Skip to content
This repository has been archived by the owner on Mar 8, 2020. It is now read-only.

schema: Add string interpolation UAST type #383

Open
dennwc opened this issue Mar 20, 2019 · 1 comment
Open

schema: Add string interpolation UAST type #383

dennwc opened this issue Mar 20, 2019 · 1 comment

Comments

@dennwc
Copy link
Member

dennwc commented Mar 20, 2019

I identified another low-hanging fruit in terms of Semantic UAST types: string interpolation.

The node is similar if most drivers I've seen, and the semantic is pretty well-understood. Essentially all nodes of this kind follow the following structure:

type StringInterpolation struct{
  Parts []Any
}

Each part can be a String, Identifier or any other expression that yields a value. The effect of this operation is to convert all arguments to String and join them into a single one.

Current list of discovered interpolation nodes:

  • bash:string
  • csharp:InterpolatedStringExpression
  • javascript:TemplateLiteral
  • php:Scalar_Encapsed
  • python:JoinedStr
  • ruby:dstr

If we decide to go full-in on Semantic, there some other candidates:

  • Go: fmt.Sprintf, strings.Join(, "")
  • Java: String.format
    But for now, I propose to only touch the unique AST nodes, not function calls.

In terms of functionality, this will allow to better detect SQL injections and similar bugs.

@juanjux
Copy link
Contributor

juanjux commented Mar 21, 2019

Python has two variants:

"some string {w} named interpolation".format(w='with')
# or
"some string {0} positional {1}".format('with', 'interpolation')
# or
"some string {} implicit positional {}".format('with', 'interpolation')
# this one is the joinedstr:
f"f-string {w} some interpolated variable"

Joined strings are the second ones. I've just noticed that the first one doesn't have an integration test so I'll make a PR for it.

The format ones get a pretty complicated AST: Expression->Call where the args are the {}'s for the second and third case or keywords for the third and the string itself is inside func.QualifiedIdentifier.identifiers[0].

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants