to "application/octet-stream"
+		at.Header.Set("Content-Type", "application/octet-stream")
+	}
+	if id != "" {
+		at.Header.Set("Content-Disposition", fmt.Sprintf("inline;\r\n filename=\"%s\"", filename))
+		at.Header.Set("Content-ID", fmt.Sprintf("<%s>", id))
+	} else {
+		at.Header.Set("Content-Disposition", fmt.Sprintf("attachment;\r\n filename=\"%s\"", filename))
+	}
+	at.Header.Set("Content-Transfer-Encoding", "base64")
+	e.Attachments = append(e.Attachments, at)
+	return at, nil
+}
+
+// Send will send out the mail
+func (e *Email) Send() error {
+	if e.Auth == nil {
+		e.Auth = smtp.PlainAuth(e.Identity, e.Username, e.Password, e.Host)
+	}
+	// Merge the To, Cc, and Bcc fields
+	to := make([]string, 0, len(e.To)+len(e.Cc)+len(e.Bcc))
+	to = append(append(append(to, e.To...), e.Cc...), e.Bcc...)
+	// Check to make sure there is at least one recipient and one "From" address
+	if len(to) == 0 {
+		return errors.New("Must specify at least one To address")
+	}
+
+	// Use the username if no From is provided
+	if len(e.From) == 0 {
+		e.From = e.Username
+	}
+
+	from, err := mail.ParseAddress(e.From)
+	if err != nil {
+		return err
+	}
+
+	// use mail's RFC 2047 to encode any string
+	e.Subject = qEncode("utf-8", e.Subject)
+
+	raw, err := e.Bytes()
+	if err != nil {
+		return err
+	}
+	return smtp.SendMail(e.Host+":"+strconv.Itoa(e.Port), e.Auth, from.Address, to, raw)
+}
+
+// quotePrintEncode writes the quoted-printable text to the IO Writer (according to RFC 2045)
+func quotePrintEncode(w io.Writer, s string) error {
+	var buf [3]byte
+	mc := 0
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		// We're assuming Unix style text formats as input (LF line break), and
+		// quoted-printble uses CRLF line breaks. (Literal CRs will become
+		// "=0D", but probably shouldn't be there to begin with!)
+		if c == '\n' {
+			io.WriteString(w, "\r\n")
+			mc = 0
+			continue
+		}
+
+		var nextOut []byte
+		if isPrintable(c) {
+			nextOut = append(buf[:0], c)
+		} else {
+			nextOut = buf[:]
+			qpEscape(nextOut, c)
+		}
+
+		// Add a soft line break if the next (encoded) byte would push this line
+		// to or past the limit.
+		if mc+len(nextOut) >= maxLineLength {
+			if _, err := io.WriteString(w, "=\r\n"); err != nil {
+				return err
+			}
+			mc = 0
+		}
+
+		if _, err := w.Write(nextOut); err != nil {
+			return err
+		}
+		mc += len(nextOut)
+	}
+	// No trailing end-of-line?? Soft line break, then. TODO: is this sane?
+	if mc > 0 {
+		io.WriteString(w, "=\r\n")
+	}
+	return nil
+}
+
+// isPrintable returns true if the rune given is "printable" according to RFC 2045, false otherwise
+func isPrintable(c byte) bool {
+	return (c >= '!' && c <= '<') || (c >= '>' && c <= '~') || (c == ' ' || c == '\n' || c == '\t')
+}
+
+// qpEscape is a helper function for quotePrintEncode which escapes a
+// non-printable byte. Expects len(dest) == 3.
+func qpEscape(dest []byte, c byte) {
+	const nums = "0123456789ABCDEF"
+	dest[0] = '='
+	dest[1] = nums[(c&0xf0)>>4]
+	dest[2] = nums[(c & 0xf)]
+}
+
+// headerToBytes enumerates the key and values in the header, and writes the results to the IO Writer
+func headerToBytes(w io.Writer, t textproto.MIMEHeader) error {
+	for k, v := range t {
+		// Write the header key
+		_, err := fmt.Fprintf(w, "%s:", k)
+		if err != nil {
+			return err
+		}
+		// Write each value in the header
+		for _, c := range v {
+			_, err := fmt.Fprintf(w, " %s\r\n", c)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// base64Wrap encodes the attachment content, and wraps it according to RFC 2045 standards (every 76 chars)
+// The output is then written to the specified io.Writer
+func base64Wrap(w io.Writer, b []byte) {
+	// 57 raw bytes per 76-byte base64 line.
+	const maxRaw = 57
+	// Buffer for each line, including trailing CRLF.
+	var buffer [maxLineLength + len("\r\n")]byte
+	copy(buffer[maxLineLength:], "\r\n")
+	// Process raw chunks until there's no longer enough to fill a line.
+	for len(b) >= maxRaw {
+		base64.StdEncoding.Encode(buffer[:], b[:maxRaw])
+		w.Write(buffer[:])
+		b = b[maxRaw:]
+	}
+	// Handle the last chunk of bytes.
+	if len(b) > 0 {
+		out := buffer[:base64.StdEncoding.EncodedLen(len(b))]
+		base64.StdEncoding.Encode(out, b)
+		out = append(out, "\r\n"...)
+		w.Write(out)
+	}
+}
+
+// Encode returns the encoded-word form of s. If s is ASCII without special
+// characters, it is returned unchanged. The provided charset is the IANA
+// charset name of s. It is case insensitive.
+// RFC 2047 encoded-word
+func qEncode(charset, s string) string {
+	if !needsEncoding(s) {
+		return s
+	}
+	return encodeWord(charset, s)
+}
+
+func needsEncoding(s string) bool {
+	for _, b := range s {
+		if (b < ' ' || b > '~') && b != '\t' {
+			return true
+		}
+	}
+	return false
+}
+
+// encodeWord encodes a string into an encoded-word.
+func encodeWord(charset, s string) string {
+	buf := getBuffer()
+
+	buf.WriteString("=?")
+	buf.WriteString(charset)
+	buf.WriteByte('?')
+	buf.WriteByte('q')
+	buf.WriteByte('?')
+
+	enc := make([]byte, 3)
+	for i := 0; i < len(s); i++ {
+		b := s[i]
+		switch {
+		case b == ' ':
+			buf.WriteByte('_')
+		case b <= '~' && b >= '!' && b != '=' && b != '?' && b != '_':
+			buf.WriteByte(b)
+		default:
+			enc[0] = '='
+			enc[1] = upperhex[b>>4]
+			enc[2] = upperhex[b&0x0f]
+			buf.Write(enc)
+		}
+	}
+	buf.WriteString("?=")
+
+	es := buf.String()
+	putBuffer(buf)
+	return es
+}
+
+var bufPool = sync.Pool{
+	New: func() interface{} {
+		return new(bytes.Buffer)
+	},
+}
+
+func getBuffer() *bytes.Buffer {
+	return bufPool.Get().(*bytes.Buffer)
+}
+
+func putBuffer(buf *bytes.Buffer) {
+	if buf.Len() > 1024 {
+		return
+	}
+	buf.Reset()
+	bufPool.Put(buf)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/utils/rand.go

