diff --git a/change-notes/1.24/extractor-go.md b/change-notes/1.24/extractor-go.md index dedba0b1499..744d4732f86 100644 --- a/change-notes/1.24/extractor-go.md +++ b/change-notes/1.24/extractor-go.md @@ -5,3 +5,4 @@ ## Changes to code extraction * The autobuilder now runs Makefiles or custom build scripts present in the codebase to install dependencies. +* The extractor now supports extracting go.mod files, enabling queries on dependencies and their versions. diff --git a/extractor/extractor.go b/extractor/extractor.go index ca99c51e87a..90c76193e4c 100644 --- a/extractor/extractor.go +++ b/extractor/extractor.go @@ -121,8 +121,6 @@ func ExtractWithFlags(buildFlags []string, patterns []string) error { cwd = rcwd } - log.Printf("Walking file tree from %s to discover go.mod files...", cwd) - goModPaths := make([]string, 0, 10) filepath.Walk(cwd, func(path string, info os.FileInfo, err error) error { diff --git a/ql/src/go.qll b/ql/src/go.qll index b7d8af964a1..dfdd54726cf 100644 --- a/ql/src/go.qll +++ b/ql/src/go.qll @@ -9,6 +9,7 @@ import semmle.go.Concepts import semmle.go.Decls import semmle.go.Expr import semmle.go.Files +import semmle.go.GoMod import semmle.go.Locations import semmle.go.Packages import semmle.go.Scopes diff --git a/ql/src/semmle/go/AST.qll b/ql/src/semmle/go/AST.qll index 3d1dddf8981..a58a8c3d78a 100644 --- a/ql/src/semmle/go/AST.qll +++ b/ql/src/semmle/go/AST.qll @@ -16,6 +16,7 @@ class AstNode extends @node, Locatable { */ AstNode getChild(int i) { result = this.(ExprParent).getChildExpr(i) or + result = this.(GoModExprParent).getChildGoModExpr(i) or result = this.(StmtParent).getChildStmt(i) or result = this.(DeclParent).getDecl(i) or result = this.(GenDecl).getSpec(i) or @@ -70,6 +71,29 @@ class ExprParent extends @exprparent, AstNode { int getNumChildExpr() { result = count(getAChildExpr()) } } +/** + * An AST node whose children include go.mod expressions. + */ +class GoModExprParent extends @modexprparent, AstNode { + /** + * Gets the `i`th child expression of this node. + * + * Note that the precise indices of child expressions are considered an implementation detail + * and are subject to change without notice. + */ + GoModExpr getChildGoModExpr(int i) { modexprs(result, _, this, i) } + + /** + * Gets an expression that is a child node of this node in the AST. + */ + GoModExpr getAChildGoModExpr() { result = getChildGoModExpr(_) } + + /** + * Gets the number of child expressions of this node. + */ + int getNumChildGoModExpr() { result = count(getAChildGoModExpr()) } +} + /** * An AST node whose children include statements. */ diff --git a/ql/src/semmle/go/Files.qll b/ql/src/semmle/go/Files.qll index 963c9943106..170ba9c2b3d 100644 --- a/ql/src/semmle/go/Files.qll +++ b/ql/src/semmle/go/Files.qll @@ -178,7 +178,8 @@ class Folder extends Container, @folder { } /** A file. */ -class File extends Container, @file, Documentable, ExprParent, DeclParent, ScopeNode { +class File extends Container, @file, Documentable, ExprParent, GoModExprParent, DeclParent, + ScopeNode { override Location getLocation() { has_location(this, result) } override string getAbsolutePath() { files(this, result, _, _, _) } diff --git a/ql/src/semmle/go/GoMod.qll b/ql/src/semmle/go/GoMod.qll new file mode 100644 index 00000000000..63a01b72c14 --- /dev/null +++ b/ql/src/semmle/go/GoMod.qll @@ -0,0 +1,207 @@ +/** + * Provides classes for working with go.mod files. + */ + +import go + +/** A go.mod file. */ +class GoModFile extends File { + GoModFile() { this.getBaseName() = "go.mod" } + + /** + * Gets the module declaration of this file, that is, the line declaring the path of this module. + */ + GoModModuleLine getModuleDeclaration() { result.getFile() = this } +} + +/** + * An expression in a go.mod file, which is used to declare dependencies. + */ +class GoModExpr extends @modexpr, GoModExprParent { + /** + * Gets the kind of this expression, which is an integer value representing the expression's + * node type. + * + * Note that the mapping from node types to integer kinds is considered an implementation detail + * and subject to change without notice. + */ + int getKind() { modexprs(this, result, _, _) } + + /** + * Get the comment group associated with this expression. + */ + DocComment getComments() { result.getDocumentedElement() = this } + + override GoModFile getFile() { result = GoModExprParent.super.getFile() } + + /** Gets path of the module of this go.mod expression. */ + string getModulePath() { result = this.getFile().getModuleDeclaration().getPath() } + + override string toString() { result = "go.mod expression" } +} + +/** + * A top-level block of comments separate from any rule. + */ +class GoModCommentBlock extends @modcommentblock, GoModExpr { } + +/** + * A single line of tokens. + */ +class GoModLine extends @modline, GoModExpr { + /** + * Gets the `i`th token on this line, 0-based. + * + * Generally, one should use `getToken`, as that accounts for lines inside of line blocks. + */ + string getRawToken(int i) { modtokens(result, this, i) } + + /** + * Gets the `i`th token of `line`, including the token in the line block declaration, if it there is + * one, 0-based. + * + * This compensates for the fact that lines in line blocks have their 0th token in the line block + * declaration, and makes dealing with lines more uniform. + * + * For example, `.getToken(1)` will result in the dependency path (`github.com/github/codeql-go`) + * for both lines for normal require lines like `require "github.com/github/codeql-go" v1.2.3` and + * in a line block like + * + * ``` + * require ( + * "github.com/github/codeql-go" v1.2.3 + * ... + * ) + * ``` + * + * As a special case, when `i` is `0` and the line is in a line block, the result will be the + * token from the line block. + */ + string getToken(int i) { + i = 0 and result = this.getParent().