Merge pull request #323 from gagliardetto/standard-lib-pt-8

Add taint-tracking for packages in `encoding/*`

ql/src/semmle/go/frameworks/Stdlib.qll

@@ -15,6 +15,18 @@ import semmle.go.frameworks.stdlib.CompressZlib
 import semmle.go.frameworks.stdlib.Mime
 import semmle.go.frameworks.stdlib.MimeMultipart
 import semmle.go.frameworks.stdlib.MimeQuotedprintable
+import semmle.go.frameworks.stdlib.Encoding
+import semmle.go.frameworks.stdlib.EncodingAscii85
+import semmle.go.frameworks.stdlib.EncodingAsn1
+import semmle.go.frameworks.stdlib.EncodingBase32
+import semmle.go.frameworks.stdlib.EncodingBase64
+import semmle.go.frameworks.stdlib.EncodingBinary
+import semmle.go.frameworks.stdlib.EncodingCsv
+import semmle.go.frameworks.stdlib.EncodingGob
+import semmle.go.frameworks.stdlib.EncodingHex
+import semmle.go.frameworks.stdlib.EncodingJson
+import semmle.go.frameworks.stdlib.EncodingPem
+import semmle.go.frameworks.stdlib.EncodingXml
 import semmle.go.frameworks.stdlib.Path
 import semmle.go.frameworks.stdlib.PathFilepath
 import semmle.go.frameworks.stdlib.Reflect
@@ -697,53 +709,6 @@ module Log {
   }
 }
 
-/** Provides models of some functions in the `encoding/json` package. */
-module EncodingJson {
-  /** The `Marshal` or `MarshalIndent` function in the `encoding/json` package. */
-  class MarshalFunction extends TaintTracking::FunctionModel, MarshalingFunction::Range {
-    MarshalFunction() {
-      this.hasQualifiedName("encoding/json", "Marshal") or
-      this.hasQualifiedName("encoding/json", "MarshalIndent")
-    }
-
-    override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
-      inp = getAnInput() and outp = getOutput()
-    }
-
-    override FunctionInput getAnInput() { result.isParameter(0) }
-
-    override FunctionOutput getOutput() { result.isResult(0) }
-
-    override string getFormat() { result = "JSON" }
-  }
-
-  private class UnmarshalFunction extends TaintTracking::FunctionModel, UnmarshalingFunction::Range {
-    UnmarshalFunction() { this.hasQualifiedName("encoding/json", "Unmarshal") }
-
-    override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
-      inp = getAnInput() and outp = getOutput()
-    }
-
-    override FunctionInput getAnInput() { result.isParameter(0) }
-
-    override FunctionOutput getOutput() { result.isParameter(1) }
-
-    override string getFormat() { result = "JSON" }
-  }
-}
-
-/** Provides models of some functions in the `encoding/hex` package. */
-module EncodingHex {
-  private class DecodeStringFunction extends TaintTracking::FunctionModel {
-    DecodeStringFunction() { this.hasQualifiedName("encoding/hex", "DecodeString") }
-
-    override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
-      inp.isParameter(0) and
-      outp.isResult(0)
-    }
-  }
-}
-
 /** Provides models of some functions in the `crypto/cipher` package. */
 module CryptoCipher {
   private class AeadOpenFunction extends TaintTracking::FunctionModel, Method {

ql/src/semmle/go/frameworks/stdlib/Encoding.qll

@@ -0,0 +1,35 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding` package. */
+module Encoding {
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (BinaryMarshaler).MarshalBinary() (data []byte, err error)
+      this.implements("encoding", "BinaryMarshaler", "MarshalBinary") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (TextMarshaler).MarshalText() (text []byte, err error)
+      this.implements("encoding", "TextMarshaler", "MarshalText") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (BinaryUnmarshaler).UnmarshalBinary(data []byte) error
+      this.implements("encoding", "BinaryUnmarshaler", "UnmarshalBinary") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (TextUnmarshaler).UnmarshalText(text []byte) error
+      this.implements("encoding", "TextUnmarshaler", "UnmarshalText") and
+      (inp.isParameter(0) and outp.isReceiver())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingAscii85.qll

@@ -0,0 +1,27 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/ascii85` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/ascii85` package. */
+module EncodingAscii85 {
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func Decode(dst []byte, src []byte, flush bool) (ndst int, nsrc int, err error)
+      hasQualifiedName("encoding/ascii85", "Decode") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func NewDecoder(r io.Reader) io.Reader
+      hasQualifiedName("encoding/ascii85", "NewDecoder") and
+      (inp.isParameter(0) and outp.isResult())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingAsn1.qll

@@ -0,0 +1,69 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/asn1` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/asn1` package. */
+module EncodingAsn1 {
+  /** The `Marshal` or `MarshalWithParams` function in the `encoding/asn1` package. */
+  private class MarshalFunction extends MarshalingFunction::Range {
+    MarshalFunction() {
+      hasQualifiedName("encoding/asn1", "Marshal") or
+      hasQualifiedName("encoding/asn1", "MarshalWithParams")
+    }
+
+    override FunctionInput getAnInput() { result.isParameter(0) }
+
+    override FunctionOutput getOutput() { result.isResult(0) }
+
+    override string getFormat() { result = "ASN1" }
+  }
+
+  /** The `Unmarshal` or `UnmarshalWithParams` function in the `encoding/asn1` package. */
+  private class UnmarshalFunction extends UnmarshalingFunction::Range {
+    UnmarshalFunction() {
+      hasQualifiedName("encoding/asn1", "Unmarshal") or
+      hasQualifiedName("encoding/asn1", "UnmarshalWithParams")
+    }
+
+    override FunctionInput getAnInput() { result.isParameter(0) }
+
+    override FunctionOutput getOutput() { result.isParameter(1) }
+
+    override string getFormat() { result = "ASN1" }
+  }
+
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func Marshal(val interface{}) ([]byte, error)
+      hasQualifiedName("encoding/asn1", "Marshal") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func MarshalWithParams(val interface{}, params string) ([]byte, error)
+      hasQualifiedName("encoding/asn1", "MarshalWithParams") and
+      (inp.isParameter(_) and outp.isResult(0))
+      or
+      // signature: func Unmarshal(b []byte, val interface{}) (rest []byte, err error)
+      hasQualifiedName("encoding/asn1", "Unmarshal") and
+      (
+        inp.isParameter(0) and
+        (outp.isParameter(1) or outp.isResult(0))
+      )
+      or
+      // signature: func UnmarshalWithParams(b []byte, val interface{}, params string) (rest []byte, err error)
+      hasQualifiedName("encoding/asn1", "UnmarshalWithParams") and
+      (
+        inp.isParameter([0, 2]) and
+        (outp.isParameter(1) or outp.isResult(0))
+      )
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingBase32.qll

@@ -0,0 +1,42 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/base32` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/base32` package. */
+module EncodingBase32 {
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func NewDecoder(enc *Encoding, r io.Reader) io.Reader
+      hasQualifiedName("encoding/base32", "NewDecoder") and
+      (inp.isParameter(1) and outp.isResult())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (*Encoding).Decode(dst []byte, src []byte) (n int, err error)
+      this.hasQualifiedName("encoding/base32", "Encoding", "Decode") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func (*Encoding).DecodeString(s string) ([]byte, error)
+      this.hasQualifiedName("encoding/base32", "Encoding", "DecodeString") and
+      (inp.isParameter(0) and outp.isResult(0))
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingBase64.qll

@@ -0,0 +1,42 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/base64` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/base64` package. */
+module EncodingBase64 {
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func NewDecoder(enc *Encoding, r io.Reader) io.Reader
+      hasQualifiedName("encoding/base64", "NewDecoder") and
+      (inp.isParameter(1) and outp.isResult())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (*Encoding).Decode(dst []byte, src []byte) (n int, err error)
+      this.hasQualifiedName("encoding/base64", "Encoding", "Decode") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func (*Encoding).DecodeString(s string) ([]byte, error)
+      this.hasQualifiedName("encoding/base64", "Encoding", "DecodeString") and
+      (inp.isParameter(0) and outp.isResult(0))
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingBinary.qll

