sdk icon indicating copy to clipboard operation
sdk copied to clipboard

schema: Add string interpolation UAST type

Open dennwc opened this issue 6 years ago • 1 comments

I identified another low-hanging fruit in terms of Semantic UAST types: string interpolation.

The node is similar if most drivers I've seen, and the semantic is pretty well-understood. Essentially all nodes of this kind follow the following structure:

type StringInterpolation struct{
  Parts []Any
}

Each part can be a String, Identifier or any other expression that yields a value. The effect of this operation is to convert all arguments to String and join them into a single one.

Current list of discovered interpolation nodes:

  • bash:string
  • csharp:InterpolatedStringExpression
  • javascript:TemplateLiteral
  • php:Scalar_Encapsed
  • python:JoinedStr
  • ruby:dstr

If we decide to go full-in on Semantic, there some other candidates:

  • Go: fmt.Sprintf, strings.Join(, "")
  • Java: String.format But for now, I propose to only touch the unique AST nodes, not function calls.

In terms of functionality, this will allow to better detect SQL injections and similar bugs.

dennwc avatar Mar 20 '19 17:03 dennwc

Python has two variants:

"some string {w} named interpolation".format(w='with')
# or
"some string {0} positional {1}".format('with', 'interpolation')
# or
"some string {} implicit positional {}".format('with', 'interpolation')
# this one is the joinedstr:
f"f-string {w} some interpolated variable"

Joined strings are the second ones. I've just noticed that the first one doesn't have an integration test so I'll make a PR for it.

The format ones get a pretty complicated AST: Expression->Call where the args are the {}'s for the second and third case or keywords for the third and the string itself is inside func.QualifiedIdentifier.identifiers[0].

juanjux avatar Mar 21 '19 08:03 juanjux