From 9dbe9adb001d2b41b216578bb2ca29414ff3e2f1 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 2 Jun 2026 09:34:03 +0100 Subject: [PATCH] Update tests --- .../ControlFlowGraph/NoretFunctions.expected | 6 + .../CONSISTENCY/DataFlowConsistency.expected | 12 +- .../CWE-312/CleartextLogging.expected | 212 ++++++++---------- .../query-tests/Security/CWE-312/passwords.go | 6 +- 4 files changed, 108 insertions(+), 128 deletions(-) diff --git a/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/NoretFunctions.expected b/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/NoretFunctions.expected index 9955274a4e0..4e466b74504 100644 --- a/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/NoretFunctions.expected +++ b/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/NoretFunctions.expected @@ -5,6 +5,12 @@ | file://:0:0:0:0 | Fatalf | log.Logger.Fatalf | | file://:0:0:0:0 | Fatalln | log.Fatalln | | file://:0:0:0:0 | Fatalln | log.Logger.Fatalln | +| file://:0:0:0:0 | Panic | log.Logger.Panic | +| file://:0:0:0:0 | Panic | log.Panic | +| file://:0:0:0:0 | Panicf | log.Logger.Panicf | +| file://:0:0:0:0 | Panicf | log.Panicf | +| file://:0:0:0:0 | Panicln | log.Logger.Panicln | +| file://:0:0:0:0 | Panicln | log.Panicln | | file://:0:0:0:0 | panic | panic | | noretfunctions.go:8:6:8:12 | isNoRet | github.com/github/codeql-go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph.isNoRet | | noretfunctions.go:20:6:20:22 | noRetUsesLogFatal | github.com/github/codeql-go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph.noRetUsesLogFatal | diff --git a/go/ql/test/query-tests/Security/CWE-117/CONSISTENCY/DataFlowConsistency.expected b/go/ql/test/query-tests/Security/CWE-117/CONSISTENCY/DataFlowConsistency.expected index 2f4d9e320f8..a683e969167 100644 --- a/go/ql/test/query-tests/Security/CWE-117/CONSISTENCY/DataFlowConsistency.expected +++ b/go/ql/test/query-tests/Security/CWE-117/CONSISTENCY/DataFlowConsistency.expected @@ -3,9 +3,9 @@ reverseRead | LogInjection.go:33:14:33:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | | LogInjection.go:34:18:34:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | | LogInjection.go:35:14:35:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | -| LogInjection.go:447:14:447:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | -| LogInjection.go:455:14:455:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | -| LogInjection.go:463:14:463:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | -| LogInjection.go:498:14:498:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | -| LogInjection.go:499:14:499:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | -| LogInjection.go:724:12:724:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | +| LogInjection.go:551:14:551:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | +| LogInjection.go:559:14:559:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | +| LogInjection.go:567:14:567:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | +| LogInjection.go:602:14:602:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | +| LogInjection.go:603:14:603:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | +| LogInjection.go:828:12:828:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. | diff --git a/go/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected b/go/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected index bc513a693a7..66392b22752 100644 --- a/go/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected +++ b/go/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected @@ -37,22 +37,22 @@ | passwords.go:26:14:26:23 | selection of password | passwords.go:26:14:26:23 | selection of password | passwords.go:26:14:26:23 | selection of password | $@ flows to a logging call. | passwords.go:26:14:26:23 | selection of password | Sensitive data returned by an access to password | | passwords.go:27:14:27:26 | call to getPassword | passwords.go:27:14:27:26 | call to getPassword | passwords.go:27:14:27:26 | call to getPassword | $@ flows to a logging call. | passwords.go:27:14:27:26 | call to getPassword | Sensitive data returned by a call to getPassword | | passwords.go:28:14:28:28 | call to getPassword | passwords.go:28:14:28:28 | call to getPassword | passwords.go:28:14:28:28 | call to getPassword | $@ flows to a logging call. | passwords.go:28:14:28:28 | call to getPassword | Sensitive data returned by a call to getPassword | -| passwords.go:32:12:32:19 | password | passwords.go:21:2:21:9 | definition of password | passwords.go:32:12:32:19 | password | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | -| passwords.go:34:14:34:35 | ...