@@ -0,0 +1,27 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/binary` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/binary` package. */
+module EncodingBinary {
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func Read(r io.Reader, order ByteOrder, data interface{}) error
+      hasQualifiedName("encoding/binary", "Read") and
+      (inp.isParameter(0) and outp.isParameter(2))
+      or
+      // signature: func Write(w io.Writer, order ByteOrder, data interface{}) error
+      hasQualifiedName("encoding/binary", "Write") and
+      (inp.isParameter(2) and outp.isParameter(0))
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingCsv.qll

@@ -0,0 +1,54 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/csv` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/csv` package. */
+module EncodingCsv {
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func NewReader(r io.Reader) *Reader
+      hasQualifiedName("encoding/csv", "NewReader") and
+      (inp.isParameter(0) and outp.isResult())
+      or
+      // signature: func NewWriter(w io.Writer) *Writer
+      hasQualifiedName("encoding/csv", "NewWriter") and
+      (inp.isResult() and outp.isParameter(0))
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (*Reader).Read() (record []string, err error)
+      this.hasQualifiedName("encoding/csv", "Reader", "Read") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (*Reader).ReadAll() (records [][]string, err error)
+      this.hasQualifiedName("encoding/csv", "Reader", "ReadAll") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (*Writer).Write(record []string) error
+      this.hasQualifiedName("encoding/csv", "Writer", "Write") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (*Writer).WriteAll(records [][]string) error
+      this.hasQualifiedName("encoding/csv", "Writer", "WriteAll") and
+      (inp.isParameter(0) and outp.isReceiver())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingGob.qll

@@ -0,0 +1,62 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/gob` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/gob` package. */
+module EncodingGob {
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func NewDecoder(r io.Reader) *Decoder
+      hasQualifiedName("encoding/gob", "NewDecoder") and
+      (inp.isParameter(0) and outp.isResult())
+      or
+      // signature: func NewEncoder(w io.Writer) *Encoder
+      hasQualifiedName("encoding/gob", "NewEncoder") and
+      (inp.isResult() and outp.isParameter(0))
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (*Decoder).Decode(e interface{}) error
+      this.hasQualifiedName("encoding/gob", "Decoder", "Decode") and
+      (inp.isReceiver() and outp.isParameter(0))
+      or
+      // signature: func (*Decoder).DecodeValue(v reflect.Value) error
+      this.hasQualifiedName("encoding/gob", "Decoder", "DecodeValue") and
+      (inp.isReceiver() and outp.isParameter(0))
+      or
+      // signature: func (*Encoder).Encode(e interface{}) error
+      this.hasQualifiedName("encoding/gob", "Encoder", "Encode") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (*Encoder).EncodeValue(value reflect.Value) error
+      this.hasQualifiedName("encoding/gob", "Encoder", "EncodeValue") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (GobDecoder).GobDecode([]byte) error
+      this.implements("encoding/gob", "GobDecoder", "GobDecode") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (GobEncoder).GobEncode() ([]byte, error)
+      this.implements("encoding/gob", "GobEncoder", "GobEncode") and
+      (inp.isReceiver() and outp.isResult(0))
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingHex.qll

@@ -0,0 +1,31 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/hex` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/hex` package. */
+module EncodingHex {
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func Decode(dst []byte, src []byte) (int, error)
+      hasQualifiedName("encoding/hex", "Decode") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func DecodeString(s string) ([]byte, error)
+      hasQualifiedName("encoding/hex", "DecodeString") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func NewDecoder(r io.Reader) io.Reader
+      hasQualifiedName("encoding/hex", "NewDecoder") and
+      (inp.isParameter(0) and outp.isResult())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingJson.qll

@@ -0,0 +1,128 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/json` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/json` package. */
+module EncodingJson {
+  private class Escape extends EscapeFunction::Range {
+    Escape() { hasQualifiedName("encoding/json", "HTMLEscape") }
+
+    override string kind() { result = "html" }
+  }
+
+  /** The `Marshal` or `MarshalIndent` function in the `encoding/json` package. */
+  class MarshalFunction extends MarshalingFunction::Range {
+    MarshalFunction() {
+      this.hasQualifiedName("encoding/json", "Marshal") or
+      this.hasQualifiedName("encoding/json", "MarshalIndent")
+    }
+
+    override FunctionInput getAnInput() { result.isParameter(0) }
+
+    override FunctionOutput getOutput() { result.isResult(0) }
+
+    override string getFormat() { result = "JSON" }
+  }
+
+  private class UnmarshalFunction extends UnmarshalingFunction::Range {
+    UnmarshalFunction() { this.hasQualifiedName("encoding/json", "Unmarshal") }
+
+    override FunctionInput getAnInput() { result.isParameter(0) }
+
+    override FunctionOutput getOutput() { result.isParameter(1) }
+
+    override string getFormat() { result = "JSON" }
+  }
+
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func Compact(dst *bytes.Buffer, src []byte) error
+      hasQualifiedName("encoding/json", "Compact") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func HTMLEscape(dst *bytes.Buffer, src []byte)
+      hasQualifiedName("encoding/json", "HTMLEscape") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func Indent(dst *bytes.Buffer, src []byte, prefix string, indent string) error
+      hasQualifiedName("encoding/json", "Indent") and
+      (inp.isParameter([1, 2, 3]) and outp.isParameter(0))
+      or
+      // signature: func Marshal(v interface{}) ([]byte, error)
+      hasQualifiedName("encoding/json", "Marshal") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func MarshalIndent(v interface{}, prefix string, indent string) ([]byte, error)
+      hasQualifiedName("encoding/json", "MarshalIndent") and
+      (inp.isParameter(_) and outp.isResult(0))
+      or
+      // signature: func NewDecoder(r io.Reader) *Decoder
+      hasQualifiedName("encoding/json", "NewDecoder") and
+      (inp.isParameter(0) and outp.isResult())
+      or
+      // signature: func NewEncoder(w io.Writer) *Encoder
+      hasQualifiedName("encoding/json", "NewEncoder") and
+      (inp.isResult() and outp.isParameter(0))
+      or
+      // signature: func Unmarshal(data []byte, v interface{}) error
+      hasQualifiedName("encoding/json", "Unmarshal") and
+      (inp.isParameter(0) and outp.isParameter(1))
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (*Decoder).Buffered() io.Reader
+      this.hasQualifiedName("encoding/json", "Decoder", "Buffered") and
+      (inp.isReceiver() and outp.isResult())
+      or
+      // signature: func (*Decoder).Decode(v interface{}) error
+      this.hasQualifiedName("encoding/json", "Decoder", "Decode") and
+      (inp.isReceiver() and outp.isParameter(0))
+      or
+      // signature: func (*Decoder).Token() (Token, error)
+      this.hasQualifiedName("encoding/json", "Decoder", "Token") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (*Encoder).Encode(v interface{}) error
+      this.hasQualifiedName("encoding/json", "Encoder", "Encode") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (*Encoder).SetIndent(prefix string, indent string)
+      this.hasQualifiedName("encoding/json", "Encoder", "SetIndent") and
+      (inp.isParameter(_) and outp.isReceiver())
+      or
+      // signature: func (RawMessage).MarshalJSON() ([]byte, error)
+      this.hasQualifiedName("encoding/json", "RawMessage", "MarshalJSON") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (*RawMessage).UnmarshalJSON(data []byte) error
+      this.hasQualifiedName("encoding/json", "RawMessage", "UnmarshalJSON") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (Marshaler).MarshalJSON() ([]byte, error)
+      this.implements("encoding/json", "Marshaler", "MarshalJSON") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (Unmarshaler).UnmarshalJSON([]byte) error
+      this.implements("encoding/json", "Unmarshaler", "UnmarshalJSON") and
+      (inp.isParameter(0) and outp.isReceiver())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingPem.qll

@@ -0,0 +1,64 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/pem` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/pem` package. */
+module EncodingPem {
+  /** The `Encode` function in the `encoding/pem` package. */
+  private class EncodeFunction extends MarshalingFunction::Range {
+    EncodeFunction() { hasQualifiedName("encoding/pem", "Encode") }
+
+    override FunctionInput getAnInput() { result.isParameter(1) }
+
+    override FunctionOutput getOutput() { result.isParameter(0) }
+
+    override string getFormat() { result = "PEM" }
+  }
+
+  /** The `EncodeToMemory` function in the `encoding/pem` package. */
+  private class EncodeToMemoryFunction extends MarshalingFunction::Range {
+    EncodeToMemoryFunction() { hasQualifiedName("encoding/pem", "EncodeToMemory") }
+
+    override FunctionInput getAnInput() { result.isParameter(0) }
+
+    override FunctionOutput getOutput() { result.isResult() }
+
+    override string getFormat() { result = "PEM" }
+  }
+
+  /** The `Decode` function in the `encoding/pem` package. */
+  private class UnmarshalFunction extends UnmarshalingFunction::Range {
+    UnmarshalFunction() { hasQualifiedName("encoding/pem", "Decode") }
+
+    override FunctionInput getAnInput() { result.isParameter(0) }
+
+    override FunctionOutput getOutput() { result.isResult(0) }
+
+    override string getFormat() { result = "PEM" }
+  }
+
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func Decode(data []byte) (p *Block, rest []byte)
+      hasQualifiedName("encoding/pem", "Decode") and
+      (inp.isParameter(0) and outp.isResult(_))
+      or
+      // signature: func Encode(out io.Writer, b *Block) error
+      hasQualifiedName("encoding/pem", "Encode") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func EncodeToMemory(b *Block) []byte
+      hasQualifiedName("encoding/pem", "EncodeToMemory") and
+      (inp.isParameter(0) and outp.isResult())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/EncodingXml.qll

@@ -0,0 +1,154 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `encoding/xml` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `encoding/xml` package. */
+module EncodingXml {
+  /** The `Marshal` or `MarshalIndent` function in the `encoding/xml` package. */
+  private class MarshalFunction extends MarshalingFunction::Range {
+    MarshalFunction() {
+      this.hasQualifiedName("encoding/xml", "Marshal") or
+      this.hasQualifiedName("encoding/xml", "MarshalIndent")
+    }
+
+    override FunctionInput getAnInput() { result.isParameter(0) }
+
+    override FunctionOutput getOutput() { result.isResult(0) }
+
+    override string getFormat() { result = "XML" }
+  }
+
+  private class UnmarshalFunction extends UnmarshalingFunction::Range {
+    UnmarshalFunction() { this.hasQualifiedName("encoding/xml", "Unmarshal") }
+
+    override FunctionInput getAnInput() { result.isParameter(0) }
+
+    override FunctionOutput getOutput() { result.isParameter(1) }
+
+    override string getFormat() { result = "XML" }
+  }
+
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func CopyToken(t Token) Token
+      hasQualifiedName("encoding/xml", "CopyToken") and
+      (inp.isParameter(0) and outp.isResult())
+      or
+      // signature: func Escape(w io.Writer, s []byte)
+      hasQualifiedName("encoding/xml", "Escape") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func EscapeText(w io.Writer, s []byte) error
+      hasQualifiedName("encoding/xml", "EscapeText") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func Marshal(v interface{}) ([]byte, error)
+      hasQualifiedName("encoding/xml", "Marshal") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func MarshalIndent(v interface{}, prefix string, indent string) ([]byte, error)
+      hasQualifiedName("encoding/xml", "MarshalIndent") and
+      (inp.isParameter(_) and outp.isResult(0))
+      or
+      // signature: func NewDecoder(r io.Reader) *Decoder
+      hasQualifiedName("encoding/xml", "NewDecoder") and
+      (inp.isParameter(0) and outp.isResult())
+      or
+      // signature: func NewEncoder(w io.Writer) *Encoder
+      hasQualifiedName("encoding/xml", "NewEncoder") and
+      (inp.isResult() and outp.isParameter(0))
+      or
+      // signature: func NewTokenDecoder(t TokenReader) *Decoder
+      hasQualifiedName("encoding/xml", "NewTokenDecoder") and
+      (inp.isParameter(0) and outp.isResult())
+      or
+      // signature: func Unmarshal(data []byte, v interface{}) error
+      hasQualifiedName("encoding/xml", "Unmarshal") and
+      (inp.isParameter(0) and outp.isParameter(1))
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (CharData).Copy() CharData
+      this.hasQualifiedName("encoding/xml", "CharData", "Copy") and
+      (inp.isReceiver() and outp.isResult())
+      or
+      // signature: func (Comment).Copy() Comment
+      this.hasQualifiedName("encoding/xml", "Comment", "Copy") and
+      (inp.isReceiver() and outp.isResult())
+      or
+      // signature: func (*Decoder).Decode(v interface{}) error
+      this.hasQualifiedName("encoding/xml", "Decoder", "Decode") and
+      (inp.isReceiver() and outp.isParameter(0))
+      or
+      // signature: func (*Decoder).DecodeElement(v interface{}, start *StartElement) error
+      this.hasQualifiedName("encoding/xml", "Decoder", "DecodeElement") and
+      (inp.isReceiver() and outp.isParameter(0))
+      or
+      // signature: func (*Decoder).RawToken() (Token, error)
+      this.hasQualifiedName("encoding/xml", "Decoder", "RawToken") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (*Decoder).Token() (Token, error)
+      this.hasQualifiedName("encoding/xml", "Decoder", "Token") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (Directive).Copy() Directive
+      this.hasQualifiedName("encoding/xml", "Directive", "Copy") and
+      (inp.isReceiver() and outp.isResult())
+      or
+      // signature: func (*Encoder).Encode(v interface{}) error
+      this.hasQualifiedName("encoding/xml", "Encoder", "Encode") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (*Encoder).EncodeElement(v interface{}, start StartElement) error
+      this.hasQualifiedName("encoding/xml", "Encoder", "EncodeElement") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (*Encoder).EncodeToken(t Token) error
+      this.hasQualifiedName("encoding/xml", "Encoder", "EncodeToken") and
+      (inp.isParameter(0) and outp.isReceiver())
+      or
+      // signature: func (*Encoder).Indent(prefix string, indent string)
+      this.hasQualifiedName("encoding/xml", "Encoder", "Indent") and
+      (inp.isParameter(_) and outp.isReceiver())
+      or
+      // signature: func (ProcInst).Copy() ProcInst
+      this.hasQualifiedName("encoding/xml", "ProcInst", "Copy") and
+      (inp.isReceiver() and outp.isResult())
+      or
+      // signature: func (StartElement).Copy() StartElement
+      this.hasQualifiedName("encoding/xml", "StartElement", "Copy") and
+      (inp.isReceiver() and outp.isResult())
+      or
+      // signature: func (Marshaler).MarshalXML(e *Encoder, start StartElement) error
+      this.implements("encoding/xml", "Marshaler", "MarshalXML") and
+      (inp.isReceiver() and outp.isParameter(0))
+      or
+      // signature: func (TokenReader).Token() (Token, error)
+      this.implements("encoding/xml", "TokenReader", "Token") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (Unmarshaler).UnmarshalXML(d *Decoder, start StartElement) error
+      this.implements("encoding/xml", "Unmarshaler", "UnmarshalXML") and
+      (inp.isParameter(0) and outp.isReceiver())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Encoding.go