(GoModLineBlock).getRawToken(0) + or + if this.getParent() instanceof GoModLineBlock + then result = this.getRawToken(i - 1) + else result = this.getRawToken(i) + } + + override string toString() { result = "go.mod line" } +} + +/** + * A factored block of lines, for example: + * ``` + * require ( + * "github.com/github/codeql-go" v1.2.3 + * "golang.org/x/tools" v3.2.1 + * ) + * ``` + */ +class GoModLineBlock extends @modlineblock, GoModExpr { + /** + * Gets the `i`th token of this line block, 0-based. + * + * Usually one should not have to use this, as `GoModLine.getToken(0)` will get the token from its + * parent line block, if any. + */ + string getRawToken(int i) { modtokens(result, this, i) } + + override string toString() { result = "go.mod line block" } +} + +/** + * A line that contains the module's package path, for example `module github.com/github/codeql-go`. + */ +class GoModModuleLine extends GoModLine { + GoModModuleLine() { this.getToken(0) = "module" } + + /** + * Get the path of the module being declared. + */ + string getPath() { result = this.getToken(1) } + + override string toString() { result = "go.mod module line" } +} + +/** + * A line that declares the Go version to be used, for example `go 1.14`. + */ +class GoModGoLine extends GoModLine { + GoModGoLine() { this.getToken(0) = "go" } + + /** Gets the Go version declared. */ + string getVersion() { result = this.getToken(1) } + + override string toString() { result = "go.mod go line" } +} + +/** + * A line that declares a requirement, for example `require "github.com/github/codeql-go" v1.2.3`. + */ +class GoModRequireLine extends GoModLine { + GoModRequireLine() { this.getToken(0) = "require" } + + /** Gets the path of the dependency. */ + string getPath() { result = this.getToken(1) } + + /** Gets the version of the dependency. */ + string getVersion() { result = this.getToken(2) } + + override string toString() { result = "go.mod require line" } +} + +/** + * A line that declares a dependency version to exclude, for example + * `exclude "github.com/github/codeql-go" v1.2.3`. + */ +class GoModExcludeLine extends GoModLine { + GoModExcludeLine() { this.getToken(0) = "exclude" } + + /** Gets the path of the dependency to exclude a version of. */ + string getPath() { result = this.getToken(1) } + + /** Gets the excluded version. */ + string getVersion() { result = this.getToken(2) } + + override string toString() { result = "go.mod exclude line" } +} + +/** + * A line that specifies a dependency to use instead of another one, for example + * `replace "golang.org/x/tools" => "github.com/golang/tools" v1.2.3`. + */ +class GoModReplaceLine extends GoModLine { + GoModReplaceLine() { this.getToken(0) = "replace" } + + /** Gets the path of the dependency to be replaced. */ + string getOriginalPath() { result = this.getToken(1) } + + /** Gets the path of the dependency to be replaced, if any. */ + string getOriginalVersion() { result = this.getToken(2) and not result = "=>" } + + /** Gets the path of the replacement dependency. */ + string getReplacementPath() { + if exists(this.getOriginalVersion()) + then result = this.getToken(4) + else result = this.getToken(3) + } + + /** Gets the version of the replacement dependency. */ + string getReplacementVersion() { + if exists(this.getOriginalVersion()) + then result = this.getToken(5) + else result = this.getToken(4) + } + + override string toString() { result = "go.mod replace line" } +} + +/** A left parenthesis for a line block. */ +class GoModLParen extends @modlparen, GoModExpr { + override string toString() { result = "go.mod (" } +} + +/** A right parenthesis for a line block. */ +class GoModRParen extends @modrparen, GoModExpr { + override string toString() { result = "go.mod )" } +} diff --git a/ql/src/semmle/go/dependencies/Dependencies.qll b/ql/src/semmle/go/dependencies/Dependencies.qll new file mode 100644 index 00000000000..9bf5e5c4726 --- /dev/null +++ b/ql/src/semmle/go/dependencies/Dependencies.qll @@ -0,0 +1,95 @@ +/** + * Provides classes for modeling go.mod dependencies. + */ + +import go + +/** + * An abstract representation of a dependency. + */ +abstract class Dependency extends Locatable { + /** + * Holds if this dependency has package path `path` and version `v`. + * + * If the version cannot be determined, `v` is bound to the string + * `"unknown"`. + */ + abstract predicate info(string path, string v); + + /** Gets the package path of this dependency. */ + string getDepPath() { this.info(result, _) } + + /** Gets the version of this dependency. */ + string getDepVersion() { this.info(_, result) } + + /** + * Holds if this dependency is relevant for imports in file `file`. That is, an import of this + * dependency's path that is in `file` will use this dependency. + */ + abstract predicate relevantForFile(File file); + + /** + * An import of this dependency. + */ + ImportSpec getAnImport() { + result.getPath() = this.getDepPath() and + this.relevantForFile(result.getFile()) + } +} + +/** + * A dependency from a go.mod file. + */ +class GoModDependency extends Dependency, GoModRequireLine { + override predicate info(string path, string v) { + this.replacementInfo(path, v) + or + not this.replacementInfo(_, _) and + this.originalInfo(path, v) + } + + override predicate relevantForFile(File file) { + exists(Folder parent | parent.getAFile() = this.getFile() | + parent.getAFolder*().getAFile() = file + ) + } + + /** + * Holds if there is a replace line that replaces this dependency with a dependency on `path`, + * version `v`. + */ + predicate replacementInfo(string path, string v) { + exists(GoModReplaceLine replace | + replace.getFile() = this.getFile() and + replace.getOriginalPath() = this.getPath() + | + path = replace.getReplacementPath() and + ( + v = replace.getReplacementVersion() + or + not exists(replace.getReplacementVersion()) and + v = "unknown" + ) + ) + } + + /** + * Get a version that was excluded for this dependency. + */ + string getAnExcludedVersion() { + exists(GoModExcludeLine exclude | + exclude.getFile() = this.getFile() and + exclude.getPath() = this.getPath() + | + result = exclude.getVersion() + ) + } + + /** + * Holds if this require line originally states dependency `path` had version `ver`. + * + * The actual info of this dependency