Python: Implement module ClickHouseDriver.qll #5889
Conversation
japroc
changed the title
japroc
changed the title
intrigus-lgtm
left a comment
intrigus-lgtm
left a comment
There was a problem hiding this comment.
Some simple comments.
I did not look at the qll file.
(Note that I'm not a member of the github/codeql team)
python/ql/src/experimental/Security/CWE-089/ClickHouseSQLInjection.py
Outdated
Show resolved
Hide resolved
python/ql/src/experimental/Security/CWE-089/ClickHouseSQLInjection.py
Outdated
Show resolved
Hide resolved
python/ql/src/experimental/Security/CWE-089/ClickHouseSQLInjection.qhelp
Outdated
Show resolved
Hide resolved
| </p> | ||
|
|
||
| <p> | ||
| In the first case, the query executed via aioch Client. aioch - is a module |
There was a problem hiding this comment.
As far as I know query help files should not contain too many examples.
I think one/two "BAD" cases (maybe one aioch case and one `Client class case) and one "GOOD" case should be enough.
RasmusWL
left a comment
RasmusWL
left a comment
There was a problem hiding this comment.
Hi @japroc, thanks for this contribution 👍
I'll take a deeper look at reviewing your code tomorrow.
From a very superficial look, I can see that you've added a new query in this PR. While that's not necessarily a bad idea for local development, to be able to test out your changes, I think we'll delete that after promoting your modeling out of experimental. If there are any of the textual comments in qhelp file that are important to keep, I would like to request that you add these to python/ql/test/experimental/semmle/python/frameworks/clickhouse-driver/ClickHouseDriver.py instead 😊
Very nice to see python/ql/test/experimental/semmle/python/frameworks/clickhouse-driver/ClickHouseDriver.ql, we usually use a slightly different approach with ConceptsTest.ql and writing expectations inline with special comment syntax (which you can see in action here), but I think your test does the job pretty nicely as well 👍
python/ql/test/experimental/semmle/python/frameworks/clickhouse-driver/ClickHouseDriver.ql
Outdated
Show resolved
Hide resolved
RasmusWL
left a comment
RasmusWL
left a comment
There was a problem hiding this comment.
Overall this code looks good to me 👍 (good job)
I have one question on client subclasses, but I don't think anything is a major blocker for us merging this PR 👍 (I might do a few minor stylistic cleanups when promoting this out of experimental)
| private DataFlow::Node client_ref() { | ||
| result = clickhouse_driver().getMember("Client").getASubclass*().getAUse() | ||
| or | ||
| result = aioch().getMember("Client").getASubclass*().getAUse() | ||
| } |
There was a problem hiding this comment.
This part surprised me. Do you have an example of someone who provides their own Client subclass in a real project? (or is this just something that you thought might happen and you wanted to capture?)
There was a problem hiding this comment.
I am sure i have seen few projects where there are custom subclasses of clickhouse-driver's Client. I did not save links to these projects. And actually dont remember how popular these projects are. I can spend some time on weekends to find them. I will put links here. And we will resolve this moment further.
What do you think? :)
There was a problem hiding this comment.
With a fast search, i have found this one https://github.com/Altinity/clickhouse-mysql-data-reader/blob/3b1b7088751b05e5bbf45890c5949b58208c2343/clickhouse_mysql/dbclient/chclient.py#L10
There are many stars, so here came the idea to support that kind of subclasses.
There was a problem hiding this comment.
Interesting, thanks for providing those examples 👍 having seen those, I think that it makes good sense to have support for that usage pattern 👍
|
Thanks, @RasmusWL! Gonna celebrate my very first PR to codeql 😄 Have a good day! |
|
Nice 🎉 I did some adjustments in #5950, so when that is merged, your contributions will be part of our standard analysis 💪 |
3 participants
Hello!
The idea of this PR is to improve default SQLInjection query by adding ClickHouseDriver.qll module with describes
clickhouse-driverPyPI package. This module hsa self Client with several methods to execute query. Alsoclickhouse-driverhas a PEP249 interface.When this module will be moved from experimental folder to standart library, it would automatically improve existing Sqlnjection.ql query. But for now, for a demonstration, i created a separate query which imports experimental module and repeats standart query. I also added python snippet for
clickhouse-driverusage and qhelp which describes different cases from that example code.Thanks,
Evgenii.