@@ -0,0 +1,54 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import "encoding"
+
+func TaintStepTest_EncodingBinaryMarshalerMarshalBinary_B0I0O0(sourceCQL interface{}) interface{} {
+	fromBinaryMarshaler656 := sourceCQL.(encoding.BinaryMarshaler)
+	intoByte414, _ := fromBinaryMarshaler656.MarshalBinary()
+	return intoByte414
+}
+
+func TaintStepTest_EncodingTextMarshalerMarshalText_B0I0O0(sourceCQL interface{}) interface{} {
+	fromTextMarshaler518 := sourceCQL.(encoding.TextMarshaler)
+	intoByte650, _ := fromTextMarshaler518.MarshalText()
+	return intoByte650
+}
+
+func TaintStepTest_EncodingBinaryUnmarshalerUnmarshalBinary_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte784 := sourceCQL.([]byte)
+	var intoBinaryUnmarshaler957 encoding.BinaryUnmarshaler
+	intoBinaryUnmarshaler957.UnmarshalBinary(fromByte784)
+	return intoBinaryUnmarshaler957
+}
+
+func TaintStepTest_EncodingTextUnmarshalerUnmarshalText_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte520 := sourceCQL.([]byte)
+	var intoTextUnmarshaler443 encoding.TextUnmarshaler
+	intoTextUnmarshaler443.UnmarshalText(fromByte520)
+	return intoTextUnmarshaler443
+}
+
+func RunAllTaints_Encoding() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingBinaryMarshalerMarshalBinary_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingTextMarshalerMarshalText_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingBinaryUnmarshalerUnmarshalBinary_B0I0O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_EncodingTextUnmarshalerUnmarshalText_B0I0O0(source)
+		sink(3, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAscii85.go

@@ -0,0 +1,34 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"encoding/ascii85"
+	"io"
+)
+
+func TaintStepTest_EncodingAscii85Decode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte656 := sourceCQL.([]byte)
+	var intoByte414 []byte
+	ascii85.Decode(intoByte414, fromByte656, false)
+	return intoByte414
+}
+
+func TaintStepTest_EncodingAscii85NewDecoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader518 := sourceCQL.(io.Reader)
+	intoReader650 := ascii85.NewDecoder(fromReader518)
+	return intoReader650
+}
+
+func RunAllTaints_EncodingAscii85() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingAscii85Decode_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingAscii85NewDecoder_B0I0O0(source)
+		sink(1, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAsn1.go

@@ -0,0 +1,110 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import "encoding/asn1"
+
+func TaintStepTest_EncodingAsn1Marshal_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface656 := sourceCQL.(interface{})
+	intoByte414, _ := asn1.Marshal(fromInterface656)
+	return intoByte414
+}
+
+func TaintStepTest_EncodingAsn1MarshalWithParams_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface518 := sourceCQL.(interface{})
+	intoByte650, _ := asn1.MarshalWithParams(fromInterface518, "")
+	return intoByte650
+}
+
+func TaintStepTest_EncodingAsn1MarshalWithParams_B0I1O0(sourceCQL interface{}) interface{} {
+	fromString784 := sourceCQL.(string)
+	intoByte957, _ := asn1.MarshalWithParams(nil, fromString784)
+	return intoByte957
+}
+
+func TaintStepTest_EncodingAsn1Unmarshal_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte520 := sourceCQL.([]byte)
+	var intoInterface443 interface{}
+	asn1.Unmarshal(fromByte520, intoInterface443)
+	return intoInterface443
+}
+
+func TaintStepTest_EncodingAsn1Unmarshal_B0I0O1(sourceCQL interface{}) interface{} {
+	fromByte127 := sourceCQL.([]byte)
+	intoByte483, _ := asn1.Unmarshal(fromByte127, nil)
+	return intoByte483
+}
+
+func TaintStepTest_EncodingAsn1UnmarshalWithParams_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte989 := sourceCQL.([]byte)
+	var intoInterface982 interface{}
+	asn1.UnmarshalWithParams(fromByte989, intoInterface982, "")
+	return intoInterface982
+}
+
+func TaintStepTest_EncodingAsn1UnmarshalWithParams_B0I0O1(sourceCQL interface{}) interface{} {
+	fromByte417 := sourceCQL.([]byte)
+	intoByte584, _ := asn1.UnmarshalWithParams(fromByte417, nil, "")
+	return intoByte584
+}
+
+func TaintStepTest_EncodingAsn1UnmarshalWithParams_B0I1O0(sourceCQL interface{}) interface{} {
+	fromString991 := sourceCQL.(string)
+	var intoInterface881 interface{}
+	asn1.UnmarshalWithParams(nil, intoInterface881, fromString991)
+	return intoInterface881
+}
+
+func TaintStepTest_EncodingAsn1UnmarshalWithParams_B0I1O1(sourceCQL interface{}) interface{} {
+	fromString186 := sourceCQL.(string)
+	intoByte284, _ := asn1.UnmarshalWithParams(nil, nil, fromString186)
+	return intoByte284
+}
+
+func RunAllTaints_EncodingAsn1() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingAsn1Marshal_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingAsn1MarshalWithParams_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingAsn1MarshalWithParams_B0I1O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_EncodingAsn1Unmarshal_B0I0O0(source)
+		sink(3, out)
+	}
+	{
+		source := newSource(4)
+		out := TaintStepTest_EncodingAsn1Unmarshal_B0I0O1(source)
+		sink(4, out)
+	}
+	{
+		source := newSource(5)
+		out := TaintStepTest_EncodingAsn1UnmarshalWithParams_B0I0O0(source)
+		sink(5, out)
+	}
+	{
+		source := newSource(6)
+		out := TaintStepTest_EncodingAsn1UnmarshalWithParams_B0I0O1(source)
+		sink(6, out)
+	}
+	{
+		source := newSource(7)
+		out := TaintStepTest_EncodingAsn1UnmarshalWithParams_B0I1O0(source)
+		sink(7, out)
+	}
+	{
+		source := newSource(8)
+		out := TaintStepTest_EncodingAsn1UnmarshalWithParams_B0I1O1(source)
+		sink(8, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase32.go

@@ -0,0 +1,47 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"encoding/base32"
+	"io"
+)
+
+func TaintStepTest_EncodingBase32NewDecoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader656 := sourceCQL.(io.Reader)
+	intoReader414 := base32.NewDecoder(nil, fromReader656)
+	return intoReader414
+}
+
+func TaintStepTest_EncodingBase32EncodingDecode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte518 := sourceCQL.([]byte)
+	var intoByte650 []byte
+	var mediumObjCQL base32.Encoding
+	mediumObjCQL.Decode(intoByte650, fromByte518)
+	return intoByte650
+}
+
+func TaintStepTest_EncodingBase32EncodingDecodeString_B0I0O0(sourceCQL interface{}) interface{} {
+	fromString784 := sourceCQL.(string)
+	var mediumObjCQL base32.Encoding
+	intoByte957, _ := mediumObjCQL.DecodeString(fromString784)
+	return intoByte957
+}
+
+func RunAllTaints_EncodingBase32() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingBase32NewDecoder_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingBase32EncodingDecode_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingBase32EncodingDecodeString_B0I0O0(source)
+		sink(2, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase64.go