can change based on `replace` directives in the same go.mod + * file, which replace a dependency with another one. + */ + predicate originalInfo(string path, string v) { path = this.getPath() and v = this.getVersion() } +} diff --git a/ql/src/semmle/go/dependencies/SemVer.qll b/ql/src/semmle/go/dependencies/SemVer.qll new file mode 100644 index 00000000000..88d37563931 --- /dev/null +++ b/ql/src/semmle/go/dependencies/SemVer.qll @@ -0,0 +1,100 @@ +/** + * Provides classes for dealing with semantic versions, for dependency versions. + */ + +import semmle.go.dependencies.Dependencies + +/** + * A SemVer-formatted version string in a dependency. + * + * Pre-release information and build metadata is not yet supported. + */ +class DependencySemVer extends string { + Dependency dep; + string normalized; + + DependencySemVer() { + this = dep.getDepVersion() and + normalized = normalizeSemver(this) + } + + /** + * Holds if this version may be before `last`. + */ + bindingset[last] + predicate maybeBefore(string last) { normalized < normalizeSemver(last) } + + /** + * Holds if this version may be after `first`. + */ + bindingset[first] + predicate maybeAfter(string first) { normalizeSemver(first) < normalized } + + /** + * Holds if this version may be between `first` (inclusive) and `last` (exclusive). + */ + bindingset[first, last] + predicate maybeBetween(string first, string last) { + normalizeSemver(first) <= normalized and + normalized < normalizeSemver(last) + } + + /** + * Holds if this version is equivalent to `other`. + */ + bindingset[other] + predicate is(string other) { normalized = normalizeSemver(other) } + + /** + * Gets the dependency that uses this string. + */ + Dependency getDependency() { result = dep } +} + +bindingset[str] +private string leftPad(string str) { result = ("000" + str).suffix(str.length()) } + +/** + * Normalizes a SemVer string such that the lexicographical ordering + * of two normalized strings is consistent with the SemVer ordering. + * + * Pre-release information and build metadata is not yet supported. + */ +bindingset[orig] +private string normalizeSemver(string orig) { + exists(string pattern, string major, string minor, string patch | + pattern = "v?(\\d+)\\.(\\d+)\\.(\\d+)(\\D.*)?" and + major = orig.regexpCapture(pattern, 1) and + minor = orig.regexpCapture(pattern, 2) and + patch = orig.regexpCapture(pattern, 3) + | + result = leftPad(major) + "." + leftPad(minor) + "." + leftPad(patch) + ) +} + +/** + * A version string in a dependency that has a SemVer, but also contains a git commit SHA. + * + * This class is useful for interacting with go.mod versions, which use SemVer, but can also contain + * SHAs if no useful tags are found, or when a user wishes to specify a commit SHA. + * + * Pre-release information and build metadata is not yet supported. + */ +class DependencySemShaVersion extends DependencySemVer { + string sha; + + DependencySemShaVersion() { sha = this.regexpCapture(".*-([0-9a-f]+)", 1) } + + /** + * Gets the commit SHA associated with this version. + */ + string getSha() { result = sha } + + bindingset[other] + override predicate is(string other) { + this.getSha() = other.(DependencySemShaVersion).getSha() + or + not other instanceof DependencySemShaVersion and + super.is(other) + } +} diff --git a/ql/test/library-tests/semmle/go/GoModExpr/ExcludeLines.expected b/ql/test/library-tests/semmle/go/GoModExpr/ExcludeLines.expected new file mode 100644 index 00000000000..b94f4383c1b --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/ExcludeLines.expected @@ -0,0 +1,3 @@ +| pkg1/go.mod:10:1:10:44 | go.mod exclude line | codeql-go-tests/gomod/dep1 | github.com/github/codeql-go | v1.23.1 | +| pkg2/go.mod:15:2:15:35 | go.mod exclude line | codeql-go-tests/gomod/dep2 | github.com/sirupsen/logrus | v1.4.2 | +| pkg2/go.mod:16:2:16:37 | go.mod exclude line | codeql-go-tests/gomod/dep2 | github.com/github/codeql-go | v1.23.1 | diff --git a/ql/test/library-tests/semmle/go/GoModExpr/ExcludeLines.ql b/ql/test/library-tests/semmle/go/GoModExpr/ExcludeLines.ql new file mode 100644 index 00000000000..f469a5d5b21 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/ExcludeLines.ql @@ -0,0 +1,4 @@ +import go + +from GoModExcludeLine excl +select excl, excl.getModulePath(), excl.getPath(), excl.getVersion() diff --git a/ql/test/library-tests/semmle/go/GoModExpr/ReplaceLines.expected b/ql/test/library-tests/semmle/go/GoModExpr/ReplaceLines.expected new file mode 100644 index 00000000000..7d4d0b310c4 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/ReplaceLines.expected @@ -0,0 +1,2 @@ +| pkg2/go.mod:5:1:5:55 | go.mod replace line | codeql-go-tests/gomod/dep2 | github.com/Masterminds/squirrel | no version | ../squirrel | no version | +| pkg2/go.mod:6:1:6:79 | go.mod replace line | codeql-go-tests/gomod/dep2 | github.com/Sirupsen/logrus | v1.4.1 | github.com/sirupsen/logrus | v1.4.1 | diff --git a/ql/test/library-tests/semmle/go/GoModExpr/ReplaceLines.ql b/ql/test/library-tests/semmle/go/GoModExpr/ReplaceLines.ql new file mode 100644 index 00000000000..485a7c69c44 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/ReplaceLines.ql @@ -0,0 +1,18 @@ +import go + +from GoModReplaceLine repl, string origVersion, string repVersion +where + ( + repVersion = repl.getReplacementVersion() + or + not exists(repl.getReplacementVersion()) and + repVersion = "no version" + ) and + ( + origVersion = repl.getOriginalVersion() + or + not exists(repl.getOriginalVersion()) and + origVersion = "no version" + ) +select repl, repl.getModulePath(), repl.getOriginalPath(), origVersion, repl.getReplacementPath(), + repVersion diff --git a/ql/test/library-tests/semmle/go/GoModExpr/RequireLines.expected b/ql/test/library-tests/semmle/go/GoModExpr/RequireLines.expected new file mode 100644 index 00000000000..60a0dfedd56 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/RequireLines.expected @@ -0,0 +1,5 @@ +| pkg1/go.mod:6:2:6:67 | go.mod require line | codeql-go-tests/gomod/dep1 | github.com/github/codeql-go | v1.23.2-0.20200302182241-5e71a04fdf30 | +| pkg1/go.mod:7:2:7:55 | go.mod require line | codeql-go-tests/gomod/dep1 | golang.org/x/tools | v0.0.0-20200109174759-ac4f524c1612 | +| pkg2/go.mod:8:1:8:38 | go.mod require line | codeql-go-tests/gomod/dep2 | github.com/gorilla/mux | v1.7.4 | +| pkg2/go.mod:10:2:10:35 | go.mod require line | codeql-go-tests/gomod/dep2 | github.com/Sirupsen/logrus | v1.4.1 | +| pkg2/go.mod:11:2:11:40 | go.mod require line | codeql-go-tests/gomod/dep2 | github.com/Masterminds/squirrel | v1.2.0 | diff --git a/ql/test/library-tests/semmle/go/GoModExpr/RequireLines.ql b/ql/test/library-tests/semmle/go/GoModExpr/RequireLines.ql new file mode 100644 index 00000000000..d3c1ebf3e75 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/RequireLines.ql @@ -0,0 +1,4 @@ +import go + +from GoModRequireLine req +select req, req.getModulePath(), req.getPath(), req.getVersion() diff --git a/ql/test/library-tests/semmle/go/GoModExpr/pkg1/go.mod b/ql/test/library-tests/semmle/go/GoModExpr/pkg1/go.mod new file mode 100644 index 00000000000..3416d3f0204 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/pkg1/go.mod @@ -0,0 +1,10 @@ +module codeql-go-tests/gomod/dep1 + +go 1.14 + +require ( + github.com/github/codeql-go v1.23.2-0.20200302182241-5e71a04fdf30 + golang.org/x/tools v0.0.0-20200109174759-ac4f524c1612 +) + +exclude github.com/github/codeql-go v1.23.1 diff --git a/ql/test/library-tests/semmle/go/GoModExpr/pkg1/pkg1.go b/ql/test/library-tests/semmle/go/GoModExpr/pkg1/pkg1.go new file mode 100644 index 00000000000..e071a1255a5 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/pkg1/pkg1.go @@ -0,0 +1,16 @@ +package pkg1 + +import ( + "fmt" + + "github.com/github/codeql-go/extractor/dbscheme" + "github.com/github/codeql-go/extractor/trap" + "golang.org/x/tools/go/packages" +) + +func usePkgs() { + fmt.Println(packages.NeedImports) + fmt.Println(dbscheme.LabelObjectType.Index()) + var lbl trap.Label + fmt.Println(lbl) +} diff --git a/ql/test/library-tests/semmle/go/GoModExpr/pkg2/go.mod b/ql/test/library-tests/semmle/go/GoModExpr/pkg2/go.mod new file mode 100644 index 00000000000..698fe145ad7 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/pkg2/go.mod @@ -0,0 +1,17 @@ +module codeql-go-tests/gomod/dep2 + +go 1.14 + +replace github.com/Masterminds/squirrel => ../squirrel +replace github.com/Sirupsen/logrus v1.4.1 => github.com/sirupsen/logrus v1.4.1 + +require github.com/gorilla/mux v1.7.4 +require ( + github.com/Sirupsen/logrus v1.4.1 + github.com/Masterminds/squirrel v1.2.0 +) + +exclude ( + github.com/sirupsen/logrus v1.4.2 + github.com/github/codeql-go v1.23.1 +) diff --git a/ql/test/library-tests/semmle/go/GoModExpr/pkg2/pkg2.go b/ql/test/library-tests/semmle/go/GoModExpr/pkg2/pkg2.go new file mode 100644 index 00000000000..16c3a325211 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/pkg2/pkg2.go @@ -0,0 +1,13 @@ +package pkg2 + +import ( + "fmt" + + "github.com/Masterminds/squirrel" + "github.com/gorilla/mux" + "github.com/sirupsen/logrus" +) + +func useDeps() { + +} diff --git a/ql/test/library-tests/semmle/go/GoModExpr/squirrel/LICENSE b/ql/test/library-tests/semmle/go/GoModExpr/squirrel/LICENSE new file mode 100644 index 00000000000..74c20a2b970 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/squirrel/LICENSE @@ -0,0 +1,23 @@ +Squirrel +The Masterminds +Copyright (C) 2014-2015, Lann Martin +Copyright (C) 2015-2016, Google +Copyright (C) 2015, Matt Farina and Matt Butcher + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ql/test/library-tests/semmle/go/GoModExpr/squirrel/README.md b/ql/test/library-tests/semmle/go/GoModExpr/squirrel/README.md new file mode 100644 index 00000000000..d51962ba840 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/squirrel/README.md @@ -0,0 +1,3 @@ +This is a simple stub for https://github.com/Masterminds/squirrel, strictly for use in query testing. + +See the LICENSE file in this folder for information about the licensing of the original library. diff --git a/ql/test/library-tests/semmle/go/GoModExpr/squirrel/go.mod b/ql/test/library-tests/semmle/go/GoModExpr/squirrel/go.mod new file mode 100644 index 00000000000..78405f23173 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/squirrel/go.mod @@ -0,0 +1,3 @@ +module github.com/github/codeql-go/ql/test/library-tests/semmle/go/GoModExpr/squirrel + +go 1.14 diff --git a/ql/test/library-tests/semmle/go/GoModExpr/squirrel/squirrel.go b/ql/test/library-tests/semmle/go/GoModExpr/squirrel/squirrel.go new file mode 100644 index 00000000000..78a19d3a6f2 --- /dev/null +++ b/ql/test/library-tests/semmle/go/GoModExpr/squirrel/squirrel.go @@ -0,0 +1,24 @@ +package squirrel + +type StatementBuilderType struct{} + +func Expr(e string, args ...interface{}) string { + return Expr(e, args...) +} + +var StatementBuilder = &StatementBuilderType{} + +func (b *StatementBuilderType) Insert(table string) *StatementBuilderType { + return b +} + +func (b *StatementBuilderType) Columns(columns ...string) *StatementBuilderType { + return b +} + +func (b *StatementBuilderType) Values(strings ...string) *StatementBuilderType { + return b +} + +func (b *StatementBuilderType) Exec() { +} diff --git a/ql/test/library-tests/semmle/go/dependencies/GoModDependency.expected b/ql/test/library-tests/semmle/go/dependencies/GoModDependency.expected new file mode 100644 index 00000000000..de38b1a1c7b --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/GoModDependency.expected @@ -0,0 +1,60 @@ +| codeql-go/go.mod:6:2:6:25 | go.mod require line | golang.org/x/mod | v0.2.0 | golang.org/x/mod | v0.2.0 | +| codeql-go/go.mod:7:2:7:55 | go.mod require line | golang.org/x/tools | v0.0.0-20200302225559-9b52d559c609 | golang.org/x/tools | v0.0.0-20200302225559-9b52d559c609 | +| fabric-snaps/go.mod:4:2:4:34 | go.mod require line | github.com/DATA-DOG/godog | v0.7.4 | github.com/DATA-DOG/godog | v0.7.4 | +| fabric-snaps/go.mod:5:2:5:56 | go.mod require line | github.com/cactus/go-statsd-client | v3.1.1+incompatible | github.com/cactus/go-statsd-client | v3.1.1+incompatible | +| fabric-snaps/go.mod:6:2:6:64 | go.mod require line | github.com/cloudflare/cfssl | v0.0.0-20180323000720-5d63dbd981b5 | github.com/cloudflare/cfssl | v0.0.0-20180323000720-5d63dbd981b5 | +| fabric-snaps/go.mod:7:2:7:64 | go.mod require line | github.com/facebookgo/clock | v0.0.0-20150410010913-600d898af40a | github.com/facebookgo/clock | v0.0.0-20150410010913-600d898af40a | +| fabric-snaps/go.mod:8:2:8:42 | go.mod require line | github.com/fsouza/go-dockerclient | v1.3.0 | github.com/fsouza/go-dockerclient | v1.3.0 | +| fabric-snaps/go.mod:9:2:9:30 | go.mod require line | github.com/go-kit/kit | v0.7.0 | github.com/go-kit/kit | v0.7.0 | +| fabric-snaps/go.mod:10:2:10:36 | go.mod require line | github.com/go-logfmt/logfmt | v0.4.0 | github.com/go-logfmt/logfmt | v0.3.0 | +| fabric-snaps/go.mod:11:2:11:35 | go.mod require line | github.com/golang/protobuf | v1.2.0 | github.com/golang/protobuf | v1.2.0 | +| fabric-snaps/go.mod:12:2:12:82 | go.mod require line | github.com/google/certificate-transparency-go | v0.0.0-20180219093839-391726f8973d | github.com/google/certificate-transparency-go | v0.0.0-20180219093839-391726f8973d | +| fabric-snaps/go.mod:13:2:13:38 | go.mod require line | github.com/hyperledger/fabric | v1.4.0 | github.com/securekey/fabric-next | v0.0.0-20190216163058-9e08161f2597 | +| fabric-snaps/go.mod:14:2:14:73 | go.mod require line | github.com/hyperledger/fabric-sdk-go | v0.0.0-20190125204638-b490519efff9 | github.com/hyperledger/fabric-sdk-go | v0.0.0-20190125204638-b490519efff9 | +| fabric-snaps/go.mod:15:2:15:31 | go.mod require line | github.com/onsi/gomega | v1.5.0 | github.com/onsi/gomega | v1.4.2 | +| fabric-snaps/go.mod:16:2:16:61 | go.mod require line | github.com/op/go-logging | v0.0.0-20160315200505-970db520ece7 | github.com/op/go-logging | v0.0.0-20160315200505-970db520ece7 | +| fabric-snaps/go.mod:17:2:17:30 | go.mod require line | github.com/pkg/errors | v0.8.1 | github.com/pkg/errors | v0.8.0 | +| fabric-snaps/go.mod:18:2:18:54 | go.mod require line | github.com/rs/xid | v0.0.0-20170604230408-02dd45c33376 | github.com/rs/xid | v0.0.0-20170604230408-02dd45c33376 | +| fabric-snaps/go.mod:19:2:19:72 | go.mod require line | github.com/securekey/fabric-snaps/membershipsnap/pkg/membership | v0.0.0 | ./membershipsnap/pkg/membership | unknown | +| fabric-snaps/go.mod:20:2:20:56 | go.mod require line | github.com/securekey/fabric-snaps/util/rolesmgr | v0.4.0 | ./util/rolesmgr | unknown | +| fabric-snaps/go.mod:21:2:21:56 | go.mod require line | github.com/securekey/fabric-snaps/util/statemgr | v0.4.0 | ./util/statemgr | unknown | +| fabric-snaps/go.mod:22:2:22:31 | go.mod require line | github.com/spf13/cobra | v0.0.3 | github.com/spf13/cobra | v0.0.3 | +| fabric-snaps/go.mod:23:2:23:31 | go.mod require line | github.com/spf13/pflag | v1.0.3 | github.com/spf13/pflag | v1.0.3 | +| fabric-snaps/go.mod:24:2:24:59 | go.mod require line | github.com/spf13/viper | v0.0.0-20171227194143-aafc9e6bc7b7 | github.com/spf13/viper | v0.0.0-20171227194143-aafc9e6bc7b7 | +| fabric-snaps/go.mod:25:2:25:36 | go.mod require line | github.com/stretchr/testify | v1.3.0 | github.com/stretchr/testify | v1.2.2 | +| fabric-snaps/go.mod:26:2:26:46 | go.mod require line | github.com/uber-go/tally | v3.3.2+incompatible | github.com/uber-go/tally | v3.3.2+incompatible | +| fabric-snaps/go.mod:27:2:27:69 | go.mod require line | github.com/xeipuuv/gojsonpointer | v0.0.0-20170225233418-6fe8760cad35 | github.com/xeipuuv/gojsonpointer | v0.0.0-20170225233418-6fe8760cad35 | +| fabric-snaps/go.mod:28:2:28:71 | go.mod require line | github.com/xeipuuv/gojsonreference | v0.0.0-20150808065054-e02fc20de94c | github.com/xeipuuv/gojsonreference | v0.0.0-20150808065054-e02fc20de94c | +| fabric-snaps/go.mod:29:2:29:68 | go.mod require line | github.com/xeipuuv/gojsonschema | v0.0.0-20170528113821-0c8571ac0ce1 | github.com/xeipuuv/gojsonschema | v0.0.0-20170528113821-0c8571ac0ce1 | +| fabric-snaps/go.mod:30:2:30:56 | go.mod require line | golang.org/x/crypto | v0.0.0-20181001203147-e3636079e1a4 | golang.org/x/crypto | v0.0.0-20180827131323-e3636079e1a4 | +| fabric-snaps/go.mod:31:2:31:53 | go.mod require line | golang.org/x/net | v0.0.0-20181003013248-f5e5bdd77824 | golang.org/x/net | v0.0.0-20181003013248-f5e5bdd77824 | +| fabric-snaps/go.mod:32:2:32:55 | go.mod require line | golang.org/x/tools | v0.0.0-20181026183834-f60e5f99f081 | golang.org/x/tools | v0.0.0-20181026183834-f60e5f99f081 | +| fabric-snaps/go.mod:33:2:33:32 | go.mod require line | google.golang.org/grpc | v1.17.0 | google.golang.org/grpc | v1.15.0 | +| hrm-profile-tool/go.mod:4:2:4:61 | go.mod require line | github.com/ajstarks/svgo | v0.0.0-20180830174826-7338bd80e790 | github.com/ajstarks/svgo | v0.0.0-20180830174826-7338bd80e790 | +| hrm-profile-tool/go.mod:5:2:5:48 | go.mod require line | github.com/clj/hrm-profile-tool/cmd/hrm | v0.0.0 | ./cmd/hrm | unknown | +| hrm-profile-tool/go.mod:6:2:6:53 | go.mod require line | github.com/clj/hrm-profile-tool/instructions | v0.0.0 | ./instructions | unknown | +| hrm-profile-tool/go.mod:7:2:7:48 | go.mod require line | github.com/clj/hrm-profile-tool/profile | v0.0.0 | ./profile | unknown | +| hrm-profile-tool/go.mod:8:2:8:47 | go.mod require line | github.com/clj/hrm-profile-tool/render | v0.0.0 | ./render | unknown | +| sweb/go.mod:40:2:40:30 | go.mod require line | github.com/Joker/jade | v1.0.0 | github.com/Joker/jade | v1.0.0 | +| sweb/go.mod:41:2:41:66 | go.mod require line | github.com/Shopify/goreferrer | v0.0.0-20181106222321-ec9c9a553398 | github.com/Shopify/goreferrer | v0.0.0-20181106222321-ec9c9a553398 | +| sweb/go.mod:42:2:42:49 | go.mod require line | github.com/aymerick/raymond | v2.0.2+incompatible | github.com/aymerick/raymond | v2.0.2+incompatible | +| sweb/go.mod:43:2:43:59 | go.mod require line | github.com/eknkc/amber | v0.0.0-20171010120322-cdade1c07385 | github.com/eknkc/amber | v0.0.0-20171010120322-cdade1c07385 | +| sweb/go.mod:44:2:44:33 | go.mod require line | github.com/fatih/structs | v1.1.0 | github.com/fatih/structs | v1.1.0 | +| sweb/go.mod:45:2:45:61 | go.mod require line | github.com/flosch/pongo2 | v0.0.0-20190707114632-bbf5a6c351f4 | github.com/flosch/pongo2 | v0.0.0-20190707114632-bbf5a6c351f4 | +| sweb/go.mod:46:2:46:57 | go.mod require line | github.com/iris-contrib/blackfriday | v2.0.0+incompatible | github.com/iris-contrib/blackfriday | v2.0.0+incompatible | +| sweb/go.mod:47:2:47:71 | go.mod require line | github.com/iris-contrib/formBinder | v0.0.0-20190104093907-fbd5963f41e1 | github.com/iris-contrib/formBinder | v0.0.0-20190104093907-fbd5963f41e1 | +| sweb/go.mod:48:2:48:53 | go.mod require line | github.com/iris-contrib/go.uuid | v2.0.0+incompatible | github.com/iris-contrib/go.uuid | v2.0.0+incompatible | +| sweb/go.mod:49:2:49:36 | go.mod require line | github.com/json-iterator/go | v1.1.6 | github.com/json-iterator/go | v1.1.6 | +| sweb/go.mod:50:2:50:61 | go.mod require line | github.com/kataras/golog | v0.0.0-20190624001437-99c81de45f40 | github.com/kataras/golog | v0.0.0-20190624001437-99c81de45f40 | +| sweb/go.mod:51:2:51:46 | go.mod require line | github.com/kataras/iris | v11.1.1+incompatible | github.com/kataras/iris | v11.1.1+incompatible | +| sweb/go.mod:52:2:52:59 | go.mod require line | github.com/kataras/pio | v0.0.0-20190103105442-ea782b38602d | github.com/kataras/pio | v0.0.0-20190103105442-ea782b38602d | +| sweb/go.mod:53:2:53:38 | go.mod require line | github.com/klauspost/compress | v1.7.2 | github.com/klauspost/compress | v1.7.2 | +| sweb/go.mod:54:2:54:35 | go.mod require line | github.com/klauspost/cpuid | v1.2.1 | github.com/klauspost/cpuid | v1.2.1 | +| sweb/go.mod:55:2:55:43 | go.mod require line | github.com/microcosm-cc/bluemonday | v1.0.2 | github.com/microcosm-cc/bluemonday | v1.0.2 | +| sweb/go.mod:56:2:56:40 | go.mod require line | github.com/mitchellh/go-homedir | v1.1.0 | github.com/mitchellh/go-homedir | v1.1.0 | +| sweb/go.mod:57:2:57:68 | go.mod require line | github.com/modern-go/concurrent | v0.0.0-20180306012644-bacd9c7ef1dd | github.com/modern-go/concurrent | v0.0.0-20180306012644-bacd9c7ef1dd | +| sweb/go.mod:58:2:58:38 | go.mod require line | github.com/modern-go/reflect2 | v1.0.1 | github.com/modern-go/reflect2 | v1.0.1 | +| sweb/go.mod:59:2:59:51 | go.mod require line | github.com/ryanuber/columnize | v2.1.0+incompatible | github.com/ryanuber/columnize | v2.1.0+incompatible | +| sweb/go.mod:60:2:60:50 | go.mod require line | github.com/shurcooL/sanitized_anchor_name | v1.0.0 | github.com/shurcooL/sanitized_anchor_name | v1.0.0 | +| sweb/go.mod:61:2:61:31 | go.mod require line | github.com/spf13/cobra | v0.0.5 | github.com/spf13/cobra | v0.0.5 | +| sweb/go.mod:62:2:62:31 | go.mod require line | github.com/spf13/viper | v1.4.0 | github.com/spf13/viper | v1.4.0 | diff --git a/ql/test/library-tests/semmle/go/dependencies/GoModDependency.ql b/ql/test/library-tests/semmle/go/dependencies/GoModDependency.ql new file mode 100644 index 00000000000..646dd7b5cb7 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/GoModDependency.ql @@ -0,0 +1,5 @@ +import semmle.go.dependencies.Dependencies + +from GoModDependency dep, string origpath, string origver, string path, string ver +where dep.info(path, ver) and dep.originalInfo(origpath, origver) +select dep, origpath, origver, path, ver diff --git a/ql/test/library-tests/semmle/go/dependencies/SemVer.expected b/ql/test/library-tests/semmle/go/dependencies/SemVer.expected new file mode 100644 index 00000000000..84c864deea2 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/SemVer.expected @@ -0,0 +1,50 @@ +| v0.0.0-20150410010913-600d898af40a | 0.0.0 | +| v0.0.0-20150808065054-e02fc20de94c | 0.0.0 | +| v0.0.0-20160315200505-970db520ece7 | 0.0.0 | +| v0.0.0-20170225233418-6fe8760cad35 | 0.0.0 | +| v0.0.0-20170528113821-0c8571ac0ce1 | 0.0.0 | +| v0.0.0-20170604230408-02dd45c33376 | 0.0.0 | +| v0.0.0-20171010120322-cdade1c07385 | 0.0.0 | +| v0.0.0-20171227194143-aafc9e6bc7b7 | 0.0.0 | +| v0.0.0-20180219093839-391726f8973d | 0.0.0 | +| v0.0.0-20180306012644-bacd9c7ef1dd | 0.0.0 | +| v0.0.0-20180323000720-5d63dbd981b5 | 0.0.0 | +| v0.0.0-20180827131323-e3636079e1a4 | 0.0.0 | +| v0.0.0-20180830174826-7338bd80e790 | 0.0.0 | +| v0.0.0-20181003013248-f5e5bdd77824 | 0.0.0 | +| v0.0.0-20181026183834-f60e5f99f081 | 0.0.0 | +| v0.0.0-20181106222321-ec9c9a553398 | 0.0.0 | +| v0.0.0-20190103105442-ea782b38602d | 0.0.0 | +| v0.0.0-20190104093907-fbd5963f41e1 | 0.0.0 | +| v0.0.0-20190125204638-b490519efff9 | 0.0.0 | +| v0.0.0-20190216163058-9e08161f2597 | 0.0.0 | +| v0.0.0-20190624001437-99c81de45f40 | 0.0.0 | +| v0.0.0-20190707114632-bbf5a6c351f4 | 0.0.0 | +| v0.0.0-20200302225559-9b52d559c609 | 0.0.0 | +| v0.0.3 | 0.0.3 | +| v0.0.5 | 0.0.5 | +| v0.2.0 | 0.2.0 | +| v0.3.0 | 0.3.0 | +| v0.7.0 | 0.7.0 | +| v0.7.4 | 0.7.4 | +| v0.8.0 | 0.8.0 | +| v1.0.0 | 1.0.0 | +| v1.0.1 | 1.0.1 | +| v1.0.2 | 1.0.2 | +| v1.0.3 | 1.0.3 | +| v1.1.0 | 1.1.0 | +| v1.1.6 | 1.1.6 | +| v1.2.0 | 1.2.0 | +| v1.2.1 | 1.2.1 | +| v1.2.2 | 1.2.2 | +| v1.3.0 | 1.3.0 | +| v1.4.0 | 1.4.0 | +| v1.4.2 | 1.4.2 | +| v1.7.2 | 1.7.2 | +| v1.15.0 | 1.15.0 | +| v2.0.0+incompatible | 2.0.0 | +| v2.0.2+incompatible | 2.0.2 | +| v2.1.0+incompatible | 2.1.0 | +| v3.1.1+incompatible | 3.1.1 | +| v3.3.2+incompatible | 3.3.2 | +| v11.1.1+incompatible | 11.1.1 | diff --git a/ql/test/library-tests/semmle/go/dependencies/SemVer.ql b/ql/test/library-tests/semmle/go/dependencies/SemVer.ql new file mode 100644 index 00000000000..15a5701673c --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/SemVer.ql @@ -0,0 +1,11 @@ +import semmle.go.dependencies.SemVer + +from DependencySemVer ver, string normVersion +where + exists(int major, int minor, int patch | + major = [0 .. 20] and minor = [0 .. 20] and patch = [0 .. 