Rust: Update SqlxQuery, SqlxExecute to use getCanonicalPath #19802
Conversation
|
I managed to make some progress; will continue investigations tomorrow. |
|
Just merged |
| @@ -33,7 +36,8 @@ private class SqlxExecute extends SqlExecution::Range { | |||
|
|
|||
| SqlxExecute() { | |||
| this.asExpr().getExpr() = call and | |||
| call.(Resolvable).getResolvedPath() = "crate::executor::Executor::execute" | |||
| call.getStaticTarget().(Addressable).getCanonicalPath() = | |||
| "sqlx_core::executor::Executor::execute" | |||
There was a problem hiding this comment.
I guess this should be something like
| "sqlx_core::executor::Executor::execute" | |
| "<sqlx_core::executor::Executor>::execute" |
There was a problem hiding this comment.
It's difficult to be confident without the test working, but <_ as sqlx_core::executor::Executor>::execute does at least exist as the canonical path of a function in the database, so I'm going with that for now.
| let _ = conn.execute(safe_query_2.as_str()).await?; // $ sql-sink | ||
| let _ = conn.execute(safe_query_3.as_str()).await?; // $ sql-sink | ||
| let _ = conn.execute(unsafe_query_1.as_str()).await?; // $ sql-sink Alert[rust/sql-injection]=args1 | ||
| let _ = conn.execute(safe_query_1.as_str()).await?; // $ MISSING: sql-sink |
There was a problem hiding this comment.
While we are able to infer that conn has type PoolConnection, we cannot currently infer that is in fact has type PoolConnection<MySql> (#19954 or similar is needed for that).
Once we are able to do that, we need implicit dereferencing via
impl<DB: Database> Deref for PoolConnection<DB> {
type Target = DB::Connection;
fn deref(&self) -> &Self::Target {
&self.live.as_ref().expect(EXPECT_MSG).raw
}
}
to get to the type &MySqlConnection, and then via impl<'c> Executor<'c> for &'c mut MySqlConnection we can find execute.
There was a problem hiding this comment.
I've added explicit types to some of the test cases and that is indeed not enough by itself, but it should increase the chances we see a change in test results as improvements are made.
I'm not sure whether we should aim to merge this PR (i.e. accept the regression for now) or wait for type inference to catch up. Guess I'll bring it out of draft and start a DCA run to help decide...
Update
SqlxQuery,SqlxExecuteto usegetCanonicalPathrather thangetResolvedPath.At present we lose some results, presumably for similar reasons as we lose similar results in #19268 . I'd prefer we address the issue (and do a DCA run) before merging this.
@hvitved