@@ -0,0 +1,47 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"encoding/base64"
+	"io"
+)
+
+func TaintStepTest_EncodingBase64NewDecoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader656 := sourceCQL.(io.Reader)
+	intoReader414 := base64.NewDecoder(nil, fromReader656)
+	return intoReader414
+}
+
+func TaintStepTest_EncodingBase64EncodingDecode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte518 := sourceCQL.([]byte)
+	var intoByte650 []byte
+	var mediumObjCQL base64.Encoding
+	mediumObjCQL.Decode(intoByte650, fromByte518)
+	return intoByte650
+}
+
+func TaintStepTest_EncodingBase64EncodingDecodeString_B0I0O0(sourceCQL interface{}) interface{} {
+	fromString784 := sourceCQL.(string)
+	var mediumObjCQL base64.Encoding
+	intoByte957, _ := mediumObjCQL.DecodeString(fromString784)
+	return intoByte957
+}
+
+func RunAllTaints_EncodingBase64() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingBase64NewDecoder_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingBase64EncodingDecode_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingBase64EncodingDecodeString_B0I0O0(source)
+		sink(2, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBinary.go

@@ -0,0 +1,35 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"encoding/binary"
+	"io"
+)
+
+func TaintStepTest_EncodingBinaryRead_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader656 := sourceCQL.(io.Reader)
+	var intoInterface414 interface{}
+	binary.Read(fromReader656, nil, intoInterface414)
+	return intoInterface414
+}
+
+func TaintStepTest_EncodingBinaryWrite_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface518 := sourceCQL.(interface{})
+	var intoWriter650 io.Writer
+	binary.Write(intoWriter650, nil, fromInterface518)
+	return intoWriter650
+}
+
+func RunAllTaints_EncodingBinary() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingBinaryRead_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingBinaryWrite_B0I0O0(source)
+		sink(1, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingCsv.go

@@ -0,0 +1,81 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"encoding/csv"
+	"io"
+)
+
+func TaintStepTest_EncodingCsvNewReader_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader656 := sourceCQL.(io.Reader)
+	intoReader414 := csv.NewReader(fromReader656)
+	return intoReader414
+}
+
+func TaintStepTest_EncodingCsvNewWriter_B0I0O0(sourceCQL interface{}) interface{} {
+	fromWriter518 := sourceCQL.(*csv.Writer)
+	var intoWriter650 io.Writer
+	intermediateCQL := csv.NewWriter(intoWriter650)
+	link(fromWriter518, intermediateCQL)
+	return intoWriter650
+}
+
+func TaintStepTest_EncodingCsvReaderRead_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader784 := sourceCQL.(csv.Reader)
+	intoString957, _ := fromReader784.Read()
+	return intoString957
+}
+
+func TaintStepTest_EncodingCsvReaderReadAll_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader520 := sourceCQL.(csv.Reader)
+	intoString443, _ := fromReader520.ReadAll()
+	return intoString443
+}
+
+func TaintStepTest_EncodingCsvWriterWrite_B0I0O0(sourceCQL interface{}) interface{} {
+	fromString127 := sourceCQL.([]string)
+	var intoWriter483 csv.Writer
+	intoWriter483.Write(fromString127)
+	return intoWriter483
+}
+
+func TaintStepTest_EncodingCsvWriterWriteAll_B0I0O0(sourceCQL interface{}) interface{} {
+	fromString989 := sourceCQL.([][]string)
+	var intoWriter982 csv.Writer
+	intoWriter982.WriteAll(fromString989)
+	return intoWriter982
+}
+
+func RunAllTaints_EncodingCsv() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingCsvNewReader_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingCsvNewWriter_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingCsvReaderRead_B0I0O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_EncodingCsvReaderReadAll_B0I0O0(source)
+		sink(3, out)
+	}
+	{
+		source := newSource(4)
+		out := TaintStepTest_EncodingCsvWriterWrite_B0I0O0(source)
+		sink(4, out)
+	}
+	{
+		source := newSource(5)
+		out := TaintStepTest_EncodingCsvWriterWriteAll_B0I0O0(source)
+		sink(5, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingGob.go

@@ -0,0 +1,107 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"encoding/gob"
+	"io"
+	"reflect"
+)
+
+func TaintStepTest_EncodingGobNewDecoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader656 := sourceCQL.(io.Reader)
+	intoDecoder414 := gob.NewDecoder(fromReader656)
+	return intoDecoder414
+}
+
+func TaintStepTest_EncodingGobNewEncoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromEncoder518 := sourceCQL.(*gob.Encoder)
+	var intoWriter650 io.Writer
+	intermediateCQL := gob.NewEncoder(intoWriter650)
+	link(fromEncoder518, intermediateCQL)
+	return intoWriter650
+}
+
+func TaintStepTest_EncodingGobDecoderDecode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder784 := sourceCQL.(gob.Decoder)
+	var intoInterface957 interface{}
+	fromDecoder784.Decode(intoInterface957)
+	return intoInterface957
+}
+
+func TaintStepTest_EncodingGobDecoderDecodeValue_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder520 := sourceCQL.(gob.Decoder)
+	var intoValue443 reflect.Value
+	fromDecoder520.DecodeValue(intoValue443)
+	return intoValue443
+}
+
+func TaintStepTest_EncodingGobEncoderEncode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface127 := sourceCQL.(interface{})
+	var intoEncoder483 gob.Encoder
+	intoEncoder483.Encode(fromInterface127)
+	return intoEncoder483
+}
+
+func TaintStepTest_EncodingGobEncoderEncodeValue_B0I0O0(sourceCQL interface{}) interface{} {
+	fromValue989 := sourceCQL.(reflect.Value)
+	var intoEncoder982 gob.Encoder
+	intoEncoder982.EncodeValue(fromValue989)
+	return intoEncoder982
+}
+
+func TaintStepTest_EncodingGobGobDecoderGobDecode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte417 := sourceCQL.([]byte)
+	var intoGobDecoder584 gob.GobDecoder
+	intoGobDecoder584.GobDecode(fromByte417)
+	return intoGobDecoder584
+}
+
+func TaintStepTest_EncodingGobGobEncoderGobEncode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromGobEncoder991 := sourceCQL.(gob.GobEncoder)
+	intoByte881, _ := fromGobEncoder991.GobEncode()
+	return intoByte881
+}
+
+func RunAllTaints_EncodingGob() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingGobNewDecoder_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingGobNewEncoder_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingGobDecoderDecode_B0I0O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_EncodingGobDecoderDecodeValue_B0I0O0(source)
+		sink(3, out)
+	}
+	{
+		source := newSource(4)
+		out := TaintStepTest_EncodingGobEncoderEncode_B0I0O0(source)
+		sink(4, out)
+	}
+	{
+		source := newSource(5)
+		out := TaintStepTest_EncodingGobEncoderEncodeValue_B0I0O0(source)
+		sink(5, out)
+	}
+	{
+		source := newSource(6)
+		out := TaintStepTest_EncodingGobGobDecoderGobDecode_B0I0O0(source)
+		sink(6, out)
+	}
+	{
+		source := newSource(7)
+		out := TaintStepTest_EncodingGobGobEncoderGobEncode_B0I0O0(source)
+		sink(7, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingHex.go

@@ -0,0 +1,45 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"encoding/hex"
+	"io"
+)
+
+func TaintStepTest_EncodingHexDecode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte656 := sourceCQL.([]byte)
+	var intoByte414 []byte
+	hex.Decode(intoByte414, fromByte656)
+	return intoByte414
+}
+
+func TaintStepTest_EncodingHexDecodeString_B0I0O0(sourceCQL interface{}) interface{} {
+	fromString518 := sourceCQL.(string)
+	intoByte650, _ := hex.DecodeString(fromString518)
+	return intoByte650
+}
+
+func TaintStepTest_EncodingHexNewDecoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader784 := sourceCQL.(io.Reader)
+	intoReader957 := hex.NewDecoder(fromReader784)
+	return intoReader957
+}
+
+func RunAllTaints_EncodingHex() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingHexDecode_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingHexDecodeString_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingHexNewDecoder_B0I0O0(source)
+		sink(2, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingJson.go

