Skip to content

Commit 2fd8e6d

Browse files
Copilotowen-mc
Copilot
and
owen-mc
authored
Address review feedback: drop jsontext Pointer.Tokens model, add jsontext tests, fix strings Fields tests
Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>
1 parent be10bbb commit 2fd8e6d

16 files changed

Lines changed: 698 additions & 12 deletions

File tree

‎go/ql/lib/change-notes/2026-09-09-go-1.27-models.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added or improved data flow models for the following Go standard-library APIs introduced or updated in Go 1.27:
5+
* `bytes.CutLast`, `database/sql.ConvertAssign`, `database/sql/driver.RowsColumnScanner.ScanColumn`, `net/url.URL.Clone`, `net/url.Values.Clone` and `strings.CutLast`.
6+
* The new `encoding/json/jsontext` package.
7+
* Added more data flow models for the `strings` package: `strings.Clone`, `Cut`, `CutPrefix`, `CutSuffix`, `Fields`, `FieldsFunc`, and `Join`; `strings.Builder.String`, `Builder.WriteByte`, and `Builder.WriteRune`; `strings.Reader.ReadByte` and `Reader.ReadRune`; and `strings.Replacer.Replace` and `Replacer.WriteString`.

‎go/ql/lib/ext/bytes.model.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ extensions:
55
data:
66
- ["bytes", "", False, "Clone", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
77
- ["bytes", "", False, "Cut", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"]
8+
- ["bytes", "", False, "CutLast", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"]
89
- ["bytes", "", False, "CutPrefix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
910
- ["bytes", "", False, "CutSuffix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
1011
- ["bytes", "", False, "Fields", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

‎go/ql/lib/ext/database.sql.driver.model.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,5 +24,6 @@ extensions:
2424
- ["database/sql/driver", "Conn", True, "Prepare", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
2525
- ["database/sql/driver", "ConnPrepareContext", True, "PrepareContext", "", "", "Argument[1]", "ReturnValue[0]", "taint", "manual"]
2626
- ["database/sql/driver", "Rows", True, "Next", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
27+
- ["database/sql/driver", "RowsColumnScanner", True, "ScanColumn", "", "", "Argument[receiver]", "Argument[2]", "taint", "manual"]
2728
- ["database/sql/driver", "ValueConverter", True, "ConvertValue", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
2829
- ["database/sql/driver", "Valuer", True, "Value", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]

‎go/ql/lib/ext/database.sql.model.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ extensions:
4949
pack: codeql/go-all
5050
extensible: summaryModel
5151
data:
52+
- ["database/sql", "", False, "ConvertAssign", "", "", "Argument[2]", "Argument[1]", "taint", "manual"]
5253
- ["database/sql", "", False, "Named", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
5354
- ["database/sql", "Conn", True, "PrepareContext", "", "", "Argument[1]", "ReturnValue[0]", "taint", "manual"]
5455
- ["database/sql", "DB", True, "Prepare", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]

‎go/ql/lib/ext/encoding.json.jsontext.model.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: summaryModel
5+
data:
6+
- ["encoding/json/jsontext", "", False, "AppendFloat", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
7+
- ["encoding/json/jsontext", "", False, "AppendFormat", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"]
8+
- ["encoding/json/jsontext", "", False, "AppendQuote", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"]
9+
- ["encoding/json/jsontext", "", False, "AppendUnquote", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"]
10+
- ["encoding/json/jsontext", "", False, "NewDecoder", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
11+
- ["encoding/json/jsontext", "", False, "Float", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
12+
- ["encoding/json/jsontext", "", False, "Float32", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
13+
- ["encoding/json/jsontext", "", False, "Int", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
14+
- ["encoding/json/jsontext", "", False, "String", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
15+
- ["encoding/json/jsontext", "", False, "Uint", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
16+
- ["encoding/json/jsontext", "Decoder", True, "ReadToken", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
17+
- ["encoding/json/jsontext", "Decoder", True, "ReadValue", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
18+
- ["encoding/json/jsontext", "Decoder", True, "Reset", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
19+
- ["encoding/json/jsontext", "Decoder", True, "UnreadBuffer", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
20+
- ["encoding/json/jsontext", "Encoder", True, "Reset", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
21+
- ["encoding/json/jsontext", "Encoder", True, "WriteToken", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
22+
- ["encoding/json/jsontext", "Encoder", True, "WriteValue", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
23+
- ["encoding/json/jsontext", "Pointer", True, "AppendToken", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
24+
- ["encoding/json/jsontext", "Pointer", True, "AppendToken", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
25+
- ["encoding/json/jsontext", "Pointer", True, "LastToken", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
26+
- ["encoding/json/jsontext", "Pointer", True, "Parent", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
27+
- ["encoding/json/jsontext", "Token", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
28+
- ["encoding/json/jsontext", "Token", True, "Float", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
29+
- ["encoding/json/jsontext", "Token", True, "Float32", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
30+
- ["encoding/json/jsontext", "Token", True, "Int", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
31+
- ["encoding/json/jsontext", "Token", True, "String", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
32+
- ["encoding/json/jsontext", "Token", True, "Uint", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
33+
- ["encoding/json/jsontext", "Value", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
34+
- ["encoding/json/jsontext", "Value", True, "MarshalJSON", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
35+
- ["encoding/json/jsontext", "Value", True, "String", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
36+
- ["encoding/json/jsontext", "Value", True, "UnmarshalJSON", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]

