Skip to content

Commit 6903d4f

Browse files
KARTIKrockscoderabbitai[bot]
KARTIKrocks
and
coderabbitai[bot]
authored
feat: add PostgreSQL parser and reporting capabilities (#2)
* feat: add PostgreSQL parser and reporting capabilities - Implemented a new PostgreSQL parser in `pgparser` that provides structural analysis of SQL queries, including support for SELECT, INSERT, UPDATE, and DELETE statements. - Added unit tests for the PostgreSQL parser to ensure accurate parsing and structural fact extraction. - Introduced a `ConsoleReporter` for outputting analysis results to the terminal with color-coded severity levels. - Created a `JSONReporter` for outputting analysis results in JSON format. - Defined a `Reporter` interface for consistent reporting of analysis results across different formats. - Updated the main `sqlguard` package to support the new PostgreSQL parser and reporting features. * Update .github/workflows/ci.yml Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/codeql.yml Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: disable credential persistence for checkout actions in CI workflows * Update cmd/sqlguard/scan.go Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update reporter/json.go Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: correct comment typo in skipSingleQuoted function * fix: add missing import for fmt in JSONReporter * feat: enhance reporting capabilities and improve documentation --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
1 parent a8be5c2 commit 6903d4f

96 files changed

Lines changed: 11261 additions & 1 deletion

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.coderabbit.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,11 @@ reviews:
121121
comment/string-aware multi-statement rejection and SELECT/WITH-only (DML
122122
behind WithAllowDML) policy. EXPLAIN takes no bind params, so
123123
concatenation is by design — the defense is validate() + the rolled-back
124-
read-only tx; do not "fix" it with parameterization.
124+
read-only tx; do not "fix" it with parameterization. Deliberate
125+
carve-out: explain keeps Result.Query (and the inner analyzer.Result
126+
.Query of its findings) RAW — the user typed the query on their own CLI,
127+
it never reaches a log/telemetry sink, and Fingerprint is still set. Do
128+
NOT flag explain findings for not redacting Query; that is intended.
125129
126130
- path: "**/*_test.go"
127131
instructions: >-

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
name: Bug report
3+
about: Report incorrect behavior, a false positive/negative, or a crash
4+
title: ""
5+
labels: bug
6+
assignees: ""
7+
---
8+
9+
**Do not file security vulnerabilities here** — see [SECURITY.md](../../SECURITY.md).
10+
11+
## What happened
12+
13+
A clear description of the bug.
14+
15+
## Expected behavior
16+
17+
What you expected instead. For a false positive/negative, say which **rule**
18+
(e.g. `select-star`) fired or failed to fire.
19+
20+
## Reproduction
21+
22+
The SQL or Go snippet, and how it was issued:
23+
24+
```sql
25+
-- query (redacted is fine)
26+
```
27+
28+
```go
29+
// minimal repro
30+
```
31+
32+
## Environment
33+
34+
- sqlguard version / commit:
35+
- Affected module(s) (root, `integrations/<name>`, `parsers/<name>`):
36+
- Parser in use (default fallback / pgparser / mysqlparser):
37+
- Entry surface (runtime middleware / CLI `scan` / CLI `explain` / integration):
38+
- Go version:
39+
- Database + dialect (if relevant):
40+
41+
## Additional context
42+
43+
Logs (redaction-safe), config (`.sqlguard.yml`), or anything else useful.

