gormless

package module
v0.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 20, 2024 License: MIT Imports: 8 Imported by: 0

README

Gormless

The purpose of this library is to provide a wrapper that helps prevent SQL injection risks. I do not feel like Gorm takes this risk seriously enough, particularly in these methods:

  • First
  • Take
  • Last
  • Find

But I've layered in the safesql library to help prevent SQL injection risks in all methods. So, if you want the benefits of using Gorm, but also care about security in the way I do, I welcome you to use this library.

This is such an obvious idea that I'm sure it's been done, but I can't find it. Gorm Gen will help get you some of the safety that this gives, but this gives it to you with Gorm itself (all the same capabilities, but with a couple minor changes).

Installation

go get github.com/zostay/gormless

Usage

package main

import (
    "fmt"
    "os"
    
    "gorm.io/driver/sqlite"
    "gorm.io/gorm"
    "github.com/google/go-safeweb/safesql"
    "github.com/zostay/gormless"
)

type User struct {
    ID   int
    Name string
}

func main() {
    if len(os.Args) != 2 {
        fmt.Println("usage: ", os.Args[0], " <id>")
        os.Exit(1)
    }
    
    unsafeDB, err := gorm.Open(sqlite.Open("test.db"), &gorm.Config{})
    if err != nil {
        panic("failed to connect database: " + err.Error())
    }
    
    db := gormless.New(unsafeDB)
    
    var u User
    err = db.First(&u, safesql.New("id = ?"), os.Args[1]).Error()
    if err != nil {
        panic("failed to read user: " + err.Error())
    }   

    fmt.Println("Name:", u.Name)
}

The Problem

If you read the Gorm documentation carefully (and you absolutely should because of this problem), you will find the Security page. On it, it is revealed that SQL injection is considered a feature of Gorm.

For a reminder of what SQL injection is, see XKCD's Exploits of a Mom.

The gorm devs do not consider this to be a vulnerability, but they are simply wrong. SQL injection is an obvious issue with a method like db.Where or db.Raw where you know you're writing a raw SQL query. If these were the methods we were talking about, I have concerns to make sure devs use them carefully, but I wouldn't say they are inherently vulnerable.

However, if you have a method that is safe under some circumstances, but not under others, that is a vulnerability. Consider the following program:

// BAD CODE DO NOT USE!!!

package main

import (
    "fmt"
    "os"

    "gorm.io/driver/sqlite"
    "gorm.io/gorm"
)

type User struct {
    ID   int
    Name string
}

func main() {
    if len(os.Args) != 2 {
        fmt.Println("usage: ", os.Args[0], " <id>")
        os.Exit(1)
    }

    db, err := gorm.Open(sqlite.Open("test.db"), &gorm.Config{})
    if err != nil {
        panic("failed to connect database: " + err.Error())
    }

    // VERY BAD CODE HERE!!! DO NOT USE!!!
    var u User
    err = db.First(&u, os.Args[1]).Error // <=== VULNERABILITY HERE
    if err != nil {
        panic("failed to read user: " + err.Error())
    }

    fmt.Println("Name:", u.Name)
}

Run this like so and you'll see the problem:

go run main.go "1; drop table users"

The most strident commentary when this issue is raised was, "Absolutely, this is bad API design, but it's not a vulnerability.". The Gorm devs' solution was to provide the security page linked above. That's not a solution. That's negligence. I've given talks on the OWASP Top 10 for more than a decade. This exact problem, code injection generally and SQL injection particularly, remains one of the top issues in applications today for all this time because devs like those working on Gorm have continually avoided taking it seriously.

Regarding this being bad API design and not a vulnerability, I quote Dwight Schrute, "False." It ceases to be bad API design when you realize that the various First, Find, etc. methods actually look at the input and try to magically decide how to treat the input. For example,

  • If the input is an int, it turns into something like id = <input>.
  • If it's a string containing a "?", it treats it as a prepared statement with bindings.
  • If it's some other string, it might treat it as the id = <input> case or it might treat it as a raw SQL query.

That is the absolute definition of a SQL injection vulnerability. If the input is safe some of the time, but not all of the, that's SQL injection. They have created the illusion of safety where it is most certainly not safe, which is what creates a vulnerability. That's not even an opinion, but clear fact, as far as I'm concerned.

To me, part of the purpose of using an ORM rather than raw SQL and a language like Go instead of C is to avoid footguns as big as this one. So...

The Solution

Since the authors of Gorm seem unwilling to fix this or to even admit that need a v3 that obliterate this "bad API design." I have created this library named Gormless. I'll let you interpret the name as you will.

This is a straight up wrapper of gorm.DB that adds in the powers of google.com/go-safeweb/safesql and neuters the unsafe syntax. If you want to get back to the unsafe syntax, you can call Unsafe() on the gormless.DB object.

This package is built using code generation using reflection, so it should be able to keep up with Gorm's changes. If it doesn't, please file an issue.

This solution is absolutely overkill. It's a sledgehammer to a nail. All that really needs to be fixed to resolve the major issue is the First, Find, and other methods that might be safe sometimes, but not all the time. On the other hande, safesql is a brilliantly simple solution to add in, so why not?

Patches Welcome

If there's something you cannot do with this library in place without calling Unsafe() that you believe is safe. Please submit a PR and I will happily add it in, so long as it doesn't reintroduce the vulnerability.

Callback Support

This library is unable to support the gorm.DB.Callback method. This is due to the fact that that method returns a private type, so it can't be wrapped in a straight-forward fashion. Anyway, I can think of a few workarounds, but I just want to highlight here that lack of callback support is deliberate at this time.

License

Copyright © 2024 Qubling LLC

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var Version string

Functions

This section is empty.

