Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/go-reform/reform
A better ORM for Go and database/sql
.
It uses non-empty interfaces, code generation (go generate
), and initialization-time reflection
as opposed to interface{}
, type system sidestepping, and runtime reflection. It will be kept simple.
Supported SQL dialects:
RDBMS | Library and drivers | Status |
---|---|---|
PostgreSQL | github.com/lib/pq (postgres ) | Stable. Tested with all supported versions. |
github.com/jackc/pgx/stdlib (pgx v3) | Stable. Tested with all supported versions. | |
MySQL | github.com/go-sql-driver/mysql (mysql ) | Stable. Tested with all supported versions. |
SQLite3 | github.com/mattn/go-sqlite3 (sqlite3 ) | Stable. |
Microsoft SQL Server | github.com/denisenkom/go-mssqldb (sqlserver , mssql ) | Stable. Tested on Windows with: SQL2008R2SP2, SQL2012SP1, SQL2014, SQL2016. On Linux with: mcr.microsoft.com/mssql/server:2017-latest and mcr.microsoft.com/mssql/server:2019-latest Docker images. |
Notes:
clientFoundRows=true
flag is required for mysql
driver.mssql
driver is deprecated (but not sqlserver
driver).Make sure you are using Go 1.13+, and Go modules support is enabled.
Install or update reform
package, reform
and reform-db
commands with:
go get -v gopkg.in/reform.v1/...
If you are not using Go modules yet, you can use dep to vendor desired version of reform, and then install commands with:
go install -v ./vendor/gopkg.in/reform.v1/...
You can also install the latest stable version of reform without using Go modules thanks to gopkg.in redirection, but please note that this will not use the stable versions of the database drivers:
env GO111MODULE=off go get -u -v gopkg.in/reform.v1/...
Canonical import path is gopkg.in/reform.v1
; using github.com/go-reform/reform
will not work.
See note about versioning and branches below.
Use reform-db
command to generate models for your existing database schema. For example:
reform-db -db-driver=sqlite3 -db-source=example.sqlite3 init
Update generated models or write your own – struct
representing a table or view row. For example,
store this in file person.go
:
//go:generate reform
//reform:people
type Person struct {
ID int32 `reform:"id,pk"`
Name string `reform:"name"`
Email *string `reform:"email"`
CreatedAt time.Time `reform:"created_at"`
UpdatedAt *time.Time `reform:"updated_at"`
}
Magic comment //reform:people
links this model to people
table or view in SQL database.
The first value in field's reform
tag is a column name. pk
marks primary key.
Use value -
or omit tag completely to skip a field.
Use pointers (recommended) or sql.NullXXX
types for nullable fields.
Run reform [package or directory]
or go generate [package or file]
. This will create person_reform.go
in the same package with type PersonTable
and methods on Person
.
See documentation how to use it. Simple example:
// Get *sql.DB as usual. PostgreSQL example:
sqlDB, err := sql.Open("postgres", "postgres://127.0.0.1:5432/database")
if err != nil {
log.Fatal(err)
}
defer sqlDB.Close()
// Use new *log.Logger for logging.
logger := log.New(os.Stderr, "SQL: ", log.Flags())
// Create *reform.DB instance with simple logger.
// Any Printf-like function (fmt.Printf, log.Printf, testing.T.Logf, etc) can be used with NewPrintfLogger.
// Change dialect for other databases.
db := reform.NewDB(sqlDB, postgresql.Dialect, reform.NewPrintfLogger(logger.Printf))
// Save record (performs INSERT or UPDATE).
person := &Person{
Name: "Alexey Palazhchenko",
Email: pointer.ToString("alexey.palazhchenko@gmail.com"),
}
if err := db.Save(person); err != nil {
log.Fatal(err)
}
// ID is filled by Save.
person2, err := db.FindByPrimaryKeyFrom(PersonTable, person.ID)
if err != nil {
log.Fatal(err)
}
fmt.Println(person2.(*Person).Name)
// Delete record.
if err = db.Delete(person); err != nil {
log.Fatal(err)
}
// Find records by IDs.
persons, err := db.FindAllFrom(PersonTable, "id", 1, 2)
if err != nil {
log.Fatal(err)
}
for _, p := range persons {
fmt.Println(p)
}
reform was born during summer 2014 out of frustrations with existing Go ORMs. All of them have a method
Save(record interface{})
which can be used like this:
orm.Save(User{Name: "gopher"})
orm.Save(&User{Name: "gopher"})
orm.Save(nil)
orm.Save("Batman!!")
Now you can say that last invocation is obviously invalid, and that it's not hard to make an ORM to accept both first and second versions. But there are two problems:
godoc
will not tell us how to use it.
We are essentially working against those tools by sidestepping type system.Save()
method to set record's primary key after INSERT
,
but this change will be lost due to passing by value.First proprietary version of reform was used in production even before go generate
announcement.
This free and open-source version is the fourth milestone on the road to better and idiomatic API.
We are following Semantic Versioning, using gopkg.in and filling a changelog. All v1 releases are SemVer-compatible; breaking changes will not be applied.
We use tags v1.M.m
for releases, branch main
(default on GitHub) for the next minor release development,
and release/1.M
branches for patch release development. (It was more complicated before 1.4.0 release.)
Major version 2 is currently not planned.
pk
fields for Struct and exactly one pk
field for Record.
Composite primary keys are not supported (#114).pk
field can't be a pointer (== nil
doesn't work).Code is covered by standard MIT-style license. Copyright (c) 2016-2020 Alexey Palazhchenko. See LICENSE for details. Note that generated code is covered by the terms of your choice.
The reform gopher was drawn by Natalya Glebova. Please use it only as reform logo. It is based on the original design by Renée French, released under Creative Commons Attribution 3.0 USA license.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.