Skip to content

Commit 25195bb

Browse files
smowtonsmowton
authored
Merge pull request #10103 from smowton/smowton/feature/golang-1.19-support
Go: support go 1.19
2 parents eadd85b + e5370a0 commit 25195bb

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

85 files changed

+5262
-1285
lines changed

‎.github/workflows/go-tests.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ jobs:
1111
name: Test Linux (Ubuntu)
1212
runs-on: ubuntu-latest
1313
steps:
14-
- name: Set up Go 1.18.1
14+
- name: Set up Go 1.19
1515
uses: actions/setup-go@v3
1616
with:
17-
go-version: 1.18.1
17+
go-version: 1.19
1818
id: go
1919

2020
- name: Check out code
@@ -57,10 +57,10 @@ jobs:
5757
name: Test MacOS
5858
runs-on: macos-latest
5959
steps:
60-
- name: Set up Go 1.18.1
60+
- name: Set up Go 1.19
6161
uses: actions/setup-go@v3
6262
with:
63-
go-version: 1.18.1
63+
go-version: 1.19
6464
id: go
6565

6666
- name: Check out code
@@ -87,10 +87,10 @@ jobs:
8787
name: Test Windows
8888
runs-on: windows-2019
8989
steps:
90-
- name: Set up Go 1.18.1
90+
- name: Set up Go 1.19
9191
uses: actions/setup-go@v3
9292
with:
93-
go-version: 1.18.1
93+
go-version: 1.19
9494
id: go
9595

9696
- name: Check out code

‎go/extractor/srcarchive/projectlayout.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ import (
1111
// ProjectLayout describes a very simple project layout rewriting paths starting
1212
// with `from` to start with `to` instead.
1313
//
14-
// We currently only support project layouts of the form
14+
// We currently only support project layouts of the form:
1515
//
16-
// # to
17-
// from//
16+
// # to
17+
// from//
1818
type ProjectLayout struct {
1919
from, to string
2020
}

‎go/go.mod

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ module github.com/github/codeql-go
33
go 1.18
44

55
require (
6-
golang.org/x/mod v0.5.0
7-
golang.org/x/tools v0.1.5
6+
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4
7+
golang.org/x/tools v0.1.12
88
)
99

1010
require (
11-
golang.org/x/sys v0.0.0-20210510120138-977fb7262007 // indirect
11+
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f // indirect
1212
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
1313
)

‎go/go.sum

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
44
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
55
golang.org/x/mod v0.5.0 h1:UG21uOlmZabA4fW5i7ZX6bjw1xELEGg/ZLgZq9auk/Q=
66
golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
7+
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 h1:6zppjxzCulZykYSLyVDYbneBfbaBIQPYMevg0bEwv2s=
8+
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
79
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
810
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
911
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
@@ -15,13 +17,17 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
1517
golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
1618
golang.org/x/sys v0.0.0-20210510120138-977fb7262007 h1:gG67DSER+11cZvqIMb8S8bt0vZtiN6xWYARwirrOSfE=
1719
golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
20+
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f h1:v4INt8xihDGvnrfjMDVXGxw9wrfxYyCjk0KbXjhR55s=
21+
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
1822
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
1923
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
2024
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
2125
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
2226
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
2327
golang.org/x/tools v0.1.5 h1:ouewzE6p+/VEB31YYnTbEJdi8pFqKp4P4n85vwo3DHA=
2428
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
29+
golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
30+
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
2531
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
2632
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
2733
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=

‎go/ql/lib/change-notes/2022-08-19-go-119-support.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Go 1.19 is now supported, including adding new taint propagation steps for new standard-library functions introduced in this release.

