Skip to content

Go: Add models for Go 1.27 and expand models for strings package #22534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
owen-mc wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Go: Add models for Go 1.27 and expand models for strings package #22534

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
fbd27e4
Model `encoding/json/jsontext` package
owen-mc Sep 3, 2026
fd61ec0
Add models for new functions in Go 1.27
owen-mc Sep 4, 2026
36b2a86
More models for `strings` package
owen-mc Sep 9, 2026
77ee475
Add change note
owen-mc Sep 9, 2026
37a24ee
Initial plan
Copilot Sep 9, 2026
1dea92a
Address review feedback
Copilot Sep 9, 2026
e009997
Update expected test output for changed model
owen-mc Sep 10, 2026
ec18d5c
Change "clone" models from value to taint
owen-mc Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions go/ql/lib/change-notes/2026-09-09-go-1.27-models.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
---
category: minorAnalysis
---
* Added or improved data flow models for the following Go standard-library APIs introduced or updated in Go 1.27:
* `bytes.CutLast`, `database/sql.ConvertAssign`, `database/sql/driver.RowsColumnScanner.ScanColumn`, `net/url.URL.Clone`, `net/url.Values.Clone` and `strings.CutLast`.
* The new `encoding/json/jsontext` package.
* Added more data flow models for the `strings` package: `strings.Clone`, `Cut`, `CutPrefix`, `CutSuffix`, `Fields`, `FieldsFunc`, and `Join`; `strings.Builder.String`, `Builder.WriteByte`, and `Builder.WriteRune`; `strings.Reader.ReadByte` and `Reader.ReadRune`; and `strings.Replacer.Replace` and `Replacer.WriteString`.
1 change: 1 addition & 0 deletions go/ql/lib/ext/bytes.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ extensions:
data:
- ["bytes", "", False, "Clone", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["bytes", "", False, "Cut", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"]
- ["bytes", "", False, "CutLast", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"]
- ["bytes", "", False, "CutPrefix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
- ["bytes", "", False, "CutSuffix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
- ["bytes", "", False, "Fields", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
Expand Down
1 change: 1 addition & 0 deletions go/ql/lib/ext/database.sql.driver.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,5 +24,6 @@ extensions:
- ["database/sql/driver", "Conn", True, "Prepare", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
- ["database/sql/driver", "ConnPrepareContext", True, "PrepareContext", "", "", "Argument[1]", "ReturnValue[0]", "taint", "manual"]
- ["database/sql/driver", "Rows", True, "Next", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
- ["database/sql/driver", "RowsColumnScanner", True, "ScanColumn", "", "", "Argument[receiver]", "Argument[2]", "taint", "manual"]
- ["database/sql/driver", "ValueConverter", True, "ConvertValue", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
- ["database/sql/driver", "Valuer", True, "Value", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
1 change: 1 addition & 0 deletions go/ql/lib/ext/database.sql.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ extensions:
pack: codeql/go-all
extensible: summaryModel
data:
- ["database/sql", "", False, "ConvertAssign", "", "", "Argument[2]", "Argument[1]", "taint", "manual"]
- ["database/sql", "", False, "Named", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
- ["database/sql", "Conn", True, "PrepareContext", "", "", "Argument[1]", "ReturnValue[0]", "taint", "manual"]
- ["database/sql", "DB", True, "Prepare", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
Expand Down
36 changes: 36 additions & 0 deletions go/ql/lib/ext/encoding.json.jsontext.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
extensions:
- addsTo:
pack: codeql/go-all
extensible: summaryModel
data:
- ["encoding/json/jsontext", "", False, "AppendFloat", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "", False, "AppendFormat", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"]
- ["encoding/json/jsontext", "", False, "AppendQuote", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"]
- ["encoding/json/jsontext", "", False, "AppendUnquote", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"]
Comment thread
owen-mc marked this conversation as resolved.
- ["encoding/json/jsontext", "", False, "NewDecoder", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "", False, "Float", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "", False, "Float32", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "", False, "Int", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "", False, "String", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "", False, "Uint", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Decoder", True, "ReadToken", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["encoding/json/jsontext", "Decoder", True, "ReadValue", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["encoding/json/jsontext", "Decoder", True, "Reset", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
- ["encoding/json/jsontext", "Decoder", True, "UnreadBuffer", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Encoder", True, "Reset", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
- ["encoding/json/jsontext", "Encoder", True, "WriteToken", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
- ["encoding/json/jsontext", "Encoder", True, "WriteValue", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