@@ -0,0 +1,44 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package utils
+
+import (
+	"crypto/rand"
+	r "math/rand"
+	"time"
+)
+
+var alphaNum = []byte(`0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz`)
+
+// RandomCreateBytes generate random []byte by specify chars.
+func RandomCreateBytes(n int, alphabets ...byte) []byte {
+	if len(alphabets) == 0 {
+		alphabets = alphaNum
+	}
+	var bytes = make([]byte, n)
+	var randBy bool
+	if num, err := rand.Read(bytes); num != n || err != nil {
+		r.Seed(time.Now().UnixNano())
+		randBy = true
+	}
+	for i, b := range bytes {
+		if randBy {
+			bytes[i] = alphabets[r.Intn(len(alphabets))]
+		} else {
+			bytes[i] = alphabets[b%byte(len(alphabets))]
+		}
+	}
+	return bytes
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/utils/safemap.go

@@ -0,0 +1,91 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package utils
+
+import (
+	"sync"
+)
+
+// BeeMap is a map with lock
+type BeeMap struct {
+	lock *sync.RWMutex
+	bm   map[interface{}]interface{}
+}
+
+// NewBeeMap return new safemap
+func NewBeeMap() *BeeMap {
+	return &BeeMap{
+		lock: new(sync.RWMutex),
+		bm:   make(map[interface{}]interface{}),
+	}
+}
+
+// Get from maps return the k's value
+func (m *BeeMap) Get(k interface{}) interface{} {
+	m.lock.RLock()
+	defer m.lock.RUnlock()
+	if val, ok := m.bm[k]; ok {
+		return val
+	}
+	return nil
+}
+
+// Set Maps the given key and value. Returns false
+// if the key is already in the map and changes nothing.
+func (m *BeeMap) Set(k interface{}, v interface{}) bool {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+	if val, ok := m.bm[k]; !ok {
+		m.bm[k] = v
+	} else if val != v {
+		m.bm[k] = v
+	} else {
+		return false
+	}
+	return true
+}
+
+// Check Returns true if k is exist in the map.
+func (m *BeeMap) Check(k interface{}) bool {
+	m.lock.RLock()
+	defer m.lock.RUnlock()
+	_, ok := m.bm[k]
+	return ok
+}
+
+// Delete the given key and value.
+func (m *BeeMap) Delete(k interface{}) {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+	delete(m.bm, k)
+}
+
+// Items returns all items in safemap.
+func (m *BeeMap) Items() map[interface{}]interface{} {
+	m.lock.RLock()
+	defer m.lock.RUnlock()
+	r := make(map[interface{}]interface{})
+	for k, v := range m.bm {
+		r[k] = v
+	}
+	return r
+}
+
+// Count returns the number of items within the map.
+func (m *BeeMap) Count() int {
+	m.lock.RLock()
+	defer m.lock.RUnlock()
+	return len(m.bm)
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/utils/slice.go

@@ -0,0 +1,170 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package utils
+
+import (
+	"math/rand"
+	"time"
+)
+
+type reducetype func(interface{}) interface{}
+type filtertype func(interface{}) bool
+
+// InSlice checks given string in string slice or not.
+func InSlice(v string, sl []string) bool {
+	for _, vv := range sl {
+		if vv == v {
+			return true
+		}
+	}
+	return false
+}
+
+// InSliceIface checks given interface in interface slice.
+func InSliceIface(v interface{}, sl []interface{}) bool {
+	for _, vv := range sl {
+		if vv == v {
+			return true
+		}
+	}
+	return false
+}
+
+// SliceRandList generate an int slice from min to max.
