pgx PostgreSQL driver. Connection and Pool types expose Query/Exec/QueryRow that accept raw SQL strings — injection sinks when the SQL is built from user input. pgx is the recommended Postgres driver for new Go projects.
.Exec().Query().QueryRow().ExecEx().QueryEx().QueryRowEx().SendBatch().Prepare().Exec()SinkExec(ctx context.Context, sql string, args ...any) (CommandTag, error)
Executes SQL that doesn't return rows. Sink when sql is built from user input.
1.Query()SinkQuery(ctx context.Context, sql string, args ...any) (Rows, error)
Executes a query returning rows. SQL injection sink.
1.QueryRow()SinkQueryRow(ctx context.Context, sql string, args ...any) Row
Executes a query returning a single row. SQL injection sink.
1.ExecEx()SinkExecEx(ctx context.Context, sql string, options *QueryExOptions, args ...any) (CommandTag, error)
pgx v4 compatibility shim for Exec. Same injection risk.
1.QueryEx()SinkQueryEx(ctx context.Context, sql string, options *QueryExOptions, args ...any) (*Rows, error)
pgx v4 compatibility shim for Query. Same injection risk.
1.QueryRowEx()SinkQueryRowEx(ctx context.Context, sql string, options *QueryExOptions, args ...any) *Row
pgx v4 compatibility shim for QueryRow. Same injection risk.
1.SendBatch()SinkSendBatch(ctx context.Context, b *Batch) BatchResults
Sends a batch of queries. Each query in the batch can be an injection sink.
1.Prepare()SinkPrepare(ctx context.Context, name, sql string) (*StatementDescription, error)
Creates a prepared statement. Sink when sql is user-controlled.
2| FQN | Field | |
|---|---|---|
| github.com/jackc/pgx/v5.Conn | fqns[0] | |
| github.com/jackc/pgx/v5/pgxpool.Pool | fqns[1] | |
| *.Conn | patterns | |
| *.Pool | patterns |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
require github.com/jackc/pgx/v5 v5.5.5
from codepathfinder.go_rule import GoPgxConn