+... | passwords.go:21:2:21:9 | definition of password | passwords.go:34:14:34:35 | ...+... | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | -| passwords.go:39:14:39:17 | obj1 | passwords.go:37:13:37:13 | x | passwords.go:39:14:39:17 | obj1 | $@ flows to a logging call. | passwords.go:37:13:37:13 | x | Sensitive data returned by an access to password | -| passwords.go:44:14:44:17 | obj2 | passwords.go:21:2:21:9 | definition of password | passwords.go:44:14:44:17 | obj2 | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | -| passwords.go:51:14:51:27 | fixed_password | passwords.go:50:2:50:15 | definition of fixed_password | passwords.go:51:14:51:27 | fixed_password | $@ flows to a logging call. | passwords.go:50:2:50:15 | definition of fixed_password | Sensitive data returned by an access to fixed_password | -| passwords.go:89:14:89:26 | utilityObject | passwords.go:87:16:87:36 | call to make | passwords.go:89:14:89:26 | utilityObject | $@ flows to a logging call. | passwords.go:87:16:87:36 | call to make | Sensitive data returned by an access to passwordSet | -| passwords.go:92:23:92:28 | secret | passwords.go:21:2:21:9 | definition of password | passwords.go:92:23:92:28 | secret | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | -| passwords.go:102:15:102:40 | ...+... | passwords.go:21:2:21:9 | definition of password | passwords.go:102:15:102:40 | ...+... | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | -| passwords.go:108:16:108:41 | ...+... | passwords.go:21:2:21:9 | definition of password | passwords.go:108:16:108:41 | ...+... | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | -| passwords.go:113:15:113:40 | ...+... | passwords.go:21:2:21:9 | definition of password | passwords.go:113:15:113:40 | ...+... | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | -| passwords.go:117:14:117:45 | ...+... | passwords.go:116:6:116:14 | definition of password1 | passwords.go:117:14:117:45 | ...+... | $@ flows to a logging call. | passwords.go:116:6:116:14 | definition of password1 | Sensitive data returned by an access to password1 | -| passwords.go:127:14:127:19 | config | passwords.go:21:2:21:9 | definition of password | passwords.go:127:14:127:19 | config | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | -| passwords.go:127:14:127:19 | config | passwords.go:121:13:121:14 | x3 | passwords.go:127:14:127:19 | config | $@ flows to a logging call. | passwords.go:121:13:121:14 | x3 | Sensitive data returned by an access to password | -| passwords.go:127:14:127:19 | config | passwords.go:124:13:124:25 | call to getPassword | passwords.go:127:14:127:19 | config | $@ flows to a logging call. | passwords.go:124:13:124:25 | call to getPassword | Sensitive data returned by a call to getPassword | -| passwords.go:128:14:128:21 | selection of x | passwords.go:21:2:21:9 | definition of password | passwords.go:128:14:128:21 | selection of x | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | -| passwords.go:129:14:129:21 | selection of y | passwords.go:124:13:124:25 | call to getPassword | passwords.go:129:14:129:21 | selection of y | $@ flows to a logging call. | passwords.go:124:13:124:25 | call to getPassword | Sensitive data returned by a call to getPassword | +| passwords.go:33:13:33:20 | password | passwords.go:21:2:21:9 | definition of password | passwords.go:33:13:33:20 | password | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | +| passwords.go:36:14:36:35 | ...+... | passwords.go:21:2:21:9 | definition of password | passwords.go:36:14:36:35 | ...+... | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | +| passwords.go:41:14:41:17 | obj1 | passwords.go:39:13:39:13 | x | passwords.go:41:14:41:17 | obj1 | $@ flows to a logging call. | passwords.go:39:13:39:13 | x | Sensitive data returned by an access to password | +| passwords.go:46:14:46:17 | obj2 | passwords.go:21:2:21:9 | definition of password | passwords.go:46:14:46:17 | obj2 | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | +| passwords.go:53:14:53:27 | fixed_password | passwords.go:52:2:52:15 | definition of fixed_password | passwords.go:53:14:53:27 | fixed_password | $@ flows to a logging call. | passwords.go:52:2:52:15 | definition of fixed_password | Sensitive data returned by an access to fixed_password | +| passwords.go:91:14:91:26 | utilityObject | passwords.go:89:16:89:36 | call to make | passwords.go:91:14:91:26 | utilityObject | $@ flows to a logging call. | passwords.go:89:16:89:36 | call to make | Sensitive data returned by an access to passwordSet | +| passwords.go:94:23:94:28 | secret | passwords.go:21:2:21:9 | definition of password | passwords.go:94:23:94:28 | secret | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | +| passwords.go:104:15:104:40 | ...+... | passwords.go:21:2:21:9 | definition of password | passwords.go:104:15:104:40 | ...+... | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | +| passwords.go:110:16:110:41 | ...+... | passwords.go:21:2:21:9 | definition of password | passwords.go:110:16:110:41 | ...+... | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | +| passwords.go:115:15:115:40 | ...+... | passwords.go:21:2:21:9 | definition of password | passwords.go:115:15:115:40 | ...+... | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | +| passwords.go:119:14:119:45 | ...+... | passwords.go:118:6:118:14 | definition of password1 | passwords.go:119:14:119:45 | ...+... | $@ flows to a logging call. | passwords.go:118:6:118:14 | definition of password1 | Sensitive data returned by an access to password1 | +| passwords.go:129:14:129:19 | config | passwords.go:21:2:21:9 | definition of password | passwords.go:129:14:129:19 | config | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | +| passwords.go:129:14:129:19 | config | passwords.go:123:13:123:14 | x3 | passwords.go:129:14:129:19 | config | $@ flows to a logging call. | passwords.go:123:13:123:14 | x3 | Sensitive data returned by an access to password | +| passwords.go:129:14:129:19 | config | passwords.go:126:13:126:25 | call to getPassword | passwords.go:129:14:129:19 | config | $@ flows to a logging call. | passwords.go:126:13:126:25 | call to getPassword | Sensitive data returned by a call to getPassword | +| passwords.go:130:14:130:21 | selection of x | passwords.go:21:2:21:9 | definition of password | passwords.go:130:14:130:21 | selection of x | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password | +| passwords.go:131:14:131:21 | selection of y | passwords.go:126:13:126:25 | call to getPassword | passwords.go:131:14:131:21 | selection of y | $@ flows to a logging call. | passwords.go:126:13:126:25 | call to getPassword | Sensitive data returned by a call to getPassword | | protobuf.go:14:14:14:35 | call to GetDescription | protobuf.go:9:2:9:9 | definition of password | protobuf.go:14:14:14:35 | call to GetDescription | $@ flows to a logging call. | protobuf.go:9:2:9:9 | definition of password | Sensitive data returned by an access to password | edges | klog.go:21:3:26:3 | range statement[1] | klog.go:22:27:22:33 | headers | provenance | | @@ -86,35 +86,11 @@ edges | main.go:54:12:54:19 | password | main.go:62:12:62:19 | password | provenance | Sink:MaD:7 | | main.go:54:12:54:19 | password | main.go:65:13:65:20 | password | provenance | | | main.go:54:12:54:19 | password | main.go:68:11:68:18 | password | provenance | | -| main.go:54:12:54:19 | password | main.go:68:11:68:18 | password | provenance | | | main.go:54:12:54:19 | password | main.go:71:18:71:25 | password | provenance | | -| main.go:54:12:54:19 | password | main.go:71:18:71:25 | password | provenance | | -| main.go:54:12:54:19 | password | main.go:74:12:74:19 | password | provenance | | | main.go:54:12:54:19 | password | main.go:74:12:74:19 | password | provenance | Sink:MaD:9 | | main.go:54:12:54:19 | password | main.go:77:13:77:20 | password | provenance | | -| main.go:54:12:54:19 | password | main.go:77:13:77:20 | password | provenance | | | main.go:54:12:54:19 | password | main.go:79:14:79:21 | password | provenance | Sink:MaD:8 | | main.go:54:12:54:19 | password | main.go:80:17:80:24 | password | provenance | | -| main.go:68:11:68:18 | password | main.go:71:18:71:25 | password | provenance | | -| main.go:68:11:68:18 | password | main.go:71:18:71:25 | password | provenance | | -| main.go:68:11:68:18 | password | main.go:74:12:74:19 | password | provenance | | -| main.go:68:11:68:18 | password | main.go:74:12:74:19 | password | provenance | Sink:MaD:9 | -| main.go:68:11:68:18 | password | main.go:77:13:77:20 | password | provenance | | -| main.go:68:11:68:18 | password | main.go:77:13:77:20 | password | provenance | | -| main.go:68:11:68:18 | password | main.go:79:14:79:21 | password | provenance | Sink:MaD:8 | -| main.go:68:11:68:18 | password | main.go:80:17:80:24 | password | provenance | | -| main.go:71:18:71:25 | password | main.go:74:12:74:19 | password | provenance | | -| main.go:71:18:71:25 | password | main.go:74:12:74:19 | password | provenance | Sink:MaD:9 | -| main.go:71:18:71:25 | password | main.go:77:13:77:20 | password | provenance | | -| main.go:71:18:71:25 | password | main.go:77:13:77:20 | password | provenance | | -| main.go:71:18:71:25 | password | main.go:79:14:79:21 | password | provenance | Sink:MaD:8 | -| main.go:71:18:71:25 | password | main.go:80:17:80:24 | password | provenance | | -| main.go:74:12:74:19 | password | main.go:77:13:77:20 | password | provenance | | -| main.go:74:12:74:19 | password | main.go:77:13:77:20 | password | provenance | | -| main.go:74:12:74:19 | password | main.go:79:14:79:21 | password | provenance | Sink:MaD:8 | -| main.go:74:12:74:19 | password | main.go:80:17:80:24 | password | provenance | | -| main.go:77:13:77:20 | password | main.go:79:14:79:21 | password | provenance | Sink:MaD:8 | -| main.go:77:13:77:20 | password | main.go:80:17:80:24 | password | provenance | | | main.go:80:17:80:24 | password | main.go:82:12:82:19 | password | provenance | | | main.go:80:17:80:24 | password | main.go:83:17:83:24 | password | provenance | | | main.go:80:17:80:24 | password | main.go:86:19:86:26 | password | provenance | | @@ -126,46 +102,46 @@ edges | passwords.go:8:12:8:12 | definition of x | passwords.go:9:14:9:14 | x | provenance | | | passwords.go:21:2:21:9 | definition of password | passwords.go:25:14:25:21 | password | provenance | | | passwords.go:21:2:21:9 | definition of password | passwords.go:30:8:30:15 | password | provenance | | -| passwords.go:21:2:21:9 | definition of password | passwords.go:32:12:32:19 | password | provenance | | -| passwords.go:21:2:21:9 | definition of password | passwords.go:34:28:34:35 | password | provenance | | +| passwords.go:21:2:21:9 | definition of password | passwords.go:33:13:33:20 | password | provenance | | +| passwords.go:21:2:21:9 | definition of password | passwords.go:36:28:36:35 | password | provenance | | | passwords.go:30:8:30:15 | password | passwords.go:8:12:8:12 | definition of x | provenance | | -| passwords.go:34:28:34:35 | password | passwords.go:34:14:34:35 | ...+... | provenance | Config | -| passwords.go:34:28:34:35 | password | passwords.go:42:6:42:13 | password | provenance | | -| passwords.go:36:10:38:2 | struct literal | passwords.go:39:14:39:17 | obj1 | provenance | | -| passwords.go:37:13:37:13 | x | passwords.go:36:10:38:2 | struct literal | provenance | Config | -| passwords.go:41:10:43:2 | struct literal | passwords.go:44:14:44:17 | obj2 | provenance | | -| passwords.go:42:6:42:13 | password | passwords.go:41:10:43:2 | struct literal | provenance | Config | -| passwords.go:42:6:42:13 | password | passwords.go:48:11:48:18 | password | provenance | | -| passwords.go:48:11:48:18 | password | passwords.go:92:23:92:28 | secret | provenance | | -| passwords.go:48:11:48:18 | password | passwords.go:102:33:102:40 | password | provenance | | -| passwords.go:48:11:48:18 | password | passwords.go:108:34:108:41 | password | provenance | | -| passwords.go:48:11:48:18 | password | passwords.go:113:33:113:40 | password | provenance | | -| passwords.go:48:11:48:18 | password | passwords.go:123:13:123:20 | password | provenance | | -| passwords.go:50:2:50:15 | definition of fixed_password | passwords.go:51:14:51:27 | fixed_password | provenance | | -| passwords.go:86:19:88:2 | struct literal | passwords.go:89:14:89:26 | utilityObject | provenance | | -| passwords.go:87:16:87:36 | call to make | passwords.go:86:19:88:2 | struct literal | provenance | Config | -| passwords.go:102:33:102:40 | password | passwords.go:102:15:102:40 | ...+... | provenance | Config | -| passwords.go:102:33:102:40 | password | passwords.go:108:34:108:41 | password | provenance | | -| passwords.go:102:33:102:40 | password | passwords.go:113:33:113:40 | password | provenance | | -| passwords.go:102:33:102:40 | password | passwords.go:123:13:123:20 | password | provenance | | -| passwords.go:108:34:108:41 | password | passwords.go:108:16:108:41 | ...+... | provenance | Config | -| passwords.go:108:34:108:41 | password | passwords.go:113:33:113:40 | password | provenance | | -| passwords.go:108:34:108:41 | password | passwords.go:123:13:123:20 | password | provenance | | -| passwords.go:113:33:113:40 | password | passwords.go:113:15:113:40 | ...+... | provenance | Config | -| passwords.go:113:33:113:40 | password | passwords.go:123:13:123:20 | password | provenance | | -| passwords.go:116:6:116:14 | definition of password1 | passwords.go:117:28:117:36 | password1 | provenance | | -| passwords.go:117:28:117:36 | password1 | passwords.go:117:28:117:45 | call to String | provenance | Config | -| passwords.go:117:28:117:45 | call to String | passwords.go:117:14:117:45 | ...+... | provenance | Config | -| passwords.go:120:12:125:2 | struct literal | passwords.go:127:14:127:19 | config | provenance | | -| passwords.go:120:12:125:2 | struct literal [x] | passwords.go:128:14:128:19 | config [x] | provenance | | -| passwords.go:120:12:125:2 | struct literal [y] | passwords.go:129:14:129:19 | config [y] | provenance | | -| passwords.go:121:13:121:14 | x3 | passwords.go:120:12:125:2 | struct literal | provenance | Config | -| passwords.go:123:13:123:20 | password | passwords.go:120:12:125:2 | struct literal | provenance | Config | -| passwords.go:123:13:123:20 | password | passwords.go:120:12:125:2 | struct literal [x] | provenance | | -| passwords.go:124:13:124:25 | call to getPassword | passwords.go:120:12:125:2 | struct literal | provenance | Config | -| passwords.go:124:13:124:25 | call to getPassword | passwords.go:120:12:125:2 | struct literal [y] | provenance | | -| passwords.go:128:14:128:19 | config [x] | passwords.go:128:14:128:21 | selection of x | provenance | | -| passwords.go:129:14:129:19 | config [y] | passwords.go:129:14:129:21 | selection of y | provenance | | +| passwords.go:36:28:36:35 | password | passwords.go:36:14:36:35 | ...+... | provenance | Config | +| passwords.go:36:28:36:35 | password | passwords.go:44:6:44:13 | password | provenance | | +| passwords.go:38:10:40:2 | struct literal | passwords.go:41:14:41:17 | obj1 | provenance | | +| passwords.go:39:13:39:13 | x | passwords.go:38:10:40:2 | struct literal | provenance | Config | +| passwords.go:43:10:45:2 | struct literal | passwords.go:46:14:46:17 | obj2 | provenance | | +| passwords.go:44:6:44:13 | password | passwords.go:43:10:45:2 | struct literal | provenance | Config | +| passwords.go:44:6:44:13 | password | passwords.go:50:11:50:18 | password | provenance | | +| passwords.go:50:11:50:18 | password | passwords.go:94:23:94:28 | secret | provenance | | +| passwords.go:50:11:50:18 | password | passwords.go:104:33:104:40 | password | provenance | | +| passwords.go:50:11:50:18 | password | passwords.go:110:34:110:41 | password | provenance | | +| passwords.go:50:11:50:18 | password | passwords.go:115:33:115:40 | password | provenance | | +| passwords.go:50:11:50:18 | password | passwords.go:125:13:125:20 | password | provenance | | +| passwords.go:52:2:52:15 | definition of fixed_password | passwords.go:53:14:53:27 | fixed_password | provenance | | +| passwords.go:88:19:90:2 | struct literal | passwords.go:91:14:91:26 | utilityObject | provenance | | +| passwords.go:89:16:89:36 | call to make | passwords.go:88:19:90:2 | struct literal | provenance | Config | +| passwords.go:104:33:104:40 | password | passwords.go:104:15:104:40 | ...