+func SliceRandList(min, max int) []int {
+	if max < min {
+		min, max = max, min
+	}
+	length := max - min + 1
+	t0 := time.Now()
+	rand.Seed(int64(t0.Nanosecond()))
+	list := rand.Perm(length)
+	for index := range list {
+		list[index] += min
+	}
+	return list
+}
+
+// SliceMerge merges interface slices to one slice.
+func SliceMerge(slice1, slice2 []interface{}) (c []interface{}) {
+	c = append(slice1, slice2...)
+	return
+}
+
+// SliceReduce generates a new slice after parsing every value by reduce function
+func SliceReduce(slice []interface{}, a reducetype) (dslice []interface{}) {
+	for _, v := range slice {
+		dslice = append(dslice, a(v))
+	}
+	return
+}
+
+// SliceRand returns random one from slice.
+func SliceRand(a []interface{}) (b interface{}) {
+	randnum := rand.Intn(len(a))
+	b = a[randnum]
+	return
+}
+
+// SliceSum sums all values in int64 slice.
+func SliceSum(intslice []int64) (sum int64) {
+	for _, v := range intslice {
+		sum += v
+	}
+	return
+}
+
+// SliceFilter generates a new slice after filter function.
+func SliceFilter(slice []interface{}, a filtertype) (ftslice []interface{}) {
+	for _, v := range slice {
+		if a(v) {
+			ftslice = append(ftslice, v)
+		}
+	}
+	return
+}
+
+// SliceDiff returns diff slice of slice1 - slice2.
+func SliceDiff(slice1, slice2 []interface{}) (diffslice []interface{}) {
+	for _, v := range slice1 {
+		if !InSliceIface(v, slice2) {
+			diffslice = append(diffslice, v)
+		}
+	}
+	return
+}
+
+// SliceIntersect returns slice that are present in all the slice1 and slice2.
+func SliceIntersect(slice1, slice2 []interface{}) (diffslice []interface{}) {
+	for _, v := range slice1 {
+		if InSliceIface(v, slice2) {
+			diffslice = append(diffslice, v)
+		}
+	}
+	return
+}
+
+// SliceChunk separates one slice to some sized slice.
+func SliceChunk(slice []interface{}, size int) (chunkslice [][]interface{}) {
+	if size >= len(slice) {
+		chunkslice = append(chunkslice, slice)
+		return
+	}
+	end := size
+	for i := 0; i <= (len(slice) - size); i += size {
+		chunkslice = append(chunkslice, slice[i:end])
+		end += size
+	}
+	return
+}
+
+// SliceRange generates a new slice from begin to end with step duration of int64 number.
+func SliceRange(start, end, step int64) (intslice []int64) {
+	for i := start; i <= end; i += step {
+		intslice = append(intslice, i)
+	}
+	return
+}
+
+// SlicePad prepends size number of val into slice.
+func SlicePad(slice []interface{}, size int, val interface{}) []interface{} {
+	if size <= len(slice) {
+		return slice
+	}
+	for i := 0; i < (size - len(slice)); i++ {
+		slice = append(slice, val)
+	}
+	return slice
+}
+
+// SliceUnique cleans repeated values in slice.
+func SliceUnique(slice []interface{}) (uniqueslice []interface{}) {
+	for _, v := range slice {
+		if !InSliceIface(v, uniqueslice) {
+			uniqueslice = append(uniqueslice, v)
+		}
+	}
+	return
+}
+
+// SliceShuffle shuffles a slice.
+func SliceShuffle(slice []interface{}) []interface{} {
+	for i := 0; i < len(slice); i++ {
+		a := rand.Intn(len(slice))
+		b := rand.Intn(len(slice))
+		slice[a], slice[b] = slice[b], slice[a]
+	}
+	return slice
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/utils/stub.go