20] + | + normVersion = major + "." + minor + "." + patch + ) and + ver.is(normVersion) +select ver, normVersion diff --git a/ql/test/library-tests/semmle/go/dependencies/ShaVer.expected b/ql/test/library-tests/semmle/go/dependencies/ShaVer.expected new file mode 100644 index 00000000000..8b3b364aff0 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/ShaVer.expected @@ -0,0 +1,23 @@ +| v0.0.0-20150410010913-600d898af40a | 600d898af40a | +| v0.0.0-20150808065054-e02fc20de94c | e02fc20de94c | +| v0.0.0-20160315200505-970db520ece7 | 970db520ece7 | +| v0.0.0-20170225233418-6fe8760cad35 | 6fe8760cad35 | +| v0.0.0-20170528113821-0c8571ac0ce1 | 0c8571ac0ce1 | +| v0.0.0-20170604230408-02dd45c33376 | 02dd45c33376 | +| v0.0.0-20171010120322-cdade1c07385 | cdade1c07385 | +| v0.0.0-20171227194143-aafc9e6bc7b7 | aafc9e6bc7b7 | +| v0.0.0-20180219093839-391726f8973d | 391726f8973d | +| v0.0.0-20180306012644-bacd9c7ef1dd | bacd9c7ef1dd | +| v0.0.0-20180323000720-5d63dbd981b5 | 5d63dbd981b5 | +| v0.0.0-20180827131323-e3636079e1a4 | e3636079e1a4 | +| v0.0.0-20180830174826-7338bd80e790 | 7338bd80e790 | +| v0.0.0-20181003013248-f5e5bdd77824 | f5e5bdd77824 | +| v0.0.0-20181026183834-f60e5f99f081 | f60e5f99f081 | +| v0.0.0-20181106222321-ec9c9a553398 | ec9c9a553398 | +| v0.0.0-20190103105442-ea782b38602d | ea782b38602d | +| v0.0.0-20190104093907-fbd5963f41e1 | fbd5963f41e1 | +| v0.0.0-20190125204638-b490519efff9 | b490519efff9 | +| v0.0.0-20190216163058-9e08161f2597 | 9e08161f2597 | +| v0.0.0-20190624001437-99c81de45f40 | 99c81de45f40 | +| v0.0.0-20190707114632-bbf5a6c351f4 | bbf5a6c351f4 | +| v0.0.0-20200302225559-9b52d559c609 | 9b52d559c609 | diff --git a/ql/test/library-tests/semmle/go/dependencies/ShaVer.ql b/ql/test/library-tests/semmle/go/dependencies/ShaVer.ql new file mode 100644 index 00000000000..b85b5cbbfab --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/ShaVer.ql @@ -0,0 +1,4 @@ +import semmle.go.dependencies.SemVer + +from DependencySemShaVersion ver +select ver, ver.getSha() diff --git a/ql/test/library-tests/semmle/go/dependencies/codeql-go/go.mod b/ql/test/library-tests/semmle/go/dependencies/codeql-go/go.mod new file mode 100644 index 00000000000..06ecc65d84a --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/codeql-go/go.mod @@ -0,0 +1,8 @@ +module github.com/github/codeql-go + +go 1.13 + +require ( + golang.org/x/mod v0.2.0 + golang.org/x/tools v0.0.0-20200302225559-9b52d559c609 +) diff --git a/ql/test/library-tests/semmle/go/dependencies/fabric-snaps/LICENSE b/ql/test/library-tests/semmle/go/dependencies/fabric-snaps/LICENSE new file mode 100644 index 00000000000..8dada3edaf5 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/fabric-snaps/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "{}" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright {yyyy} {name of copyright owner} + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/ql/test/library-tests/semmle/go/dependencies/fabric-snaps/README.md b/ql/test/library-tests/semmle/go/dependencies/fabric-snaps/README.md new file mode 100644 index 00000000000..343b9e55123 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/fabric-snaps/README.md @@ -0,0 +1,3 @@ +This is the go.mod and go.sum files from https://github.com/securekey/fabric-snaps, strictly for use in query testing. + +See the LICENSE file in this folder for information about the licensing of the original code. diff --git a/ql/test/library-tests/semmle/go/dependencies/fabric-snaps/go.mod b/ql/test/library-tests/semmle/go/dependencies/fabric-snaps/go.mod new file mode 100644 index 00000000000..3751c58532a --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/fabric-snaps/go.mod @@ -0,0 +1,65 @@ +module github.com/securekey/fabric-snaps + +require ( + github.com/DATA-DOG/godog v0.7.4 + github.com/cactus/go-statsd-client v3.1.1+incompatible // indirect + github.com/cloudflare/cfssl v0.0.0-20180323000720-5d63dbd981b5 // indirect + github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect + github.com/fsouza/go-dockerclient v1.3.0 + github.com/go-kit/kit v0.7.0 + github.com/go-logfmt/logfmt v0.4.0 // indirect + github.com/golang/protobuf v1.2.0 + github.com/google/certificate-transparency-go v0.0.0-20180219093839-391726f8973d // indirect + github.com/hyperledger/fabric v1.4.0 + github.com/hyperledger/fabric-sdk-go v0.0.0-20190125204638-b490519efff9 + github.com/onsi/gomega v1.5.0 // indirect + github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 + github.com/pkg/errors v0.8.1 + github.com/rs/xid v0.0.0-20170604230408-02dd45c33376 + github.com/securekey/fabric-snaps/membershipsnap/pkg/membership v0.0.0 + github.com/securekey/fabric-snaps/util/rolesmgr v0.4.0 + github.com/securekey/fabric-snaps/util/statemgr v0.4.0 + github.com/spf13/cobra v0.0.3 + github.com/spf13/pflag v1.0.3 + github.com/spf13/viper v0.0.0-20171227194143-aafc9e6bc7b7 + github.com/stretchr/testify v1.3.0 + github.com/uber-go/tally v3.3.2+incompatible // indirect + github.com/xeipuuv/gojsonpointer v0.0.0-20170225233418-6fe8760cad35 // indirect + github.com/xeipuuv/gojsonreference v0.0.0-20150808065054-e02fc20de94c // indirect + github.com/xeipuuv/gojsonschema v0.0.0-20170528113821-0c8571ac0ce1 + golang.org/x/crypto v0.0.0-20181001203147-e3636079e1a4 + golang.org/x/net v0.0.0-20181003013248-f5e5bdd77824 + golang.org/x/tools v0.0.0-20181026183834-f60e5f99f081 + google.golang.org/grpc v1.17.0 + +) + +replace github.com/hyperledger/fabric => github.com/securekey/fabric-next v0.0.0-20190216163058-9e08161f2597 + +replace github.com/docker/libnetwork => github.com/docker/libnetwork v0.0.0-20180608203834-19279f049241 + +replace github.com/docker/docker => github.com/docker/docker v0.0.0-20180827131323-0c5f8d2b9b23 + +replace golang.org/x/crypto => golang.org/x/crypto v0.0.0-20180827131323-e3636079e1a4 + +replace github.com/spf13/afero => github.com/spf13/afero v1.2.1 + +replace github.com/hashicorp/hcl => github.com/hashicorp/hcl v1.0.0 + +replace github.com/go-logfmt/logfmt => github.com/go-logfmt/logfmt v0.3.0 + +replace github.com/stretchr/testify => github.com/stretchr/testify v1.2.2 + +replace github.com/onsi/gomega => github.com/onsi/gomega v1.4.2 + +replace github.com/securekey/fabric-snaps/util/rolesmgr => ./util/rolesmgr + +replace github.com/securekey/fabric-snaps/util/statemgr => ./util/statemgr + +replace github.com/securekey/fabric-snaps/membershipsnap/pkg/membership => ./membershipsnap/pkg/membership + +replace google.golang.org/grpc => google.golang.org/grpc v1.15.0 + +replace