@@ -0,0 +1,268 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+)
+
+func TaintStepTest_EncodingJsonCompact_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte656 := sourceCQL.([]byte)
+	var intoBuffer414 *bytes.Buffer
+	json.Compact(intoBuffer414, fromByte656)
+	return intoBuffer414
+}
+
+func TaintStepTest_EncodingJsonHTMLEscape_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte518 := sourceCQL.([]byte)
+	var intoBuffer650 *bytes.Buffer
+	json.HTMLEscape(intoBuffer650, fromByte518)
+	return intoBuffer650
+}
+
+func TaintStepTest_EncodingJsonIndent_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte784 := sourceCQL.([]byte)
+	var intoBuffer957 *bytes.Buffer
+	json.Indent(intoBuffer957, fromByte784, "", "")
+	return intoBuffer957
+}
+
+func TaintStepTest_EncodingJsonIndent_B0I1O0(sourceCQL interface{}) interface{} {
+	fromString520 := sourceCQL.(string)
+	var intoBuffer443 *bytes.Buffer
+	json.Indent(intoBuffer443, nil, fromString520, "")
+	return intoBuffer443
+}
+
+func TaintStepTest_EncodingJsonIndent_B0I2O0(sourceCQL interface{}) interface{} {
+	fromString127 := sourceCQL.(string)
+	var intoBuffer483 *bytes.Buffer
+	json.Indent(intoBuffer483, nil, "", fromString127)
+	return intoBuffer483
+}
+
+func TaintStepTest_EncodingJsonMarshal_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface989 := sourceCQL.(interface{})
+	intoByte982, _ := json.Marshal(fromInterface989)
+	return intoByte982
+}
+
+func TaintStepTest_EncodingJsonMarshalIndent_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface417 := sourceCQL.(interface{})
+	intoByte584, _ := json.MarshalIndent(fromInterface417, "", "")
+	return intoByte584
+}
+
+func TaintStepTest_EncodingJsonMarshalIndent_B0I1O0(sourceCQL interface{}) interface{} {
+	fromString991 := sourceCQL.(string)
+	intoByte881, _ := json.MarshalIndent(nil, fromString991, "")
+	return intoByte881
+}
+
+func TaintStepTest_EncodingJsonMarshalIndent_B0I2O0(sourceCQL interface{}) interface{} {
+	fromString186 := sourceCQL.(string)
+	intoByte284, _ := json.MarshalIndent(nil, "", fromString186)
+	return intoByte284
+}
+
+func TaintStepTest_EncodingJsonNewDecoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader908 := sourceCQL.(io.Reader)
+	intoDecoder137 := json.NewDecoder(fromReader908)
+	return intoDecoder137
+}
+
+func TaintStepTest_EncodingJsonNewEncoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromEncoder494 := sourceCQL.(*json.Encoder)
+	var intoWriter873 io.Writer
+	intermediateCQL := json.NewEncoder(intoWriter873)
+	link(fromEncoder494, intermediateCQL)
+	return intoWriter873
+}
+
+func TaintStepTest_EncodingJsonUnmarshal_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte599 := sourceCQL.([]byte)
+	var intoInterface409 interface{}
+	json.Unmarshal(fromByte599, intoInterface409)
+	return intoInterface409
+}
+
+func TaintStepTest_EncodingJsonDecoderBuffered_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder246 := sourceCQL.(json.Decoder)
+	intoReader898 := fromDecoder246.Buffered()
+	return intoReader898
+}
+
+func TaintStepTest_EncodingJsonDecoderDecode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder598 := sourceCQL.(json.Decoder)
+	var intoInterface631 interface{}
+	fromDecoder598.Decode(intoInterface631)
+	return intoInterface631
+}
+
+func TaintStepTest_EncodingJsonDecoderToken_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder165 := sourceCQL.(json.Decoder)
+	intoToken150, _ := fromDecoder165.Token()
+	return intoToken150
+}
+
+func TaintStepTest_EncodingJsonEncoderEncode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface340 := sourceCQL.(interface{})
+	var intoEncoder471 json.Encoder
+	intoEncoder471.Encode(fromInterface340)
+	return intoEncoder471
+}
+
+func TaintStepTest_EncodingJsonEncoderSetIndent_B0I0O0(sourceCQL interface{}) interface{} {
+	fromString290 := sourceCQL.(string)
+	var intoEncoder758 json.Encoder
+	intoEncoder758.SetIndent(fromString290, "")
+	return intoEncoder758
+}
+
+func TaintStepTest_EncodingJsonEncoderSetIndent_B0I1O0(sourceCQL interface{}) interface{} {
+	fromString396 := sourceCQL.(string)
+	var intoEncoder707 json.Encoder
+	intoEncoder707.SetIndent("", fromString396)
+	return intoEncoder707
+}
+
+func TaintStepTest_EncodingJsonRawMessageMarshalJSON_B0I0O0(sourceCQL interface{}) interface{} {
+	fromRawMessage912 := sourceCQL.(json.RawMessage)
+	intoByte718, _ := fromRawMessage912.MarshalJSON()
+	return intoByte718
+}
+
+func TaintStepTest_EncodingJsonRawMessageUnmarshalJSON_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte972 := sourceCQL.([]byte)
+	var intoRawMessage633 json.RawMessage
+	intoRawMessage633.UnmarshalJSON(fromByte972)
+	return intoRawMessage633
+}
+
+func TaintStepTest_EncodingJsonMarshalerMarshalJSON_B0I0O0(sourceCQL interface{}) interface{} {
+	fromMarshaler316 := sourceCQL.(json.Marshaler)
+	intoByte145, _ := fromMarshaler316.MarshalJSON()
+	return intoByte145
+}
+
+func TaintStepTest_EncodingJsonUnmarshalerUnmarshalJSON_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte817 := sourceCQL.([]byte)
+	var intoUnmarshaler474 json.Unmarshaler
+	intoUnmarshaler474.UnmarshalJSON(fromByte817)
+	return intoUnmarshaler474
+}
+
+func RunAllTaints_EncodingJson() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingJsonCompact_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingJsonHTMLEscape_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingJsonIndent_B0I0O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_EncodingJsonIndent_B0I1O0(source)
+		sink(3, out)
+	}
+	{
+		source := newSource(4)
+		out := TaintStepTest_EncodingJsonIndent_B0I2O0(source)
+		sink(4, out)
+	}
+	{
+		source := newSource(5)
+		out := TaintStepTest_EncodingJsonMarshal_B0I0O0(source)
+		sink(5, out)
+	}
+	{
+		source := newSource(6)
+		out := TaintStepTest_EncodingJsonMarshalIndent_B0I0O0(source)
+		sink(6, out)
+	}
+	{
+		source := newSource(7)
+		out := TaintStepTest_EncodingJsonMarshalIndent_B0I1O0(source)
+		sink(7, out)
+	}
+	{
+		source := newSource(8)
+		out := TaintStepTest_EncodingJsonMarshalIndent_B0I2O0(source)
+		sink(8, out)
+	}
+	{
+		source := newSource(9)
+		out := TaintStepTest_EncodingJsonNewDecoder_B0I0O0(source)
+		sink(9, out)
+	}
+	{
+		source := newSource(10)
+		out := TaintStepTest_EncodingJsonNewEncoder_B0I0O0(source)
+		sink(10, out)
+	}
+	{
+		source := newSource(11)
+		out := TaintStepTest_EncodingJsonUnmarshal_B0I0O0(source)
+		sink(11, out)
+	}
+	{
+		source := newSource(12)
+		out := TaintStepTest_EncodingJsonDecoderBuffered_B0I0O0(source)
+		sink(12, out)
+	}
+	{
+		source := newSource(13)
+		out := TaintStepTest_EncodingJsonDecoderDecode_B0I0O0(source)
+		sink(13, out)
+	}
+	{
+		source := newSource(14)
+		out := TaintStepTest_EncodingJsonDecoderToken_B0I0O0(source)
+		sink(14, out)
+	}
+	{
+		source := newSource(15)
+		out := TaintStepTest_EncodingJsonEncoderEncode_B0I0O0(source)
+		sink(15, out)
+	}
+	{
+		source := newSource(16)
+		out := TaintStepTest_EncodingJsonEncoderSetIndent_B0I0O0(source)
+		sink(16, out)
+	}
+	{
+		source := newSource(17)
+		out := TaintStepTest_EncodingJsonEncoderSetIndent_B0I1O0(source)
+		sink(17, out)
+	}
+	{
+		source := newSource(18)
+		out := TaintStepTest_EncodingJsonRawMessageMarshalJSON_B0I0O0(source)
+		sink(18, out)
+	}
+	{
+		source := newSource(19)
+		out := TaintStepTest_EncodingJsonRawMessageUnmarshalJSON_B0I0O0(source)
+		sink(19, out)
+	}
+	{
+		source := newSource(20)
+		out := TaintStepTest_EncodingJsonMarshalerMarshalJSON_B0I0O0(source)
+		sink(20, out)
+	}
+	{
+		source := newSource(21)
+		out := TaintStepTest_EncodingJsonUnmarshalerUnmarshalJSON_B0I0O0(source)
+		sink(21, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingPem.go

