Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add db.Exec and db.Prepare to the sql rule #763

Merged
merged 2 commits into from Jan 17, 2022
Merged

Conversation

kaiili
Copy link
Contributor

@kaiili kaiili commented Jan 16, 2022

Problem

fixes #756

Details :

can be seen in #756.
G201,G202 only match Query, QueryContext, QueryRow, QueryRowContext .
If there is a SQLStr like the following, there will be problems with matching.

db.Exec("SELECT " + cols + " FROM DUAL")

Solution

Add Exec, ExecContext, Prepare and PrepareContext.

@codecov-commenter
Copy link

Codecov Report

Merging #763 (407051f) into master (7be6d4e) will increase coverage by 0.10%.
The diff coverage is 100.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #763      +/-   ##
==========================================
+ Coverage   73.72%   73.82%   +0.10%     
==========================================
  Files          47       47              
  Lines        2953     2953              
==========================================
+ Hits         2177     2180       +3     
+ Misses        712      710       -2     
+ Partials       64       63       -1     
Impacted Files Coverage Δ
rules/sql.go 79.39% <100.00%> (+1.50%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7be6d4e...407051f. Read the comment docs.

@ccojocar ccojocar merged commit 1d909e2 into securego:master Jan 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Query string building via concatenation (G202) should apply to Exec and Prepare
3 participants