{"id":18779306,"url":"https://github.com/zostay/gormless","last_synced_at":"2025-12-17T23:30:16.798Z","repository":{"id":253576317,"uuid":"843913190","full_name":"zostay/gormless","owner":"zostay","description":"Fixing gorm's code safety problems with extreme prejudice","archived":false,"fork":false,"pushed_at":"2024-08-20T05:50:33.000Z","size":54,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-12-29T10:28:51.431Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zostay.png","metadata":{"files":{"readme":"README.md","changelog":"Changes.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-17T19:51:44.000Z","updated_at":"2024-08-20T05:45:14.000Z","dependencies_parsed_at":"2024-08-20T07:41:57.786Z","dependency_job_id":null,"html_url":"https://github.com/zostay/gormless","commit_stats":null,"previous_names":["zostay/gormless"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zostay%2Fgormless","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zostay%2Fgormless/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zostay%2Fgormless/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zostay%2Fgormless/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zostay","download_url":"https://codeload.github.com/zostay/gormless/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239690521,"owners_count":19681117,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-07T20:19:34.893Z","updated_at":"2025-12-17T23:30:16.758Z","avatar_url":"https://github.com/zostay.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Gormless\n\nThe purpose of this library is to provide a wrapper that helps prevent SQL\ninjection risks. I do not feel like Gorm takes this risk seriously enough,\nparticularly in these methods:\n\n* `First`\n* `Take`\n* `Last`\n* `Find`\n\nBut I've layered in the `safesql` library to help prevent SQL injection risks\nin all methods. So, if you want the benefits of using Gorm, but also care about\nsecurity in the way I do, I welcome you to use this library.\n\nThis is such an obvious idea that I'm sure it's been done, but I can't find it.\nGorm Gen will help get you some of the safety that this gives, but this gives it \nto you with Gorm itself (all the same capabilities, but with a couple minor \nchanges).\n\n# Installation\n\n```sh\ngo get github.com/zostay/gormless\n```\n\n# Usage\n\n```go\npackage main\n\nimport (\n    \"fmt\"\n    \"os\"\n    \n    \"gorm.io/driver/sqlite\"\n    \"gorm.io/gorm\"\n    \"github.com/google/go-safeweb/safesql\"\n    \"github.com/zostay/gormless\"\n)\n\ntype User struct {\n    ID   int\n    Name string\n}\n\nfunc main() {\n    if len(os.Args) != 2 {\n        fmt.Println(\"usage: \", os.Args[0], \" \u003cid\u003e\")\n        os.Exit(1)\n    }\n    \n    unsafeDB, err := gorm.Open(sqlite.Open(\"test.db\"), \u0026gorm.Config{})\n    if err != nil {\n        panic(\"failed to connect database: \" + err.Error())\n    }\n    \n    db := gormless.New(unsafeDB)\n    \n    var u User\n    err = db.First(\u0026u, safesql.New(\"id = ?\"), os.Args[1]).Error()\n    if err != nil {\n        panic(\"failed to read user: \" + err.Error())\n    }   \n\n    fmt.Println(\"Name:\", u.Name)\n}\n```\n\n# The Problem\n\nIf you read the Gorm documentation carefully (and you absolutely should because\nof this problem), you will find the [Security](https://gorm.io/docs/security.html)\npage. On it, it is revealed that SQL injection is considered a feature of Gorm.\n\nFor a reminder of what SQL injection is, see XKCD's [Exploits of a Mom](https://xkcd.com/327/).\n\n![A comic about a mom who destroys the school database because she named her boy \"Robert'); DROP TABLE Students;--\"](https://imgs.xkcd.com/comics/exploits_of_a_mom.png)\n\nThe gorm devs do not consider this to be a vulnerability, but they are simply \nwrong. SQL injection is an obvious issue with a method like `db.Where` or \n`db.Raw` where you know you're writing a raw SQL query. If these were the\nmethods we were talking about, I have concerns to make sure devs use them\ncarefully, but I wouldn't say they are inherently vulnerable.\n\nHowever, if you have a method that is safe under some circumstances, but not\nunder others, that is a vulnerability. Consider the following program:\n\n```go\n// BAD CODE DO NOT USE!!!