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/KARTIKrocks/sqlguard/security/advisories/new
5+
about: Report security issues privately — please do not open a public issue.
6+
- name: Question / discussion
7+
url: https://github.com/KARTIKrocks/sqlguard/discussions
8+
about: Ask usage questions or discuss ideas here.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
name: Feature request
3+
about: Suggest a new rule, integration, or capability
4+
title: ""
5+
labels: enhancement
6+
assignees: ""
7+
---
8+
9+
## Problem
10+
11+
What are you trying to catch or do that sqlguard can't today?
12+
13+
## Proposed solution
14+
15+
What you'd like to see. If you're proposing a **new detection rule**, include:
16+
17+
- the SQL anti-pattern it should flag,
18+
- example queries that should and should **not** trigger it,
19+
- a suggested severity (info / warning / critical),
20+
- any tunable (and its default).
21+
22+
If you're proposing a **new integration**, name the ORM/driver and its
23+
hook/seam.
24+
25+
## Alternatives considered
26+
27+
Other approaches, workarounds, or existing rules/config that almost fit.
28+
29+
## Additional context
30+
31+
Anything else — links, prior art, willingness to send a PR.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
## Summary
2+
3+
What does this PR change, and why?
4+
5+
Closes #<!-- issue number, if any -->
6+
7+
## Type of change
8+
9+
- [ ] Bug fix
10+
- [ ] New detection rule
11+
- [ ] New integration / parser
12+
- [ ] Feature / enhancement
13+
- [ ] Docs only
14+
- [ ] Refactor / chore
15+
16+
## Checklist
17+
18+
- [ ] `make ci` passes (fmt-check, vet, lint, test-race) across all modules
19+
- [ ] Added/updated tests (and, where practical, a failure-mode check)
20+
- [ ] Updated docs as needed (`README.md`, `CLAUDE.md`, `.sqlguard.example.yml`)
21+
- [ ] Added an entry under `## [Unreleased]` in `CHANGELOG.md`
22+
- [ ] No new third-party deps in `analyzer` / `middleware` / `reporter`
23+
- [ ] Findings stay redaction-safe (no raw literals leak into a `Result`)
24+
25+
## Notes for reviewers
26+
27+
Anything reviewers should focus on — tricky areas, trade-offs, follow-ups.

‎.github/dependabot.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
version: 2
2+
3+
updates:
4+
- package-ecosystem: gomod
5+
directory: /
6+
schedule:
7+
interval: weekly
8+
groups:
9+
go-dependencies:
10+
patterns:
11+
- "*"
12+
13+
- package-ecosystem: gomod
14+
directory: /integrations/gormguard
15+
schedule:
16+
interval: weekly
17+
18+
- package-ecosystem: gomod
19+
directory: /integrations/sqlxguard
20+
schedule:
21+
interval: weekly
22+
23+
- package-ecosystem: gomod
24+
directory: /integrations/pgxguard
25+
schedule:
26+
interval: weekly
27+
28+
- package-ecosystem: gomod
29+
directory: /integrations/bunguard
30+
schedule:
31+
interval: weekly
32+
33+
- package-ecosystem: gomod
34+
directory: /integrations/xormguard
35+
schedule:
36+
interval: weekly
37+
38+
- package-ecosystem: gomod
39+
directory: /integrations/entguard
40+
schedule:
41+
interval: weekly
42+
43+
- package-ecosystem: gomod
44+
directory: /parsers/pgparser
45+
schedule:
46+
interval: weekly
47+
48+
- package-ecosystem: gomod
49+
directory: /parsers/mysqlparser
50+
schedule:
51+
interval: weekly
52+
53+
- package-ecosystem: github-actions
54+
directory: /
55+
schedule:
56+
interval: weekly