@@ -0,0 +1,10 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for github.com/astaxie/beego/utils, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: github.com/astaxie/beego/utils (exports: ; functions: Display)
+
+// Package utils is a stub of github.com/astaxie/beego/utils, generated by depstubber.
+package utils
+
+func Display(_ ...interface{}) {}

ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/utils/utils.go

@@ -0,0 +1,89 @@
+package utils
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strconv"
+	"strings"
+)
+
+// GetGOPATHs returns all paths in GOPATH variable.
+func GetGOPATHs() []string {
+	gopath := os.Getenv("GOPATH")
+	if gopath == "" && compareGoVersion(runtime.Version(), "go1.8") >= 0 {
+		gopath = defaultGOPATH()
+	}
+	return filepath.SplitList(gopath)
+}
+
+func compareGoVersion(a, b string) int {
+	reg := regexp.MustCompile("^\\d*")
+
+	a = strings.TrimPrefix(a, "go")
+	b = strings.TrimPrefix(b, "go")
+
+	versionsA := strings.Split(a, ".")
+	versionsB := strings.Split(b, ".")
+
+	for i := 0; i < len(versionsA) && i < len(versionsB); i++ {
+		versionA := versionsA[i]
+		versionB := versionsB[i]
+
+		vA, err := strconv.Atoi(versionA)
+		if err != nil {
+			str := reg.FindString(versionA)
+			if str != "" {
+				vA, _ = strconv.Atoi(str)
+			} else {
+				vA = -1
+			}
+		}
+
+		vB, err := strconv.Atoi(versionB)
+		if err != nil {
+			str := reg.FindString(versionB)
+			if str != "" {
+				vB, _ = strconv.Atoi(str)
+			} else {
+				vB = -1
+			}
+		}
+
+		if vA > vB {
+			// vA = 12, vB = 8
+			return 1
+		} else if vA < vB {
+			// vA = 6, vB = 8
+			return -1
+		} else if vA == -1 {
+			// vA = rc1, vB = rc3
+			return strings.Compare(versionA, versionB)
+		}
+
+		// vA = vB = 8
+		continue
+	}
+
+	if len(versionsA) > len(versionsB) {
+		return 1
+	} else if len(versionsA) == len(versionsB) {
+		return 0
+	}
+
+	return -1
+}
+
+func defaultGOPATH() string {
+	env := "HOME"
+	if runtime.GOOS == "windows" {
+		env = "USERPROFILE"
+	} else if runtime.GOOS == "plan9" {
+		env = "home"
+	}
+	if home := os.Getenv(env); home != "" {
+		return filepath.Join(home, "go")
+	}
+	return ""
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/beorn7/perks/LICENSE

@@ -0,0 +1,20 @@
+Copyright (C) 2013 Blake Mizerany
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

ql/test/query-tests/Security/CWE-117/vendor/github.com/beorn7/perks/quantile/stream.go