- ["encoding/json/jsontext", "Pointer", True, "AppendToken", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Pointer", True, "AppendToken", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Pointer", True, "LastToken", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Pointer", True, "Parent", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Token", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Token", True, "Float", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["encoding/json/jsontext", "Token", True, "Float32", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["encoding/json/jsontext", "Token", True, "Int", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["encoding/json/jsontext", "Token", True, "String", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Token", True, "Uint", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["encoding/json/jsontext", "Value", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Value", True, "MarshalJSON", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["encoding/json/jsontext", "Value", True, "String", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["encoding/json/jsontext", "Value", True, "UnmarshalJSON", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
2 changes: 2 additions & 0 deletions go/ql/lib/ext/net.url.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ extensions:
- ["net/url", "", False, "QueryUnescape", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
- ["net/url", "", False, "User", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["net/url", "", False, "UserPassword", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
- ["net/url", "URL", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["net/url", "URL", True, "EscapedPath", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["net/url", "URL", True, "Hostname", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["net/url", "URL", True, "MarshalBinary", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
Expand All @@ -24,5 +25,6 @@ extensions:
- ["net/url", "URL", True, "ResolveReference", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["net/url", "Userinfo", True, "Password", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["net/url", "Userinfo", True, "Username", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["net/url", "Values", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["net/url", "Values", True, "Encode", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["net/url", "Values", True, "Get", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
19 changes: 16 additions & 3 deletions go/ql/lib/ext/strings.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,15 @@ extensions:
pack: codeql/go-all
extensible: summaryModel
data:
- ["strings", "", False, "Fields", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["strings", "", False, "FieldsFunc", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["strings", "", False, "Join", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
- ["strings", "", False, "Clone", "", "", "Argument[0]", "ReturnValue", "value", "manual"]
- ["strings", "", False, "Cut", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"]
- ["strings", "", False, "CutLast", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"]
- ["strings", "", False, "CutPrefix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
- ["strings", "", False, "CutSuffix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
- ["strings", "", False, "Fields", "", "", "Argument[0]", "ReturnValue.ArrayElement", "taint", "manual"]
- ["strings", "", False, "FieldsFunc", "", "", "Argument[0]", "ReturnValue.ArrayElement", "taint", "manual"]
Comment thread
owen-mc marked this conversation as resolved.
- ["strings", "", False, "Join", "", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"]
- ["strings", "", False, "Join", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
Comment thread
owen-mc marked this conversation as resolved.
- ["strings", "", False, "Map", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
- ["strings", "", False, "NewReader", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["strings", "", False, "Repeat", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
Expand Down Expand Up @@ -34,6 +40,13 @@ extensions:
- ["strings", "", False, "TrimRightFunc", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["strings", "", False, "TrimSpace", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["strings", "", False, "TrimSuffix", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["strings", "Builder", True, "String", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["strings", "Builder", True, "WriteByte", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
- ["strings", "Builder", True, "WriteRune", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
- ["strings", "Reader", True, "ReadByte", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["strings", "Reader", True, "ReadRune", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
- ["strings", "Reader", True, "Reset", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
- ["strings", "Replacer", True, "Replace", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
- ["strings", "Replacer", True, "Replace", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["strings", "Replacer", True, "WriteString", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
- ["strings", "Replacer", True, "WriteString", "", "", "Argument[1]", "Argument[0]", "taint", "manual"]
12 changes: 9 additions & 3 deletions go/ql/lib/semmle/go/frameworks/stdlib/EncodingJson.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,15 @@ module EncodingJson {
FunctionOutput outp;

FunctionModels() {
// signature: func NewEncoder(w io.Writer) *Encoder
this.hasQualifiedName("encoding/json", "NewEncoder") and
(inp.isResult() and outp.isParameter(0))
(
// signature: func NewEncoder(w io.Writer) *Encoder
this.hasQualifiedName("encoding/json", "NewEncoder")
or
// signature: func NewEncoder(w io.Writer, opts ...Options) *Encoder
this.hasQualifiedName("encoding/json/jsontext", "NewEncoder")
Comment thread
owen-mc marked this conversation as resolved.
) and
inp.isResult() and
outp.isParameter(0)
}

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
Expand Down
24 changes: 24 additions & 0 deletions go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 15 additions & 1 deletion go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 12 additions & 0 deletions go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading