Rust: Re-categorize tokio-postgres sources as remote.

rust/ql/lib/codeql/rust/frameworks/tokio-postgres.model.yml

@@ -20,5 +20,5 @@ extensions:
       pack: codeql/rust-all
       extensible: sourceModel
     data:
-      - ["repo:https://github.com/sfackler/rust-postgres:tokio-postgres", "<crate::row::Row>::get", "ReturnValue", "database", "manual"]
-      - ["repo:https://github.com/sfackler/rust-postgres:tokio-postgres", "<crate::row::Row>::try_get", "ReturnValue.Variant[crate::result::Result::Ok(0)]", "database", "manual"]
+      - ["repo:https://github.com/sfackler/rust-postgres:tokio-postgres", "<crate::row::Row>::get", "ReturnValue", "remote", "manual"]
+      - ["repo:https://github.com/sfackler/rust-postgres:tokio-postgres", "<crate::row::Row>::try_get", "ReturnValue.Variant[crate::result::Result::Ok(0)]", "remote", "manual"]

rust/ql/test/library-tests/frameworks/postgres/Postgres.ql

@@ -4,7 +4,7 @@ import codeql.rust.security.SqlInjectionExtensions
 import utils.test.InlineExpectationsTest
 
 module PostgresTest implements TestSig {
-  string getARelevantTag() { result = ["sql-sink", "database-read"] }
+  string getARelevantTag() { result = ["sql-sink", "source"] }
 
   predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(SqlInjection::Sink sink |
@@ -15,11 +15,11 @@ module PostgresTest implements TestSig {
       value = ""
     )
     or
-    exists(ModeledDatabaseSource source |
+    exists(ThreatModelSource source |
       location = source.getLocation() and
       location.getFile().getBaseName() != "" and
       element = source.toString() and
-      tag = "database-read" and
+      tag = "source" and
       value = ""
     )
   }

rust/ql/test/library-tests/frameworks/postgres/main.rs

@@ -2,7 +2,7 @@
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     // Get input from CLI
-    let args: Vec<String> = std::env::args().collect();
+    let args: Vec<String> = std::env::args().collect(); // $ source
     let name = &args[1];
     let age = &args[2];
 
@@ -16,7 +16,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         )",
         &[],
     )?;
-    
+
     let query = format!("INSERT INTO person (name, age) VALUES ('{}', '{}')", name, age);
 
     conn.execute(query.as_str(), &[])?;     // $ sql-sink
@@ -33,11 +33,11 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     // conn.query_typed_raw(query.as_str(), &[])?;
 
     for row in &conn.query("SELECT id, name, age FROM person", &[])? {  // $ sql-sink
-        let id: i32 = row.get("id");        // $ database-read
-        let name: &str = row.try_get("name")?;   // $ database-read
-        let age: i32 = row.try_get("age").unwrap();      // $ database-read
+        let id: i32 = row.get("id");        // $ source
+        let name: &str = row.try_get("name")?;   // $ source
+        let age: i32 = row.try_get("age").unwrap();      // $ source
         println!("found person: {} {} {}", id, name, age);
     }
 
     Ok(())
-}
+}