Skip to content

Rust: Model mysql and mysql_async query sinks#20631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
geoffw0 merged 14 commits into from
Oct 16, 2025
Merged

Rust: Model mysql and mysql_async query sinks #20631

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
ef93b36
Rust: Add test cases for the mysql library.
geoffw0 Oct 10, 2025
883e005
Rust: Add test cases for the mysql_async library.
geoffw0 Oct 10, 2025
f15a34f
Rust: Add test cases for transactions as well.
geoffw0 Oct 10, 2025
f16742b
Rust: Add models.
geoffw0 Oct 10, 2025
859c1ef
Rust: Change note.
geoffw0 Oct 10, 2025
c102ce4
Rust: Claim support for the two libraries.
geoffw0 Oct 10, 2025
106bad2
Rust: Add test cases for bad use of prepared statements as well.
geoffw0 Oct 10, 2025
1d7ccb6
Update rust/ql/lib/codeql/rust/frameworks/mysql.model.yml
geoffw0 Oct 13, 2025
35f3fbf
Rust: Accept consistency regressions.
geoffw0 Oct 13, 2025
93eb7ce
Rust: Accept test changes following suggested edit.
geoffw0 Oct 13, 2025
5544dff
Update rust/ql/test/query-tests/security/CWE-089/mysql.rs
geoffw0 Oct 15, 2025
28c139a
Rust: Format the test.
geoffw0 Oct 15, 2025
48ca04b
Rust: Repair test annotations following format and accept .expected c…
geoffw0 Oct 15, 2025
072eca2
Rust: Update consistency check .expected.
geoffw0 Oct 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/codeql/reusables/supported-frameworks.rst
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -336,6 +336,8 @@ and the CodeQL library pack ``codeql/rust-all`` (`changelog <https://github.com/
`log <https://crates.io/crates/log>`__, Logging library
`md5 <https://crates.io/crates/md5>`__, Utility library
`memchr <https://crates.io/crates/memchr>`__, Utility library
`mysql <https://crates.io/crates/mysql>`__, Database
`mysql_async <https://crates.io/crates/mysql_async>`__, Database
`once_cell <https://crates.io/crates/once_cell>`__, Utility library
`poem <https://crates.io/crates/poem>`__, Web framework
`postgres <https://crates.io/crates/postgres>`__, Database
Expand Down
4 changes: 4 additions & 0 deletions rust/ql/lib/change-notes/2025-10-10-mysql.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added models for the `mysql` and `mysql_async` libraries.
13 changes: 13 additions & 0 deletions rust/ql/lib/codeql/rust/frameworks/mysql-async.model.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
data:
- ["<_ as mysql_async::queryable::Queryable>::query", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql_async::queryable::Queryable>::query_drop", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql_async::queryable::Queryable>::query_first", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql_async::queryable::Queryable>::query_fold", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql_async::queryable::Queryable>::query_stream", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql_async::queryable::Queryable>::query_map", "Argument[0]", "sql-injection", "manual"]
- ["<mysql_async::conn::Conn as mysql_async::queryable::Queryable>::query_iter", "Argument[0]", "sql-injection", "manual"]
- ["<mysql_async::conn::Conn as mysql_async::queryable::Queryable>::prep", "Argument[0]", "sql-injection", "manual"]
16 changes: 16 additions & 0 deletions rust/ql/lib/codeql/rust/frameworks/mysql.model.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
data:
- ["<_ as mysql::conn::queryable::Queryable>::query", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql::conn::queryable::Queryable>::query_opt", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql::conn::queryable::Queryable>::query_drop", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql::conn::queryable::Queryable>::query_first", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql::conn::queryable::Queryable>::query_first_opt", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql::conn::queryable::Queryable>::query_fold", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql::conn::queryable::Queryable>::query_fold_opt", "Argument[0]", "sql-injection", "manual"]
