From 1ca335016ae188ba88bf947d819c7ac744840e74 Mon Sep 17 00:00:00 2001
From: Jon McClintock <jon.mcclintock@mixpanel.com>
Date: Mon, 22 Jan 2018 18:45:07 +0000
Subject: [PATCH] Rebase to master

---
 rules/sql.go        | 13 +++++--------
 testutils/source.go | 23 ++++++++++++++++++++++-
 2 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/rules/sql.go b/rules/sql.go
index 5996b9a..c6505e3 100644
--- a/rules/sql.go
+++ b/rules/sql.go
@@ -29,7 +29,7 @@ type sqlStatement struct {
 }
 
 // See if the string matches the patterns for the statement.
-func (s sqlStatement) Match(str string) bool {
+func (s sqlStatement) MatchPatterns(str string) bool {
 	for _, pattern := range s.patterns {
 		if !pattern.MatchString(str) {
 			return false
@@ -55,7 +55,7 @@ func (s *sqlStrConcat) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
 	if node, ok := n.(*ast.BinaryExpr); ok {
 		if start, ok := node.X.(*ast.BasicLit); ok {
 			if str, e := gas.GetString(start); e == nil {
-				if !s.Match(str) {
+				if !s.MatchPatterns(str) {
 					return nil, nil
 				}
 				if _, ok := node.Y.(*ast.BasicLit); ok {
@@ -73,8 +73,8 @@ func (s *sqlStrConcat) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
 
 // NewSQLStrConcat looks for cases where we are building SQL strings via concatenation
 func NewSQLStrConcat(conf gas.Config) (gas.Rule, []ast.Node) {
-	return &SqlStrConcat{
-		SqlStatement: SqlStatement{
+	return &sqlStrConcat{
+		sqlStatement: sqlStatement{
 			patterns: []*regexp.Regexp{
 				regexp.MustCompile(`(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) `),
 			},
@@ -97,10 +97,7 @@ func (s *sqlStrFormat) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
 
 	// TODO(gm) improve confidence if database/sql is being used
 	if node := s.calls.ContainsCallExpr(n, c); node != nil {
-		if arg, e := gas.GetString(node.Args[0]); e == nil {
-			if !s.Match(str) {
-				return nil, nil
-			}
+		if arg, e := gas.GetString(node.Args[0]); s.MatchPatterns(arg) && e == nil {
 			return gas.NewIssue(c, n, s.What, s.Severity, s.Confidence), nil
 		}
 	}
diff --git a/testutils/source.go b/testutils/source.go
index 7eb0130..f606e4a 100644
--- a/testutils/source.go
+++ b/testutils/source.go
@@ -206,7 +206,28 @@ func main(){
 		panic(err)
 	}
 	defer rows.Close()
-}`, 1}, {
+}`, 1}, {`
+// Format string false positive, safe string spec.
+package main
+import (
+	"database/sql"
+	"fmt"
+	"os"
+	//_ "github.com/mattn/go-sqlite3"
+)
+
+func main(){
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		panic(err)
+	}
+	q := fmt.Sprintf("SELECT * FROM foo where id = %d", os.Args[1])
+	rows, err := db.Query(q)
+	if err != nil {
+		panic(err)
+	}
+	defer rows.Close()
+}`, 0}, {
 			`
 // Format string false positive
 package main