‎go/ql/lib/semmle/go/frameworks/Stdlib.qll

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,25 @@ module URL {
170170
}
171171
}
172172

173+
/** The `JoinPath` function. */
174+
class JoinPath extends TaintTracking::FunctionModel {
175+
JoinPath() { this.hasQualifiedName("net/url", "JoinPath") }
176+
177+
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
178+
inp.isParameter(_) and outp.isResult(0)
179+
}
180+
}
181+
182+
/** The method `URL.JoinPath`. */
183+
class JoinPathMethod extends TaintTracking::FunctionModel, Method {
184+
JoinPathMethod() { this.hasQualifiedName("net/url", "URL", "JoinPath") }
185+
186+
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
187+
(inp.isReceiver() or inp.isParameter(_)) and
188+
outp.isResult(0)
189+
}
190+
}
191+
173192
/** A method that returns a part of a URL. */
174193
class UrlGetter extends TaintTracking::FunctionModel, Method {
175194
UrlGetter() {

‎go/ql/lib/semmle/go/frameworks/stdlib/Fmt.qll

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,24 +6,20 @@ import go
66

77
/** Provides models of commonly used functions in the `fmt` package. */
88
module Fmt {
9-
/** The `Sprint` function or one of its variants. */
10-
class Sprinter extends TaintTracking::FunctionModel {
11-
Sprinter() {
12-
// signature: func Sprint(a ...interface{}) string
13-
this.hasQualifiedName("fmt", "Sprint")
14-
or
15-
// signature: func Sprintf(format string, a ...interface{}) string
16-
this.hasQualifiedName("fmt", "Sprintf")
17-
or
18-
// signature: func Sprintln(a ...interface{}) string
19-
this.hasQualifiedName("fmt", "Sprintln")
20-
}
9+
/** The `Sprint` or `Append` functions or one of their variants. */
10+
class AppenderOrSprinter extends TaintTracking::FunctionModel {
11+
AppenderOrSprinter() { this.hasQualifiedName("fmt", ["Append", "Sprint"] + ["", "f", "ln"]) }
2112

2213
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
2314
inp.isParameter(_) and outp.isResult()
2415
}
2516
}
2617

18+
/** The `Sprint` function or one of its variants. */
19+
class Sprinter extends AppenderOrSprinter {
20+
Sprinter() { this.getName().matches("Sprint%") }
21+
}
22+
2723
/** The `Print` function or one of its variants. */
2824
class Printer extends Function {
2925
Printer() { this.hasQualifiedName("fmt", ["Print", "Printf", "Println"]) }

‎go/ql/lib/semmle/go/frameworks/stdlib/SyncAtomic.qll

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,15 @@ module SyncAtomic {
6969
FunctionOutput outp;
7070

7171
MethodModels() {
72-
// signature: func (*Value) Load() (x interface{})
73-
hasQualifiedName("sync/atomic", "Value", "Load") and
74-
(inp.isReceiver() and outp.isResult())
75-
or
76-
// signature: func (*Value) Store(x interface{})
77-
hasQualifiedName("sync/atomic", "Value", "Store") and
78-
(inp.isParameter(0) and outp.isReceiver())
72+
exists(string containerType | containerType = ["Value", "Pointer", "Uintptr"] |
73+
// signature: func (*Containertype) Load/Swap() (x containedtype)
74+
hasQualifiedName("sync/atomic", containerType, ["Load", "Swap"]) and
75+
(inp.isReceiver() and outp.isResult())
76+
or
77+
// signature: func (*Containertype) Store/Swap(x containedtype) [(x containedtype)]
78+
hasQualifiedName("sync/atomic", containerType, ["Store", "Swap"]) and
79+
(inp.isParameter(0) and outp.isReceiver())
80+
)
7981
}
8082

8183
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

‎go/ql/src/Security/CWE-352/ConstantOauth2State.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ class PrivateUrlFlowsToAuthCodeUrlCall extends DataFlow::Configuration {
106106
TaintTracking::referenceStep(pred, succ)
107107
or
108108
// Propagate across Sprintf and similar calls
109-
any(Fmt::Sprinter s).taintStep(pred, succ)
109+
any(Fmt::AppenderOrSprinter s).taintStep(pred, succ)
110110
}
111111