Types

type DB 

type DB struct {
	// contains filtered or unexported fields
}

func New 

func New(unsafe *gorm.DB) *DB

func (*DB) Assign 

func (db *DB) Assign(p1 ...interface{}) *DB

func (*DB) Association 

func (db *DB) Association(p1 string) *gorm.Association

func (*DB) Attrs 

func (db *DB) Attrs(p1 ...interface{}) *DB

func (*DB) Begin 

func (db *DB) Begin(p1 ...*sql.TxOptions) *gorm.DB

func (*DB) BindVarTo 

func (db *DB) BindVarTo(p1 clause.Writer, p2 *gorm.Statement, p3 interface{})

func (*DB) Clauses 

func (db *DB) Clauses(p1 ...clause.Expression) *gorm.DB

func (*DB) Commit 

func (db *DB) Commit() *gorm.DB

func (*DB) Config 

func (db *DB) Config() *gorm.Config

func (*DB) Count 

func (db *DB) Count(p1 *int64) *gorm.DB

func (*DB) Create 

func (db *DB) Create(s safesql.TrustedSQLString) *DB

func (*DB) CreateInBatches 

func (db *DB) CreateInBatches(p1 interface{}, p2 int) *gorm.DB

func (*DB) Debug 

func (db *DB) Debug() *gorm.DB

func (*DB) DefaultValueOf 

func (db *DB) DefaultValueOf(p1 *schema.Field) clause.Expression

func (*DB) Delete 

func (db *DB) Delete(p1 interface{}, s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Distinct 

func (db *DB) Distinct(args ...safesql.TrustedSQLString) *DB

func (*DB) Error 

func (db *DB) Error() error

func (*DB) Exec 

func (db *DB) Exec(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Find 

func (db *DB) Find(p1 interface{}, s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) FindInBatches 

func (db *DB) FindInBatches(p1 interface{}, p2 int, p3 func(*gorm.DB, int) error) *gorm.DB

func (*DB) First 

func (db *DB) First(p1 interface{}, s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) FirstOrCreate 

func (db *DB) FirstOrCreate(p1 interface{}, p2 ...interface{}) *DB

func (*DB) FirstOrInit 

func (db *DB) FirstOrInit(p1 interface{}, p2 ...interface{}) *DB

func (*DB) Group 

func (db *DB) Group(s safesql.TrustedSQLString) *DB

func (*DB) Having 

func (db *DB) Having(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) InnerJoins 

func (db *DB) InnerJoins(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) InstanceSet 

func (db *DB) InstanceSet(s safesql.TrustedSQLString, arg interface{}) *DB

func (*DB) Joins 

func (db *DB) Joins(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Last 

func (db *DB) Last(p1 interface{}, s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Limit 

func (db *DB) Limit(p1 int) *gorm.DB

func (*DB) MapColumns 

func (db *DB) MapColumns(p1 map[string]string) *gorm.DB

func (*DB) Migrator 

func (db *DB) Migrator() gorm.Migrator

func (*DB) Model 

func (db *DB) Model(s safesql.TrustedSQLString) *DB

func (*DB) Not 

func (db *DB) Not(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Offset 

func (db *DB) Offset(p1 int) *gorm.DB

func (*DB) Omit 

func (db *DB) Omit(p1 ...string) *gorm.DB

func (*DB) Or 

func (db *DB) Or(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Order 

func (db *DB) Order(s safesql.TrustedSQLString) *DB

func (*DB) Pluck 

func (db *DB) Pluck(s safesql.TrustedSQLString, arg interface{}) *DB

func (*DB) Preload 

func (db *DB) Preload(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) QuoteTo 

func (db *DB) QuoteTo(p1 clause.Writer, p2 string)

func (*DB) Raw 

func (db *DB) Raw(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Rollback 

func (db *DB) Rollback() *gorm.DB

func (*DB) RollbackTo 

func (db *DB) RollbackTo(s safesql.TrustedSQLString) *DB

func (*DB) Row 

func (db *DB) Row() *sql.Row

func (*DB) RowsAffected 

func (db *DB) RowsAffected() int64

func (*DB) Save 

func (db *DB) Save(p1 interface{}) *gorm.DB

func (*DB) SavePoint 

func (db *DB) SavePoint(s safesql.TrustedSQLString) *DB

func (*DB) Scan 

func (db *DB) Scan(p1 interface{}) *gorm.DB

func (*DB) Scopes 

func (db *DB) Scopes(p1 ...func(*gorm.DB) *gorm.DB) *gorm.DB

func (*DB) Select 

func (db *DB) Select(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Session 

func (db *DB) Session(p1 *gorm.Session) *gorm.DB

func (*DB) Set 

func (db *DB) Set(s safesql.TrustedSQLString, arg interface{}) *DB

func (*DB) Statement 

func (db *DB) Statement() *gorm.Statement

func (*DB) Table 

func (db *DB) Table(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Take 

func (db *DB) Take(p1 interface{}, s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) Unsafe 

func (db *DB) Unsafe() *gorm.DB

func (*DB) Unscoped 

func (db *DB) Unscoped() *gorm.DB

func (*DB) Update 

func (db *DB) Update(s safesql.TrustedSQLString, arg interface{}) *DB

func (*DB) UpdateColumn 

func (db *DB) UpdateColumn(s safesql.TrustedSQLString, arg interface{}) *DB

func (*DB) UpdateColumns 

func (db *DB) UpdateColumns(p1 interface{}) *gorm.DB

func (*DB) Updates 

func (db *DB) Updates(p1 interface{}) *gorm.DB

func (*DB) Where 

func (db *DB) Where(s safesql.TrustedSQLString, args ...interface{}) *DB

func (*DB) WithContext 

func (db *DB) WithContext(p1 context.Context) *gorm.DB

Source Files

View all Source files

Directories

Path Synopsis
tools
gen

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.