Merge pull request #559 from sauyon/xorm

Add Xorm support

Author: Sauyon Lee

change-notes/2021-05-06-xorm.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added support for the `xorm.io/xorm` package

ql/src/semmle/go/frameworks/SQL.qll

@@ -224,3 +224,33 @@ module Gorm {
     result = package(["github.com/jinzhu/gorm", "github.com/go-gorm/gorm", "gorm.io/gorm"], "")
   }
 }
+
+/**
+ * Provides classes for working with the [XORM](https://xorm.io/) package.
+ */
+module Xorm {
+  /** Gets the package name for Xorm. */
+  string packagePath() { result = package(["xorm.io/xorm", "github.com/go-xorm/xorm"], "") }
+
+  /** A model for sinks of XORM. */
+  private class XormSink extends SQL::QueryString::Range {
+    XormSink() {
+      exists(Method meth, string type, string name, int n |
+        meth.hasQualifiedName(Xorm::packagePath(), type, name) and
+        this = meth.getACall().getArgument(n) and
+        type = ["Engine", "Session"]
+      |
+        name =
+          [
+            "Query", "Exec", "QueryString", "QueryInterface", "SQL", "Where", "And", "Or", "Alias",
+            "NotIn", "In", "Select", "SetExpr", "OrderBy", "Having", "GroupBy"
+          ] and
+        n = 0
+        or
+        name = ["SumInt", "Sum", "Sums", "SumsInt"] and n = 1
+        or
+        name = "Join" and n = [0, 1, 2]
+      )
+    }
+  }
+}

ql/test/library-tests/semmle/go/frameworks/SQL/go.mod

@@ -6,4 +6,9 @@ require (
 	github.com/Masterminds/squirrel v1.1.0
 	github.com/go-pg/pg v8.0.6+incompatible
 	github.com/go-pg/pg/v9 v9.1.3
+	github.com/go-sql-driver/mysql v1.6.0 // indirect
+	github.com/go-xorm/xorm v0.7.9
+	github.com/lib/pq v1.10.2 // indirect
+	github.com/mattn/go-sqlite3 v1.14.7 // indirect
+	xorm.io/xorm v1.1.0
 )