@@ -0,0 +1,56 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"encoding/pem"
+	"io"
+)
+
+func TaintStepTest_EncodingPemDecode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte656 := sourceCQL.([]byte)
+	intoBlock414, _ := pem.Decode(fromByte656)
+	return intoBlock414
+}
+
+func TaintStepTest_EncodingPemDecode_B0I0O1(sourceCQL interface{}) interface{} {
+	fromByte518 := sourceCQL.([]byte)
+	_, intoByte650 := pem.Decode(fromByte518)
+	return intoByte650
+}
+
+func TaintStepTest_EncodingPemEncode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromBlock784 := sourceCQL.(*pem.Block)
+	var intoWriter957 io.Writer
+	pem.Encode(intoWriter957, fromBlock784)
+	return intoWriter957
+}
+
+func TaintStepTest_EncodingPemEncodeToMemory_B0I0O0(sourceCQL interface{}) interface{} {
+	fromBlock520 := sourceCQL.(*pem.Block)
+	intoByte443 := pem.EncodeToMemory(fromBlock520)
+	return intoByte443
+}
+
+func RunAllTaints_EncodingPem() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingPemDecode_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingPemDecode_B0I0O1(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingPemEncode_B0I0O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_EncodingPemEncodeToMemory_B0I0O0(source)
+		sink(3, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingXml.go