@@ -0,0 +1,316 @@
+// Package quantile computes approximate quantiles over an unbounded data
+// stream within low memory and CPU bounds.
+//
+// A small amount of accuracy is traded to achieve the above properties.
+//
+// Multiple streams can be merged before calling Query to generate a single set
+// of results. This is meaningful when the streams represent the same type of
+// data. See Merge and Samples.
+//
+// For more detailed information about the algorithm used, see:
+//
+// Effective Computation of Biased Quantiles over Data Streams
+//
+// http://www.cs.rutgers.edu/~muthu/bquant.pdf
+package quantile
+
+import (
+	"math"
+	"sort"
+)
+
+// Sample holds an observed value and meta information for compression. JSON
+// tags have been added for convenience.
+type Sample struct {
+	Value float64 `json:",string"`
+	Width float64 `json:",string"`
+	Delta float64 `json:",string"`
+}
+
+// Samples represents a slice of samples. It implements sort.Interface.
+type Samples []Sample
+
+func (a Samples) Len() int           { return len(a) }
+func (a Samples) Less(i, j int) bool { return a[i].Value < a[j].Value }
+func (a Samples) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
+
+type invariant func(s *stream, r float64) float64
+
+// NewLowBiased returns an initialized Stream for low-biased quantiles
+// (e.g. 0.01, 0.1, 0.5) where the needed quantiles are not known a priori, but
+// error guarantees can still be given even for the lower ranks of the data
+// distribution.
+//
+// The provided epsilon is a relative error, i.e. the true quantile of a value
+// returned by a query is guaranteed to be within (1±Epsilon)*Quantile.
+//
+// See http://www.cs.rutgers.edu/~muthu/bquant.pdf for time, space, and error
+// properties.
+func NewLowBiased(epsilon float64) *Stream {
+	ƒ := func(s *stream, r float64) float64 {
+		return 2 * epsilon * r
+	}
+	return newStream(ƒ)
+}
+
+// NewHighBiased returns an initialized Stream for high-biased quantiles
+// (e.g. 0.01, 0.1, 0.5) where the needed quantiles are not known a priori, but
+// error guarantees can still be given even for the higher ranks of the data
+// distribution.
+//
+// The provided epsilon is a relative error, i.e. the true quantile of a value
+// returned by a query is guaranteed to be within 1-(1±Epsilon)*(1-Quantile).
+//
+// See http://www.cs.rutgers.edu/~muthu/bquant.pdf for time, space, and error
+// properties.
+func NewHighBiased(epsilon float64) *Stream {
+	ƒ := func(s *stream, r float64) float64 {
+		return 2 * epsilon * (s.n - r)
+	}
+	return newStream(ƒ)
+}
+
+// NewTargeted returns an initialized Stream concerned with a particular set of
+// quantile values that are supplied a priori. Knowing these a priori reduces
+// space and computation time. The targets map maps the desired quantiles to
+// their absolute errors, i.e. the true quantile of a value returned by a query
+// is guaranteed to be within (Quantile±Epsilon).
+//
+// See http://www.cs.rutgers.edu/~muthu/bquant.pdf for time, space, and error properties.
+func NewTargeted(targetMap map[float64]float64) *Stream {
+	// Convert map to slice to avoid slow iterations on a map.
+	// ƒ is called on the hot path, so converting the map to a slice
+	// beforehand results in significant CPU savings.
+	targets := targetMapToSlice(targetMap)
+
+	ƒ := func(s *stream, r float64) float64 {
+		var m = math.MaxFloat64
+		var f float64
+		for _, t := range targets {
+			if t.quantile*s.n <= r {
+				f = (2 * t.epsilon * r) / t.quantile
+			} else {
+				f = (2 * t.epsilon * (s.n - r)) / (1 - t.quantile)
+			}
+			if f < m {
+				m = f
+			}
+		}
+		return m
+	}
+	return newStream(ƒ)
+}
+
+type target struct {
+	quantile float64
+	epsilon  float64
+}
+
+func targetMapToSlice(targetMap map[float64]float64) []target {
+	targets := make([]target, 0, len(targetMap))
+
+	for quantile, epsilon := range targetMap {
+		t := target{
+			quantile: quantile,
+			epsilon:  epsilon,
+		}
+		targets = append(targets, t)
+	}
+
+	return targets
+}
+
+// Stream computes quantiles for a stream of float64s. It is not thread-safe by
+// design. Take care when using across multiple goroutines.
+type Stream struct {
+	*stream
+	b      Samples
+	sorted bool
+}
+
+func newStream(ƒ invariant) *Stream {
+	x := &stream{ƒ: ƒ}
+	return &Stream{x, make(Samples, 0, 500), true}
+}
+
+// Insert inserts v into the stream.
+func (s *Stream) Insert(v float64) {
+	s.insert(Sample{Value: v, Width: 1})
+}
+
+func (s *Stream) insert(sample Sample) {
+	s.b = append(s.b, sample)
+	s.sorted = false
+	if len(s.b) == cap(s.b) {
+		s.flush()
+	}
+}
+
+// Query returns the computed qth percentiles value. If s was created with
+// NewTargeted, and q is not in the set of quantiles provided a priori, Query
+// will return an unspecified result.
+func (s *Stream) Query(q float64) float64 {
+	if !s.flushed() {
+		// Fast path when there hasn't been enough data for a flush;
+		// this also yields better accuracy for small sets of data.
+		l := len(s.b)
+		if l == 0 {
+			return 0
+		}
+		i := int(math.Ceil(float64(l) * q))
+		if i > 0 {
+			i -= 1
+		}
+		s.maybeSort()
+		return s.b[i].Value
+	}
+	s.flush()
+	return s.stream.query(q)
+}
+
+// Merge merges samples into the underlying streams samples. This is handy when
+// merging multiple streams from separate threads, database shards, etc.
+//
+// ATTENTION: This method is broken and does not yield correct results. The
+// underlying algorithm is not capable of merging streams correctly.
+func (s *Stream) Merge(samples Samples) {
+	sort.Sort(samples)
+	s.stream.merge(samples)
+}
+
+// Reset reinitializes and clears the list reusing the samples buffer memory.
+func (s *Stream) Reset() {
+	s.stream.reset()
+	s.b = s.b[:0]
+}
+
+// Samples returns stream samples held by s.
+func (s *Stream) Samples() Samples {
+	if !s.flushed() {
+		return s.b
+	}
+	s.flush()
+	return s.stream.samples()
+}
+
+// Count returns the total number of samples observed in the stream
+// since initialization.
+func (s *Stream) Count() int {
+	return len(s.b) + s.stream.count()
+}
+
+func (s *Stream) flush() {
+	s.maybeSort()
+	s.stream.merge(s.b)
+	s.b = s.b[:0]
+}
+
+func (s *Stream) maybeSort() {
+	if !s.sorted {
+		s.sorted = true
+		sort.Sort(s.b)
+	}
+}
+
+func (s *Stream) flushed() bool {
+	return len(s.stream.l) > 0
+}
+
+type stream struct {
+	n float64
+	l []Sample
+	ƒ invariant
+}
+
+func (s *stream) reset() {
+	s.l = s.l[:0]
+	s.n = 0
+}
+
+func (s *stream) insert(v float64) {
+	s.merge(Samples{{v, 1, 0}})
+}
+
+func (s *stream) merge(samples Samples) {
+	// TODO(beorn7): This tries to merge not only individual samples, but
+	// whole summaries. The paper doesn't mention merging summaries at
+	// all. Unittests show that the merging is inaccurate. Find out how to
+	// do merges properly.
+	var r float64
+	i := 0
+	for _, sample := range samples {
+		for ; i < len(s.l); i++ {
+			c := s.l[i]
+			if c.Value > sample.Value {
+				// Insert at position i.
+				s.l = append(s.l, Sample{})
+				copy(s.l[i+1:], s.l[i:])
+				s.l[i] = Sample{
+					sample.Value,
+					sample.Width,
+					math.Max(sample.Delta, math.Floor(s.ƒ(s, r))-1),
+					// TODO(beorn7): How to calculate delta correctly?
+				}
+				i++
+				goto inserted
+			}
+			r += c.Width
+		}
+		s.l = append(s.l, Sample{sample.Value, sample.Width, 0})
+		i++
+	inserted:
+		s.n += sample.Width
+		r += sample.Width
+	}
+	s.compress()
+}
+
+func (s *stream) count() int {
+	return int(s.n)
+}
+
+func (s *stream) query(q float64) float64 {
+	t := math.Ceil(q * s.n)
+	t += math.Ceil(s.ƒ(s, t) / 2)
+	p := s.l[0]
+	var r float64
+	for _, c := range s.l[1:] {
+		r += p.Width
+		if r+c.Width+c.Delta > t {
+			return p.Value
+		}
+		p = c
+	}
+	return p.Value
+}
+
+func (s *stream) compress() {
+	if len(s.l) < 2 {
+		return
+	}
+	x := s.l[len(s.l)-1]
+	xi := len(s.l) - 1
+	r := s.n - 1 - x.Width
+
+	for i := len(s.l) - 2; i >= 0; i-- {
+		c := s.l[i]
+		if c.Width+x.Width+x.Delta <= s.ƒ(s, r) {
+			x.Width += c.Width
+			s.l[xi] = x
+			// Remove element at i.
+			copy(s.l[i:], s.l[i+1:])
+			s.l = s.l[:len(s.l)-1]
+			xi -= 1
+		} else {
+			x = c
+			xi = i
+		}
+		r -= c.Width
+	}
+}
+
+func (s *stream) samples() Samples {
+	samples := make(Samples, len(s.l))
+	copy(samples, s.l)
+	return samples
+}

