From a4d31722863071a2188f600bcf4b065510eddc63 Mon Sep 17 00:00:00 2001 From: Chanel Young Date: Tue, 16 Jun 2026 10:49:44 -0700 Subject: [PATCH] rust: Add config-derived table name barrier for SQL injection Adds a barrier that blocks taint propagation through struct field accesses whose names match table/collection/schema/index patterns (e.g., self.events_table, self.view_table). These fields are typically initialized at service startup from configuration, not from per-request user data. This addresses 3 of 4 false positives observed in triage where internal aggregate table name fields were incorrectly flagged as SQL injection sinks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../rust/security/SqlInjectionExtensions.qll | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/rust/ql/lib/codeql/rust/security/SqlInjectionExtensions.qll b/rust/ql/lib/codeql/rust/security/SqlInjectionExtensions.qll index de2622974f6f..864cc923faf7 100644 --- a/rust/ql/lib/codeql/rust/security/SqlInjectionExtensions.qll +++ b/rust/ql/lib/codeql/rust/security/SqlInjectionExtensions.qll @@ -77,4 +77,22 @@ module SqlInjection { private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier { } + + /** + * A barrier for struct field accesses whose names suggest they hold table or + * column identifiers derived from application configuration rather than user input. + * + * Patterns like `self.events_table`, `self.table_name`, `self.view_table` are + * typically initialized at service startup from hardcoded strings or configuration, + * not from per-request user data. + */ + private class ConfigDerivedTableNameBarrier extends Barrier { + ConfigDerivedTableNameBarrier() { + exists(FieldExpr fe | + this.asExpr() = fe and + fe.getIdentifier().getText() + .regexpMatch("(?i).*(table|collection|schema|bucket|index|view)(_name)?$") + ) + } + } }