sdk
sdk copied to clipboard
schema: Add string interpolation UAST type
I identified another low-hanging fruit in terms of Semantic UAST types: string interpolation.
The node is similar if most drivers I've seen, and the semantic is pretty well-understood. Essentially all nodes of this kind follow the following structure:
type StringInterpolation struct{
Parts []Any
}
Each part can be a String, Identifier or any other expression that yields a value. The effect of this operation is to convert all arguments to String and join them into a single one.
Current list of discovered interpolation nodes:
bash:stringcsharp:InterpolatedStringExpressionjavascript:TemplateLiteralphp:Scalar_Encapsedpython:JoinedStrruby:dstr
If we decide to go full-in on Semantic, there some other candidates:
- Go:
fmt.Sprintf,strings.Join(, "") - Java:
String.formatBut for now, I propose to only touch the unique AST nodes, not function calls.
In terms of functionality, this will allow to better detect SQL injections and similar bugs.
Python has two variants:
"some string {w} named interpolation".format(w='with')
# or
"some string {0} positional {1}".format('with', 'interpolation')
# or
"some string {} implicit positional {}".format('with', 'interpolation')
# this one is the joinedstr:
f"f-string {w} some interpolated variable"
Joined strings are the second ones. I've just noticed that the first one doesn't have an integration test so I'll make a PR for it.
The format ones get a pretty complicated AST: Expression->Call where the args are the {}'s for the second and third case or keywords for the third and the string itself is inside func.QualifiedIdentifier.identifiers[0].