github.com/pkg/errors => github.com/pkg/errors v0.8.0 + +replace github.com/spf13/oldviper => github.com/spf13/viper v0.0.0-20150908122457-1967d93db724 diff --git a/ql/test/library-tests/semmle/go/dependencies/hrm-profile-tool/LICENSE b/ql/test/library-tests/semmle/go/dependencies/hrm-profile-tool/LICENSE new file mode 100644 index 00000000000..2c54e25f712 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/hrm-profile-tool/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2016 Christian Lyder Jacobsen + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/ql/test/library-tests/semmle/go/dependencies/hrm-profile-tool/README.md b/ql/test/library-tests/semmle/go/dependencies/hrm-profile-tool/README.md new file mode 100644 index 00000000000..98ad865d147 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/hrm-profile-tool/README.md @@ -0,0 +1,3 @@ +This is the go.mod and go.sum files from https://github.com/clj/hrm-profile-tool, strictly for use in query testing. + +See the LICENSE file in this folder for information about the licensing of the original code. diff --git a/ql/test/library-tests/semmle/go/dependencies/hrm-profile-tool/go.mod b/ql/test/library-tests/semmle/go/dependencies/hrm-profile-tool/go.mod new file mode 100644 index 00000000000..4b0ac268e96 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/hrm-profile-tool/go.mod @@ -0,0 +1,22 @@ +module github.com/clj/hrm-profile-tool + +require ( + github.com/ajstarks/svgo v0.0.0-20180830174826-7338bd80e790 + github.com/clj/hrm-profile-tool/cmd/hrm v0.0.0 + github.com/clj/hrm-profile-tool/instructions v0.0.0 + github.com/clj/hrm-profile-tool/profile v0.0.0 + github.com/clj/hrm-profile-tool/render v0.0.0 + +) + +replace github.com/clj/hrm-profile-tool/cmd/hrm => ./cmd/hrm + +replace github.com/clj/hrm-profile-tool/profile => ./profile + +replace github.com/clj/hrm-profile-tool/instructions => ./instructions + +replace github.com/clj/hrm-profile-tool/render => ./render + +replace github.com/clj/hrm-profile-tool/utils/text => ./utils/text + +replace github.com/clj/hrm-profile-tool/utils/seekbufio => ./utils/seekbufio diff --git a/ql/test/library-tests/semmle/go/dependencies/sweb/LICENSE b/ql/test/library-tests/semmle/go/dependencies/sweb/LICENSE new file mode 100644 index 00000000000..108b937dfc3 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/sweb/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2019 ender + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/ql/test/library-tests/semmle/go/dependencies/sweb/README.md b/ql/test/library-tests/semmle/go/dependencies/sweb/README.md new file mode 100644 index 00000000000..549bdee8bf8 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/sweb/README.md @@ -0,0 +1,3 @@ +This is the go.mod and go.sum files from https://github.com/xuender/sweb, strictly for use in query testing. + +See the LICENSE file in this folder for information about the licensing of the original code. diff --git a/ql/test/library-tests/semmle/go/dependencies/sweb/go.mod b/ql/test/library-tests/semmle/go/dependencies/sweb/go.mod new file mode 100644 index 00000000000..096134411f9 --- /dev/null +++ b/ql/test/library-tests/semmle/go/dependencies/sweb/go.mod @@ -0,0 +1,63 @@ +module github.com/xuender/sweb + +go 1.12 + +replace golang.org/x/text => github.com/golang/text v0.3.2 + +replace golang.org/x/net => github.com/golang/net v0.0.0-20190620200207-3b0461eec859 + +replace golang.org/x/crypto => github.com/golang/crypto v0.0.0-20190621222207-cc06ce4a13d4 + +replace golang.org/x/tools => github.com/golang/tools v0.0.0-20190625160430-252024b82959 + +replace golang.org/x/sync => github.com/golang/sync v0.0.0-20190423024810-112230192c58 + +replace golang.org/x/sys => github.com/golang/sys v0.0.0-20190624142023-c5567b49c5d0 + +replace cloud.google.com/go => github.com/googleapis/google-cloud-go v0.40.0 + +replace google.golang.org/genproto => github.com/google/go-genproto v0.0.0-20190620144150-6af8c5fc6601 + +replace golang.org/x/exp => github.com/golang/exp v0.0.0-20190510132918-efd6b22b2522 + +replace golang.org/x/time => github.com/golang/time v0.0.0-20190308202827-9d24e82272b4 + +replace golang.org/x/oauth2 => github.com/golang/oauth2 v0.0.0-20190604053449-0f29369cfe45 + +replace golang.org/x/lint => github.com/golang/lint v0.0.0-20190409202823-959b441ac422 + +replace google.golang.org/grpc => github.com/grpc/grpc-go v1.21.1 + +replace google.golang.org/api => github.com/googleapis/google-api-go-client v0.7.0 + +replace google.golang.org/appengine => github.com/golang/appengine v1.6.1 + +replace golang.org/x/mobile => github.com/golang/mobile v0.0.0-20190607214518-6fa95d984e88 + +replace golang.org/x/image => github.com/golang/image v0.0.0-20190622003408-7e034cad6442 + +require ( + github.com/Joker/jade v1.0.0 // indirect + github.com/Shopify/goreferrer v0.0.0-20181106222321-ec9c9a553398 // indirect + github.com/aymerick/raymond v2.0.2+incompatible // indirect + github.com/eknkc/amber v0.0.0-20171010120322-cdade1c07385 // indirect + github.com/fatih/structs v1.1.0 // indirect + github.com/flosch/pongo2 v0.0.0-20190707114632-bbf5a6c351f4 // indirect + github.com/iris-contrib/blackfriday v2.0.0+incompatible // indirect + github.com/iris-contrib/formBinder v0.0.0-20190104093907-fbd5963f41e1 // indirect + github.com/iris-contrib/go.uuid v2.0.0+incompatible // indirect + github.com/json-iterator/go v1.1.6 // indirect + github.com/kataras/golog v0.0.0-20190624001437-99c81de45f40 // indirect + github.com/kataras/iris v11.1.1+incompatible + github.com/kataras/pio v0.0.0-20190103105442-ea782b38602d // indirect + github.com/klauspost/compress v1.7.2 // indirect + github.com/klauspost/cpuid v1.2.1 // indirect + github.com/microcosm-cc/bluemonday v1.0.2 // indirect + github.com/mitchellh/go-homedir v1.1.0 + github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect + github.com/modern-go/reflect2 v1.0.1 // indirect + github.com/ryanuber/columnize v2.1.0+incompatible // indirect + github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect + github.com/spf13/cobra v0.0.5 + github.com/spf13/viper v1.4.0 +)