\n\npackage main\n\nimport (\n    \"fmt\"\n    \"os\"\n\n    \"gorm.io/driver/sqlite\"\n    \"gorm.io/gorm\"\n)\n\ntype User struct {\n    ID   int\n    Name string\n}\n\nfunc main() {\n    if len(os.Args) != 2 {\n        fmt.Println(\"usage: \", os.Args[0], \" \u003cid\u003e\")\n        os.Exit(1)\n    }\n\n    db, err := gorm.Open(sqlite.Open(\"test.db\"), \u0026gorm.Config{})\n    if err != nil {\n        panic(\"failed to connect database: \" + err.Error())\n    }\n\n    // VERY BAD CODE HERE!!! DO NOT USE!!!\n    var u User\n    err = db.First(\u0026u, os.Args[1]).Error // \u003c=== VULNERABILITY HERE\n    if err != nil {\n        panic(\"failed to read user: \" + err.Error())\n    }\n\n    fmt.Println(\"Name:\", u.Name)\n}\n```\n\nRun this like so and you'll see the problem:\n\n```sh\ngo run main.go \"1; drop table users\"\n```\n\nThe most strident commentary when this issue is raised\nwas, [\"Absolutely, this is bad API design, but it's not a vulnerability.\"](https://github.com/go-gorm/gorm/issues/2517#issuecomment-638459166). The Gorm devs' solution\nwas to provide the security page linked above. That's not a solution. That's\nnegligence. I've given talks on\nthe [OWASP Top 10](https://owasp.org/www-project-top-ten/) for more than a\ndecade. This\nexact problem, code injection generally and SQL injection particularly, remains\none of the top issues in applications today for all this time because devs like\nthose working on Gorm have continually avoided taking it seriously.\n\nRegarding this being bad API design and not a vulnerability, I quote Dwight \nSchrute, \"False.\" It ceases to be bad API design when you realize \nthat the various `First`, `Find`, etc. methods actually look at the input and \ntry to magically decide how to treat the input. For example,\n\n * If the input is an `int`, it turns into something like `id = \u003cinput\u003e`. \n * If it's a `string` containing a \"?\", it treats it as a prepared statement with bindings. \n * If it's some other string, it might treat it as the `id = \u003cinput\u003e` case or it might\ntreat it as a raw SQL query. \n\nThat is the absolute definition of a SQL injection vulnerability. If the input \nis safe some of the time, but not all of the, that's SQL injection. They have\ncreated the illusion of safety where it is most certainly not safe, which is\nwhat creates a vulnerability. That's not even an opinion, but clear fact, as far\nas I'm concerned.\n\nTo me, part of the purpose of using an ORM rather than raw SQL and a language \nlike Go instead of C is to avoid footguns as big as this one. So...\n\n# The Solution\n\nSince the authors of Gorm seem unwilling to fix this or to even admit that need\na v3 that obliterate this \"bad API design.\" I have created this library named\nGormless. I'll let you interpret the name as you will.\n\nThis is a straight up wrapper of `gorm.DB` that adds in the powers\nof `google.com/go-safeweb/safesql`\nand neuters the unsafe syntax. If you want to get back to the unsafe syntax,\nyou can call `Unsafe()` on the `gormless.DB` object.\n\nThis package is built using code generation using reflection, so it should be\nable to keep up with Gorm's changes. If it doesn't, please file an issue.\n\nThis solution is absolutely overkill. It's a sledgehammer to a nail. All that\nreally needs to be fixed to resolve the major issue is the `First`, `Find`, and\nother methods that might be safe sometimes, but not all the time. On the other\nhande, `safesql` is a brilliantly simple solution to add in, so why not?\n\n# Patches Welcome\n\nIf there's something you cannot do with this library in place without\ncalling `Unsafe()` that you believe is safe. Please submit a PR and I will \nhappily add it in, so long as it doesn't reintroduce the vulnerability.\n\n# Callback Support\n\nThis library is unable to support the `gorm.DB.Callback` method. This is due to\nthe fact that that method returns a private type, so it can't be wrapped in a\nstraight-forward fashion. Anyway, I can think of a few workarounds, but I just\nwant to highlight here that lack of callback support is deliberate at this time.\n\n# License\n\nCopyright © 2024 Qubling LLC\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the “Software”), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzostay%2Fgormless","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzostay%2Fgormless","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzostay%2Fgormless/lists"}