- ["<mysql::conn::pool::PooledConn as mysql::conn::queryable::Queryable>::query_iter", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql::conn::queryable::Queryable>::query_map", "Argument[0]", "sql-injection", "manual"]
- ["<_ as mysql::conn::queryable::Queryable>::query_map_opt", "Argument[0]", "sql-injection", "manual"]
- ["<mysql::conn::pool::PooledConn as mysql::conn::queryable::Queryable>::prep", "Argument[0]", "sql-injection", "manual"]
64 changes: 64 additions & 0 deletions rust/ql/test/query-tests/security/CWE-089/CONSISTENCY/PathResolutionConsistency.expected
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,57 @@
multipleCallTargets
| mysql.rs:15:24:15:39 | ...::from(...) |
| mysql.rs:16:26:16:85 | ...::from(...) |
| mysql.rs:18:13:18:66 | ...::from(...) |
| mysql.rs:19:30:19:83 | ...::from(...) |
| mysql.rs:22:38:22:56 | safe_query.as_str() |
| mysql.rs:25:38:25:58 | unsafe_query.as_str() |
| mysql.rs:26:64:26:84 | unsafe_query.as_str() |
| mysql.rs:27:25:27:45 | unsafe_query.as_str() |
| mysql.rs:28:39:28:59 | unsafe_query.as_str() |
| mysql.rs:29:65:29:85 | unsafe_query.as_str() |
| mysql.rs:30:33:30:53 | unsafe_query.as_str() |
| mysql.rs:32:13:32:33 | unsafe_query.as_str() |
| mysql.rs:36:33:36:53 | unsafe_query.as_str() |
| mysql.rs:37:32:37:52 | unsafe_query.as_str() |
| mysql.rs:39:13:39:33 | unsafe_query.as_str() |
| mysql.rs:42:39:42:59 | unsafe_query.as_str() |
| mysql.rs:45:30:45:52 | prepared_query.as_str() |
| mysql.rs:46:45:46:66 | remote_string.as_str() |
| mysql.rs:47:71:47:92 | remote_string.as_str() |
| mysql.rs:48:46:48:67 | remote_string.as_str() |
| mysql.rs:49:33:49:54 | remote_string.as_str() |
| mysql.rs:50:46:50:67 | remote_string.as_str() |
| mysql.rs:52:37:52:58 | remote_string.as_str() |
| mysql.rs:56:14:56:35 | remote_string.as_str() |
| mysql.rs:62:14:62:35 | remote_string.as_str() |
| mysql.rs:66:40:66:61 | remote_string.as_str() |
| mysql.rs:67:39:67:60 | remote_string.as_str() |
| mysql.rs:70:14:70:35 | remote_string.as_str() |
| mysql.rs:75:31:75:51 | unsafe_query.as_str() |
| mysql.rs:80:26:80:46 | unsafe_query.as_str() |
| mysql.rs:100:24:100:39 | ...::from(...) |
| mysql.rs:101:26:101:85 | ...::from(...) |
| mysql.rs:103:13:103:66 | ...::from(...) |
| mysql.rs:104:30:104:83 | ...::from(...) |
| mysql.rs:107:38:107:56 | safe_query.as_str() |
| mysql.rs:110:38:110:58 | unsafe_query.as_str() |
| mysql.rs:111:25:111:45 | unsafe_query.as_str() |
| mysql.rs:112:47:112:67 | unsafe_query.as_str() |
| mysql.rs:114:25:114:45 | unsafe_query.as_str() |
| mysql.rs:116:33:116:53 | unsafe_query.as_str() |
| mysql.rs:118:40:118:60 | unsafe_query.as_str() |
| mysql.rs:121:24:121:44 | unsafe_query.as_str() |
| mysql.rs:125:30:125:52 | prepared_query.as_str() |
| mysql.rs:126:45:126:66 | remote_string.as_str() |
| mysql.rs:128:38:128:59 | remote_string.as_str() |
| mysql.rs:130:33:130:54 | remote_string.as_str() |
| mysql.rs:131:54:131:75 | remote_string.as_str() |
| mysql.rs:135:18:135:39 | remote_string.as_str() |
| mysql.rs:140:40:140:61 | remote_string.as_str() |
| mysql.rs:142:62:142:83 | remote_string.as_str() |
| mysql.rs:145:31:145:52 | remote_string.as_str() |
| mysql.rs:149:31:149:51 | unsafe_query.as_str() |
| mysql.rs:154:26:154:46 | unsafe_query.as_str() |
| sqlx.rs:46:24:46:44 | ...::from(...) |
| sqlx.rs:47:56:47:76 | ...::from(...) |
| sqlx.rs:48:97:48:117 | ...::from(...) |
Expand DownExpand Up@@ -65,3 +118,14 @@ multipleCallTargets
| sqlx.rs:188:29:188:51 | unsafe_query_1.as_str() |
| sqlx.rs:189:29:189:53 | prepared_query_1.as_str() |
| sqlx.rs:202:57:202:85 | ...::from(...) |
multiplePathResolutions
| mysql.rs:5:37:5:74 | Result::<...> |
| mysql.rs:26:20:26:44 | Result::<...> |
| mysql.rs:29:16:29:40 | Result::<...> |
| mysql.rs:34:25:34:49 | Result::<...> |
| mysql.rs:40:17:40:41 | Result::<...> |
| mysql.rs:47:20:47:44 | Result::<...> |
| mysql.rs:51:16:51:40 | Result::<...> |
| mysql.rs:64:25:64:49 | Result::<...> |
| mysql.rs:71:17:71:41 | Result::<...> |
| mysql.rs:91:49:91:58 | Result::<...> |
Loading