112112
predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {

‎go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalFlowStep.expected

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,15 @@
22
| file://:0:0:0:0 | function EscapedPath | url.go:28:14:28:26 | selection of EscapedPath |
33
| file://:0:0:0:0 | function Get | url.go:52:14:52:18 | selection of Get |
44
| file://:0:0:0:0 | function Hostname | url.go:29:14:29:23 | selection of Hostname |
5+
| file://:0:0:0:0 | function JoinPath | url.go:57:16:57:27 | selection of JoinPath |
6+
| file://:0:0:0:0 | function JoinPath | url.go:58:16:58:27 | selection of JoinPath |
7+
| file://:0:0:0:0 | function JoinPath | url.go:60:15:60:28 | selection of JoinPath |
8+
| file://:0:0:0:0 | function JoinPath | url.go:66:9:66:25 | selection of JoinPath |
59
| file://:0:0:0:0 | function MarshalBinary | url.go:30:11:30:25 | selection of MarshalBinary |
610
| file://:0:0:0:0 | function Parse | url.go:23:10:23:18 | selection of Parse |
711
| file://:0:0:0:0 | function Parse | url.go:32:9:32:15 | selection of Parse |
12+
| file://:0:0:0:0 | function Parse | url.go:59:14:59:22 | selection of Parse |
13+
| file://:0:0:0:0 | function Parse | url.go:65:17:65:25 | selection of Parse |
814
| file://:0:0:0:0 | function ParseQuery | url.go:50:10:50:23 | selection of ParseQuery |
915
| file://:0:0:0:0 | function ParseRequestURI | url.go:27:9:27:27 | selection of ParseRequestURI |
1016
| file://:0:0:0:0 | function Password | url.go:43:11:43:21 | selection of Password |
@@ -164,3 +170,17 @@
164170
| url.go:50:2:50:2 | definition of v | url.go:52:14:52:14 | v |
165171
| url.go:50:2:50:2 | definition of v | url.go:53:9:53:9 | v |
166172
| url.go:50:2:50:26 | ... := ...[0] | url.go:50:2:50:2 | definition of v |
173+
| url.go:56:12:56:12 | argument corresponding to q | url.go:56:12:56:12 | definition of q |
174+
| url.go:56:12:56:12 | definition of q | url.go:57:29:57:29 | q |
175+
| url.go:57:2:57:8 | definition of joined1 | url.go:58:38:58:44 | joined1 |
176+
| url.go:57:2:57:39 | ... := ...[0] | url.go:57:2:57:8 | definition of joined1 |
177+
| url.go:58:2:58:8 | definition of joined2 | url.go:59:24:59:30 | joined2 |
178+
| url.go:58:2:58:45 | ... := ...[0] | url.go:58:2:58:8 | definition of joined2 |
179+
| url.go:59:2:59:6 | definition of asUrl | url.go:60:15:60:19 | asUrl |
180+
| url.go:59:2:59:31 | ... := ...[0] | url.go:59:2:59:6 | definition of asUrl |
181+
| url.go:60:2:60:10 | definition of joinedUrl | url.go:61:9:61:17 | joinedUrl |
182+
| url.go:60:15:60:37 | call to JoinPath | url.go:60:2:60:10 | definition of joinedUrl |
183+
| url.go:64:13:64:13 | argument corresponding to q | url.go:64:13:64:13 | definition of q |
184+
| url.go:64:13:64:13 | definition of q | url.go:66:27:66:27 | q |
185+
| url.go:65:2:65:9 | definition of cleanUrl | url.go:66:9:66:16 | cleanUrl |
186+
| url.go:65:2:65:48 | ... := ...[0] | url.go:65:2:65:9 | definition of cleanUrl |

0 commit comments

Comments
 (0)