codeql-go icon indicating copy to clipboard operation
codeql-go copied to clipboard

Go: add pgx sqli query

Open japroc opened this issue 4 years ago • 0 comments

Hello, team!

The idea of this PR is to improve default SqlInjection.ql query by adding github.com/jackc/pgx module and related.

I basically reused existing SqlInjection.ql query, and created a custom PgxSqlInjection.ql query. The CodeQL custom module with implements pgx sql argument is defined in Pgx.qll file. I think that pgx support should be implemented by extending SQL::QueryString.

Also i met stange behavior. When i create custom Query class by extending DataFlow::Node the query works fine. But when i extend SQL::QueryString. I do not understand why. Maybe you can support with that bug?

Thanks, Evgenii.

japroc avatar Nov 15 '21 18:11 japroc