Rust: Add Database Sources + tokio-postgres support #18712
Conversation
There was a problem hiding this comment.
PR Overview
This pull request adds new database read sources for the tokio-postgres library and models potential SQL injection sinks in CodeQL for Rust. It also updates the test file to use row.try_get for more robust error handling.
- Adds modeling for tokio-postgres library calls to detect SQL injection
- Classifies returned values from database rows as data sources
- Updates test usage of row fields to try_get
Changes
| File | Description |
|---|---|
| rust/ql/lib/codeql/rust/frameworks/tokio-postgres.model.yml | Adds modeling for tokio-postgres library to detect SQL injection sinks and database read sources |
| rust/ql/test/library-tests/frameworks/postgres/main.rs | Updates usage of row.get to row.try_get for better error handling |
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more
Co-authored-by: Copilot <[email protected]>
geoffw0
left a comment
geoffw0
left a comment
There was a problem hiding this comment.
One question, otherwise LGTM.
|
@geoffw0 If everything looks good can you merge the PR? I am unable to |
|
Yep, I just wanted to do a DCA run to see if this change has any effects on there. That's done now, it shows 6 new taint sinks in |
|
Thanks for contributing this! |
2 participants
Two changes in this PR:
tokio-postgressupport