ql/test/query-tests/Security/CWE-117/vendor/github.com/cespare/xxhash/v2/.travis.yml

@@ -0,0 +1,8 @@
+language: go
+go:
+  - "1.x"
+  - master
+env:
+  - TAGS=""
+  - TAGS="-tags purego"
+script: go test $TAGS -v ./...

ql/test/query-tests/Security/CWE-117/vendor/github.com/cespare/xxhash/v2/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2016 Caleb Spare
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

ql/test/query-tests/Security/CWE-117/vendor/github.com/cespare/xxhash/v2/README.md

@@ -0,0 +1,67 @@
+# xxhash
+
+[![GoDoc](https://godoc.org/github.com/cespare/xxhash?status.svg)](https://godoc.org/github.com/cespare/xxhash)
+[![Build Status](https://travis-ci.org/cespare/xxhash.svg?branch=master)](https://travis-ci.org/cespare/xxhash)
+
+xxhash is a Go implementation of the 64-bit
+[xxHash](http://cyan4973.github.io/xxHash/) algorithm, XXH64. This is a
+high-quality hashing algorithm that is much faster than anything in the Go
+standard library.
+
+This package provides a straightforward API:
+
+```
+func Sum64(b []byte) uint64
+func Sum64String(s string) uint64
+type Digest struct{ ... }
+    func New() *Digest
+```
+
+The `Digest` type implements hash.Hash64. Its key methods are:
+
+```
+func (*Digest) Write([]byte) (int, error)
+func (*Digest) WriteString(string) (int, error)
+func (*Digest) Sum64() uint64
+```
+
+This implementation provides a fast pure-Go implementation and an even faster
+assembly implementation for amd64.
+
+## Compatibility
+
+This package is in a module and the latest code is in version 2 of the module.
+You need a version of Go with at least "minimal module compatibility" to use
+github.com/cespare/xxhash/v2:
+
+* 1.9.7+ for Go 1.9
+* 1.10.3+ for Go 1.10
+* Go 1.11 or later
+
+I recommend using the latest release of Go.
+
+## Benchmarks
+
+Here are some quick benchmarks comparing the pure-Go and assembly
+implementations of Sum64.
+
+| input size | purego | asm |
+| --- | --- | --- |
+| 5 B   |  979.66 MB/s |  1291.17 MB/s  |
+| 100 B | 7475.26 MB/s | 7973.40 MB/s  |
+| 4 KB  | 17573.46 MB/s | 17602.65 MB/s |
+| 10 MB | 17131.46 MB/s | 17142.16 MB/s |
+
+These numbers were generated on Ubuntu 18.04 with an Intel i7-8700K CPU using
+the following commands under Go 1.11.2:
+
+```
+$ go test -tags purego -benchtime 10s -bench '/xxhash,direct,bytes'
+$ go test -benchtime 10s -bench '/xxhash,direct,bytes'
+```
+
+## Projects using this package
+
+- [InfluxDB](https://github.com/influxdata/influxdb)
+- [Prometheus](https://github.com/prometheus/prometheus)
+- [FreeCache](https://github.com/coocood/freecache)

ql/test/query-tests/Security/CWE-117/vendor/github.com/cespare/xxhash/v2/go.mod

@@ -0,0 +1,3 @@
+module github.com/cespare/xxhash/v2
+
+go 1.11