‎.github/workflows/ci.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
test:
18+
runs-on: ubuntu-latest
19+
strategy:
20+
matrix:
21+
go-version: ["1.26"]
22+
steps:
23+
- uses: actions/checkout@v6
24+
with:
25+
persist-credentials: false
26+
27+
- uses: actions/setup-go@v6
28+
with:
29+
go-version: ${{ matrix.go-version }}
30+
31+
- name: Run tests
32+
run: go test ./... -count=1 -race
33+
34+
- name: Test integrations (gormguard)
35+
run: cd integrations/gormguard && go test ./... -count=1 -race
36+
37+
- name: Test integrations (sqlxguard)
38+
run: cd integrations/sqlxguard && go test ./... -count=1 -race
39+
40+
- name: Test integrations (pgxguard)
41+
run: cd integrations/pgxguard && go test ./... -count=1 -race
42+
43+
- name: Test integrations (bunguard)
44+
run: cd integrations/bunguard && go test ./... -count=1 -race
45+
46+
- name: Test integrations (xormguard)
47+
run: cd integrations/xormguard && go test ./... -count=1 -race
48+
49+
- name: Test integrations (entguard)
50+
run: cd integrations/entguard && go test ./... -count=1 -race
51+
52+
- name: Test parsers (pgparser)
53+
run: cd parsers/pgparser && go test ./... -count=1 -race
54+
55+
- name: Test parsers (mysqlparser)
56+
run: cd parsers/mysqlparser && go test ./... -count=1 -race
57+
58+
lint:
59+
runs-on: ubuntu-latest
60+
steps:
61+
- uses: actions/checkout@v6
62+
with:
63+
persist-credentials: false
64+
65+
- uses: actions/setup-go@v6
66+
with:
67+
go-version: "1.26"
68+
69+
- uses: golangci/golangci-lint-action@v9
70+
with:
71+
version: v2.11
72+
args: --timeout=5m
73+
74+
build:
75+
runs-on: ubuntu-latest
76+
steps:
77+
- uses: actions/checkout@v6
78+
with:
79+
persist-credentials: false
80+
81+
- uses: actions/setup-go@v6
82+
with:
83+
go-version: "1.26"
84+
85+
- name: Build CLI
86+
run: go build -o bin/sqlguard ./cmd/sqlguard
87+
88+
coverage:
89+
runs-on: ubuntu-latest
90+
steps:
91+
- uses: actions/checkout@v6
92+
with:
93+
persist-credentials: false
94+
95+
- uses: actions/setup-go@v6
96+
with:
97+
go-version: "1.26"
98+
99+
# `make coverage` runs every module and merges into a single coverage.out
100+
# (root go test does not reach the satellite modules).
101+
- name: Generate merged coverage
102+
run: make coverage
103+
104+
- name: Upload to Codecov
105+
uses: codecov/codecov-action@v5
106+
with:
107+
files: ./coverage.out
108+
token: ${{ secrets.CODECOV_TOKEN }}
109+
fail_ci_if_error: false

‎.github/workflows/codeql.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
# Weekly re-scan so newly published CodeQL queries flag old code too.
10+
- cron: "0 6 * * 1"
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: ${{ github.event_name != 'schedule' }}
15+
16+
permissions:
17+
# CodeQL requires security-events: write to upload SARIF results
18+
security-events: write
19+
contents: read
20+
21+
jobs:
22+
analyze:
23+
name: Analyze (Go)
24+
runs-on: ubuntu-latest
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@v6
28+
with:
29+
persist-credentials: false
30+
31+
- name: Setup Go
32+
uses: actions/setup-go@v6
33+
with:
34+
go-version: "1.26"
35+
36+
- name: Initialize CodeQL
37+
uses: github/codeql-action/init@v4
38+
with:
39+
languages: go
40+
# Build the modules ourselves (below) so the tracer sees all nine.
41+
build-mode: manual
42+
queries: security-extended
43+
44+
# Each integration/parser carries its own go.mod (heavy deps kept opt-in),
45+
# so `go build ./...` from root does NOT reach them. Build every module
46+
# under the CodeQL tracer so all nine are analyzed — same MODULES loop the
47+
# Makefile uses; a satellite must not silently skip scanning.
48+
- name: Build all modules
49+
run: |
50+
set -e
51+
for mod in . \
52+
./integrations/gormguard ./integrations/sqlxguard \
53+
./integrations/pgxguard ./integrations/bunguard \
54+
./integrations/xormguard ./integrations/entguard \
55+
./parsers/pgparser ./parsers/mysqlparser; do
56+
echo "==> Building $mod"
57+
(cd "$mod" && go build ./...)
58+
done
59+
60+
- name: Perform CodeQL Analysis
61+
uses: github/codeql-action/analyze@v4
62+
with:
63+
category: "/language:go"

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
*.dll
88
*.so
99
*.dylib
10+
bin
1011

1112
# Test binary, built with `go test -c`
1213
*.test
@@ -17,6 +18,9 @@ coverage.*
1718
*.coverprofile
1819
profile.cov
1920

21+
# FE
22+
sqlguard-website
23+
2024
# Dependency directories (remove the comment below to include it)
2125
# vendor/
2226

0 commit comments

Comments
 (0)