Represents sqlx.DB and sqlx.Tx from the sqlx library, which extends database/sql with struct scanning. Unsafe query methods (QueryUnsafe, GetUnsafe) and raw string methods are injection sinks.
.Query().Exec().Queryx().Get().Query()SinkQuery(query string, args ...any) (*sql.Rows, error)
Executes raw SQL query. Sink when query string contains user input.
0.Exec()SinkExec(query string, args ...any) (sql.Result, error)
Executes raw SQL DML. Sink when query string contains user input.
0.Queryx()SinkQueryx(query string, args ...any) (*sqlx.Rows, error)
Like Query but returns sqlx.Rows. Same injection risk.
0.Get()SinkGet(dest any, query string, args ...any) error
Executes query and scans result into dest. query is an injection sink.
1| FQN | Field | |
|---|---|---|
| github.com/jmoiron/sqlx.DB | fqns[0] | |
| github.com/jmoiron/sqlx.Tx | fqns[1] | |
| *.DB | patterns | |
| *.Tx | patterns |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
require github.com/jmoiron/sqlx v1.3.5
from codepathfinder.go_rule import GoSqlxDB