Add missing tests and models for go-pg/pg/orm.Formatter

Author: smowton

go/ql/lib/ext/github.com.go-pg.pg.orm.model.yml

@@ -0,0 +1,11 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: summaryModel
+    data:
+      - ["github.com/go-pg/pg/$ANYVERSION/orm", "Formatter", True, "Append", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
+      - ["github.com/go-pg/pg/$ANYVERSION/orm", "Formatter", True, "Append", "", "", "Argument[1]", "Argument[0]", "taint", "manual"]
+      - ["github.com/go-pg/pg/$ANYVERSION/orm", "Formatter", True, "AppendBytes", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
+      - ["github.com/go-pg/pg/$ANYVERSION/orm", "Formatter", True, "AppendBytes", "", "", "Argument[1]", "Argument[0]", "taint", "manual"]
+      - ["github.com/go-pg/pg/$ANYVERSION/orm", "Formatter", True, "FormatQuery", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
+      - ["github.com/go-pg/pg/$ANYVERSION/orm", "Formatter", True, "FormatQuery", "", "", "Argument[1]", "Argument[0]", "taint", "manual"]

go/ql/test/library-tests/semmle/go/frameworks/SQL/QueryString.ql

@@ -32,3 +32,32 @@ class QueryString extends InlineExpectationsTest {
     )
   }
 }
+
+class Config extends TaintTracking::Configuration {
+  Config() { this = "pg-orm config" }
+
+  override predicate isSource(DataFlow::Node n) {
+    n.asExpr() instanceof StringLit
+  }
+
+  override predicate isSink(DataFlow::Node n) {
+    n = any(DataFlow::CallNode cn | cn.getTarget().getName() = "sink").getAnArgument()
+  }
+}
+
+class TaintFlow extends InlineExpectationsTest {
+  TaintFlow() { this = "pg-orm flow" }
+
+  override string getARelevantTag() { result = "flowfrom" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "flowfrom" and
+    element = "" and
+    exists(Config c, DataFlow::Node fromNode, DataFlow::Node toNode |
+      toNode.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
+        location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
+      c.hasFlow(fromNode, toNode) and
+      value = fromNode.asExpr().(StringLit).getValue()
+    )
+  }
+}

go/ql/test/library-tests/semmle/go/frameworks/SQL/pg.go

@@ -28,6 +28,9 @@ func newpgtest(query string, conn newpg.Conn, db newpg.DB, tx newpg.Tx) {
 	db.Prepare(query)   // $ querystring=query
 	tx.Prepare(query)   // $ querystring=query
 }
+
+func sink(x interface{}) { }
+
 func pgormtest(query string, q orm.Query) {
 	orm.Q(query)        // $ querystring=query
 	q.ColumnExpr(query) // $ querystring=query
@@ -38,4 +41,16 @@ func pgormtest(query string, q orm.Query) {
 	q.Where(query)          // $ querystring=query
 	q.WhereInMulti(query)   // $ querystring=query
 	q.WhereOr(query)        // $ querystring=query
-}
+
+	var formatter orm.Formatter
+	var sink1 []byte
+
+	sink2 := formatter.Append(sink1, "Appended1")
+	sink3 := formatter.AppendBytes(sink1, []byte("Appended2"))
+	sink4 := formatter.FormatQuery(sink1, "Query")
+
+	sink(sink1) // $ flowfrom=Appended1 $ flowfrom=Appended2 $ flowfrom=Query
+	sink(sink2) // $ flowfrom=Appended1
+	sink(sink3) // $ flowfrom=Appended2
+	sink(sink4) // $ flowfrom=Query
+}