@@ -0,0 +1,333 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"encoding/xml"
+	"io"
+)
+
+func TaintStepTest_EncodingXmlCopyToken_B0I0O0(sourceCQL interface{}) interface{} {
+	fromToken656 := sourceCQL.(xml.Token)
+	intoToken414 := xml.CopyToken(fromToken656)
+	return intoToken414
+}
+
+func TaintStepTest_EncodingXmlEscape_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte518 := sourceCQL.([]byte)
+	var intoWriter650 io.Writer
+	xml.Escape(intoWriter650, fromByte518)
+	return intoWriter650
+}
+
+func TaintStepTest_EncodingXmlEscapeText_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte784 := sourceCQL.([]byte)
+	var intoWriter957 io.Writer
+	xml.EscapeText(intoWriter957, fromByte784)
+	return intoWriter957
+}
+
+func TaintStepTest_EncodingXmlMarshal_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface520 := sourceCQL.(interface{})
+	intoByte443, _ := xml.Marshal(fromInterface520)
+	return intoByte443
+}
+
+func TaintStepTest_EncodingXmlMarshalIndent_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface127 := sourceCQL.(interface{})
+	intoByte483, _ := xml.MarshalIndent(fromInterface127, "", "")
+	return intoByte483
+}
+
+func TaintStepTest_EncodingXmlMarshalIndent_B0I1O0(sourceCQL interface{}) interface{} {
+	fromString989 := sourceCQL.(string)
+	intoByte982, _ := xml.MarshalIndent(nil, fromString989, "")
+	return intoByte982
+}
+
+func TaintStepTest_EncodingXmlMarshalIndent_B0I2O0(sourceCQL interface{}) interface{} {
+	fromString417 := sourceCQL.(string)
+	intoByte584, _ := xml.MarshalIndent(nil, "", fromString417)
+	return intoByte584
+}
+
+func TaintStepTest_EncodingXmlNewDecoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromReader991 := sourceCQL.(io.Reader)
+	intoDecoder881 := xml.NewDecoder(fromReader991)
+	return intoDecoder881
+}
+
+func TaintStepTest_EncodingXmlNewEncoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromEncoder186 := sourceCQL.(*xml.Encoder)
+	var intoWriter284 io.Writer
+	intermediateCQL := xml.NewEncoder(intoWriter284)
+	link(fromEncoder186, intermediateCQL)
+	return intoWriter284
+}
+
+func TaintStepTest_EncodingXmlNewTokenDecoder_B0I0O0(sourceCQL interface{}) interface{} {
+	fromTokenReader908 := sourceCQL.(xml.TokenReader)
+	intoDecoder137 := xml.NewTokenDecoder(fromTokenReader908)
+	return intoDecoder137
+}
+
+func TaintStepTest_EncodingXmlUnmarshal_B0I0O0(sourceCQL interface{}) interface{} {
+	fromByte494 := sourceCQL.([]byte)
+	var intoInterface873 interface{}
+	xml.Unmarshal(fromByte494, intoInterface873)
+	return intoInterface873
+}
+
+func TaintStepTest_EncodingXmlCharDataCopy_B0I0O0(sourceCQL interface{}) interface{} {
+	fromCharData599 := sourceCQL.(xml.CharData)
+	intoCharData409 := fromCharData599.Copy()
+	return intoCharData409
+}
+
+func TaintStepTest_EncodingXmlCommentCopy_B0I0O0(sourceCQL interface{}) interface{} {
+	fromComment246 := sourceCQL.(xml.Comment)
+	intoComment898 := fromComment246.Copy()
+	return intoComment898
+}
+
+func TaintStepTest_EncodingXmlDecoderDecode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder598 := sourceCQL.(xml.Decoder)
+	var intoInterface631 interface{}
+	fromDecoder598.Decode(intoInterface631)
+	return intoInterface631
+}
+
+func TaintStepTest_EncodingXmlDecoderDecodeElement_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder165 := sourceCQL.(xml.Decoder)
+	var intoInterface150 interface{}
+	fromDecoder165.DecodeElement(intoInterface150, nil)
+	return intoInterface150
+}
+
+func TaintStepTest_EncodingXmlDecoderRawToken_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder340 := sourceCQL.(xml.Decoder)
+	intoToken471, _ := fromDecoder340.RawToken()
+	return intoToken471
+}
+
+func TaintStepTest_EncodingXmlDecoderToken_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder290 := sourceCQL.(xml.Decoder)
+	intoToken758, _ := fromDecoder290.Token()
+	return intoToken758
+}
+
+func TaintStepTest_EncodingXmlDirectiveCopy_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDirective396 := sourceCQL.(xml.Directive)
+	intoDirective707 := fromDirective396.Copy()
+	return intoDirective707
+}
+
+func TaintStepTest_EncodingXmlEncoderEncode_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface912 := sourceCQL.(interface{})
+	var intoEncoder718 xml.Encoder
+	intoEncoder718.Encode(fromInterface912)
+	return intoEncoder718
+}
+
+func TaintStepTest_EncodingXmlEncoderEncodeElement_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface972 := sourceCQL.(interface{})
+	var intoEncoder633 xml.Encoder
+	intoEncoder633.EncodeElement(fromInterface972, xml.StartElement{})
+	return intoEncoder633
+}
+
+func TaintStepTest_EncodingXmlEncoderEncodeToken_B0I0O0(sourceCQL interface{}) interface{} {
+	fromToken316 := sourceCQL.(xml.Token)
+	var intoEncoder145 xml.Encoder
+	intoEncoder145.EncodeToken(fromToken316)
+	return intoEncoder145
+}
+
+func TaintStepTest_EncodingXmlEncoderIndent_B0I0O0(sourceCQL interface{}) interface{} {
+	fromString817 := sourceCQL.(string)
+	var intoEncoder474 xml.Encoder
+	intoEncoder474.Indent(fromString817, "")
+	return intoEncoder474
+}
+
+func TaintStepTest_EncodingXmlEncoderIndent_B0I1O0(sourceCQL interface{}) interface{} {
+	fromString832 := sourceCQL.(string)
+	var intoEncoder378 xml.Encoder
+	intoEncoder378.Indent("", fromString832)
+	return intoEncoder378
+}
+
+func TaintStepTest_EncodingXmlProcInstCopy_B0I0O0(sourceCQL interface{}) interface{} {
+	fromProcInst541 := sourceCQL.(xml.ProcInst)
+	intoProcInst139 := fromProcInst541.Copy()
+	return intoProcInst139
+}
+
+func TaintStepTest_EncodingXmlStartElementCopy_B0I0O0(sourceCQL interface{}) interface{} {
+	fromStartElement814 := sourceCQL.(xml.StartElement)
+	intoStartElement768 := fromStartElement814.Copy()
+	return intoStartElement768
+}
+
+func TaintStepTest_EncodingXmlMarshalerMarshalXML_B0I0O0(sourceCQL interface{}) interface{} {
+	fromMarshaler468 := sourceCQL.(xml.Marshaler)
+	var intoEncoder736 *xml.Encoder
+	fromMarshaler468.MarshalXML(intoEncoder736, xml.StartElement{})
+	return intoEncoder736
+}
+
+func TaintStepTest_EncodingXmlTokenReaderToken_B0I0O0(sourceCQL interface{}) interface{} {
+	fromTokenReader516 := sourceCQL.(xml.TokenReader)
+	intoToken246, _ := fromTokenReader516.Token()
+	return intoToken246
+}
+
+func TaintStepTest_EncodingXmlUnmarshalerUnmarshalXML_B0I0O0(sourceCQL interface{}) interface{} {
+	fromDecoder679 := sourceCQL.(*xml.Decoder)
+	var intoUnmarshaler736 xml.Unmarshaler
+	intoUnmarshaler736.UnmarshalXML(fromDecoder679, xml.StartElement{})
+	return intoUnmarshaler736
+}
+
+func RunAllTaints_EncodingXml() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_EncodingXmlCopyToken_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_EncodingXmlEscape_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_EncodingXmlEscapeText_B0I0O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_EncodingXmlMarshal_B0I0O0(source)
+		sink(3, out)
+	}
+	{
+		source := newSource(4)
+		out := TaintStepTest_EncodingXmlMarshalIndent_B0I0O0(source)
+		sink(4, out)
+	}
+	{
+		source := newSource(5)
+		out := TaintStepTest_EncodingXmlMarshalIndent_B0I1O0(source)
+		sink(5, out)
+	}
+	{
+		source := newSource(6)
+		out := TaintStepTest_EncodingXmlMarshalIndent_B0I2O0(source)
+		sink(6, out)
+	}
+	{
+		source := newSource(7)
+		out := TaintStepTest_EncodingXmlNewDecoder_B0I0O0(source)
+		sink(7, out)
+	}
+	{
+		source := newSource(8)
+		out := TaintStepTest_EncodingXmlNewEncoder_B0I0O0(source)
+		sink(8, out)
+	}
+	{
+		source := newSource(9)
+		out := TaintStepTest_EncodingXmlNewTokenDecoder_B0I0O0(source)
+		sink(9, out)
+	}
+	{
+		source := newSource(10)
+		out := TaintStepTest_EncodingXmlUnmarshal_B0I0O0(source)
+		sink(10, out)
+	}
+	{
+		source := newSource(11)
+		out := TaintStepTest_EncodingXmlCharDataCopy_B0I0O0(source)
+		sink(11, out)
+	}
+	{
+		source := newSource(12)
+		out := TaintStepTest_EncodingXmlCommentCopy_B0I0O0(source)
+		sink(12, out)
+	}
+	{
+		source := newSource(13)
+		out := TaintStepTest_EncodingXmlDecoderDecode_B0I0O0(source)
+		sink(13, out)
+	}
+	{
+		source := newSource(14)
+		out := TaintStepTest_EncodingXmlDecoderDecodeElement_B0I0O0(source)
+		sink(14, out)
+	}
+	{
+		source := newSource(15)
+		out := TaintStepTest_EncodingXmlDecoderRawToken_B0I0O0(source)
+		sink(15, out)
+	}
+	{
+		source := newSource(16)
+		out := TaintStepTest_EncodingXmlDecoderToken_B0I0O0(source)
+		sink(16, out)
+	}
+	{
+		source := newSource(17)
+		out := TaintStepTest_EncodingXmlDirectiveCopy_B0I0O0(source)
+		sink(17, out)
+	}
+	{
+		source := newSource(18)
+		out := TaintStepTest_EncodingXmlEncoderEncode_B0I0O0(source)
+		sink(18, out)
+	}
+	{
+		source := newSource(19)
+		out := TaintStepTest_EncodingXmlEncoderEncodeElement_B0I0O0(source)
+		sink(19, out)
+	}
+	{
+		source := newSource(20)
+		out := TaintStepTest_EncodingXmlEncoderEncodeToken_B0I0O0(source)
+		sink(20, out)
+	}
+	{
+		source := newSource(21)
+		out := TaintStepTest_EncodingXmlEncoderIndent_B0I0O0(source)
+		sink(21, out)
+	}
+	{
+		source := newSource(22)
+		out := TaintStepTest_EncodingXmlEncoderIndent_B0I1O0(source)
+		sink(22, out)
+	}
+	{
+		source := newSource(23)
+		out := TaintStepTest_EncodingXmlProcInstCopy_B0I0O0(source)
+		sink(23, out)
+	}
+	{
+		source := newSource(24)
+		out := TaintStepTest_EncodingXmlStartElementCopy_B0I0O0(source)
+		sink(24, out)
+	}
+	{
+		source := newSource(25)
+		out := TaintStepTest_EncodingXmlMarshalerMarshalXML_B0I0O0(source)
+		sink(25, out)
+	}
+	{
+		source := newSource(26)
+		out := TaintStepTest_EncodingXmlTokenReaderToken_B0I0O0(source)
+		sink(26, out)
+	}
+	{
+		source := newSource(27)
+		out := TaintStepTest_EncodingXmlUnmarshalerUnmarshalXML_B0I0O0(source)
+		sink(27, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.expected

@@ -75,6 +75,8 @@
 | main.go:13:14:13:52 | call to MarshalIndent | main.go:13:2:13:52 | ... := ...[0] |
 | main.go:13:14:13:52 | call to MarshalIndent | main.go:13:2:13:52 | ... := ...[1] |
 | main.go:13:33:13:33 | v | main.go:13:2:13:52 | ... := ...[0] |
+| main.go:13:36:13:45 | "/*JSON*/" | main.go:13:2:13:52 | ... := ...[0] |
+| main.go:13:48:13:51 | "  " | main.go:13:2:13:52 | ... := ...[0] |
 | main.go:14:25:14:25 | b | main.go:14:9:14:41 | slice literal |
 | main.go:14:28:14:30 | err | main.go:14:9:14:41 | slice literal |
 | main.go:14:33:14:34 | b2 | main.go:14:9:14:41 | slice literal |