‎go/ql/lib/ext/net.url.model.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ extensions:
1212
- ["net/url", "", False, "QueryUnescape", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
1313
- ["net/url", "", False, "User", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
1414
- ["net/url", "", False, "UserPassword", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
15+
- ["net/url", "URL", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "value", "manual"]
1516
- ["net/url", "URL", True, "EscapedPath", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
1617
- ["net/url", "URL", True, "Hostname", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
1718
- ["net/url", "URL", True, "MarshalBinary", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
@@ -24,5 +25,6 @@ extensions:
2425
- ["net/url", "URL", True, "ResolveReference", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
2526
- ["net/url", "Userinfo", True, "Password", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
2627
- ["net/url", "Userinfo", True, "Username", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
28+
- ["net/url", "Values", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "value", "manual"]
2729
- ["net/url", "Values", True, "Encode", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
2830
- ["net/url", "Values", True, "Get", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]

‎go/ql/lib/ext/strings.model.yml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,15 @@ extensions:
33
pack: codeql/go-all
44
extensible: summaryModel
55
data:
6-
- ["strings", "", False, "Fields", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
7-
- ["strings", "", False, "FieldsFunc", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
8-
- ["strings", "", False, "Join", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
6+
- ["strings", "", False, "Clone", "", "", "Argument[0]", "ReturnValue", "value", "manual"]
7+
- ["strings", "", False, "Cut", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"]
8+
- ["strings", "", False, "CutLast", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"]
9+
- ["strings", "", False, "CutPrefix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
10+
- ["strings", "", False, "CutSuffix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
11+
- ["strings", "", False, "Fields", "", "", "Argument[0]", "ReturnValue.ArrayElement", "taint", "manual"]
12+
- ["strings", "", False, "FieldsFunc", "", "", "Argument[0]", "ReturnValue.ArrayElement", "taint", "manual"]
13+
- ["strings", "", False, "Join", "", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"]
14+
- ["strings", "", False, "Join", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
915
- ["strings", "", False, "Map", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
1016
- ["strings", "", False, "NewReader", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
1117
- ["strings", "", False, "Repeat", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
@@ -34,6 +40,13 @@ extensions:
3440
- ["strings", "", False, "TrimRightFunc", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
3541
- ["strings", "", False, "TrimSpace", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
3642
- ["strings", "", False, "TrimSuffix", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
43+
- ["strings", "Builder", True, "String", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
44+
- ["strings", "Builder", True, "WriteByte", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
45+
- ["strings", "Builder", True, "WriteRune", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
46+
- ["strings", "Reader", True, "ReadByte", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
47+
- ["strings", "Reader", True, "ReadRune", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
3748
- ["strings", "Reader", True, "Reset", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
49+
- ["strings", "Replacer", True, "Replace", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
3850
- ["strings", "Replacer", True, "Replace", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
51+
- ["strings", "Replacer", True, "WriteString", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
3952
- ["strings", "Replacer", True, "WriteString", "", "", "Argument[1]", "Argument[0]", "taint", "manual"]

‎go/ql/lib/semmle/go/frameworks/stdlib/EncodingJson.qll‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,15 @@ module EncodingJson {
4141
FunctionOutput outp;
4242

4343
FunctionModels() {
44-
// signature: func NewEncoder(w io.Writer) *Encoder
45-
this.hasQualifiedName("encoding/json", "NewEncoder") and
46-
(inp.isResult() and outp.isParameter(0))
44+
(
45+
// signature: func NewEncoder(w io.Writer) *Encoder
46+
this.hasQualifiedName("encoding/json", "NewEncoder")
47+
or
48+
// signature: func NewEncoder(w io.Writer, opts ...Options) *Encoder
49+
this.hasQualifiedName("encoding/json/jsontext", "NewEncoder")
50+
) and
51+
inp.isResult() and
52+
outp.isParameter(0)
4753
}
4854

4955
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

‎go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go‎

Lines changed: 24 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go‎

Lines changed: 15 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)