+... | provenance | Config | +| passwords.go:104:33:104:40 | password | passwords.go:110:34:110:41 | password | provenance | | +| passwords.go:104:33:104:40 | password | passwords.go:115:33:115:40 | password | provenance | | +| passwords.go:104:33:104:40 | password | passwords.go:125:13:125:20 | password | provenance | | +| passwords.go:110:34:110:41 | password | passwords.go:110:16:110:41 | ...+... | provenance | Config | +| passwords.go:110:34:110:41 | password | passwords.go:115:33:115:40 | password | provenance | | +| passwords.go:110:34:110:41 | password | passwords.go:125:13:125:20 | password | provenance | | +| passwords.go:115:33:115:40 | password | passwords.go:115:15:115:40 | ...+... | provenance | Config | +| passwords.go:115:33:115:40 | password | passwords.go:125:13:125:20 | password | provenance | | +| passwords.go:118:6:118:14 | definition of password1 | passwords.go:119:28:119:36 | password1 | provenance | | +| passwords.go:119:28:119:36 | password1 | passwords.go:119:28:119:45 | call to String | provenance | Config | +| passwords.go:119:28:119:45 | call to String | passwords.go:119:14:119:45 | ...+... | provenance | Config | +| passwords.go:122:12:127:2 | struct literal | passwords.go:129:14:129:19 | config | provenance | | +| passwords.go:122:12:127:2 | struct literal [x] | passwords.go:130:14:130:19 | config [x] | provenance | | +| passwords.go:122:12:127:2 | struct literal [y] | passwords.go:131:14:131:19 | config [y] | provenance | | +| passwords.go:123:13:123:14 | x3 | passwords.go:122:12:127:2 | struct literal | provenance | Config | +| passwords.go:125:13:125:20 | password | passwords.go:122:12:127:2 | struct literal | provenance | Config | +| passwords.go:125:13:125:20 | password | passwords.go:122:12:127:2 | struct literal [x] | provenance | | +| passwords.go:126:13:126:25 | call to getPassword | passwords.go:122:12:127:2 | struct literal | provenance | Config | +| passwords.go:126:13:126:25 | call to getPassword | passwords.go:122:12:127:2 | struct literal [y] | provenance | | +| passwords.go:130:14:130:19 | config [x] | passwords.go:130:14:130:21 | selection of x | provenance | | +| passwords.go:131:14:131:19 | config [y] | passwords.go:131:14:131:21 | selection of y | provenance | | | protobuf.go:9:2:9:9 | definition of password | protobuf.go:12:22:12:29 | password | provenance | | | protobuf.go:12:2:12:6 | implicit dereference [postupdate] [Description] | protobuf.go:12:2:12:6 | query [postupdate] [pointer, Description] | provenance | | | protobuf.go:12:2:12:6 | query [postupdate] [pointer, Description] | protobuf.go:14:14:14:18 | query [pointer, Description] | provenance | | @@ -222,12 +198,8 @@ nodes | main.go:62:12:62:19 | password | semmle.label | password | | main.go:65:13:65:20 | password | semmle.label | password | | main.go:68:11:68:18 | password | semmle.label | password | -| main.go:68:11:68:18 | password | semmle.label | password | -| main.go:71:18:71:25 | password | semmle.label | password | | main.go:71:18:71:25 | password | semmle.label | password | | main.go:74:12:74:19 | password | semmle.label | password | -| main.go:74:12:74:19 | password | semmle.label | password | -| main.go:77:13:77:20 | password | semmle.label | password | | main.go:77:13:77:20 | password | semmle.label | password | | main.go:79:14:79:21 | password | semmle.label | password | | main.go:80:17:80:24 | password | semmle.label | password | @@ -248,43 +220,43 @@ nodes | passwords.go:27:14:27:26 | call to getPassword | semmle.label | call to getPassword | | passwords.go:28:14:28:28 | call to getPassword | semmle.label | call to getPassword | | passwords.go:30:8:30:15 | password | semmle.label | password | -| passwords.go:32:12:32:19 | password | semmle.label | password | -| passwords.go:34:14:34:35 | ...+... | semmle.label | ...+... | -| passwords.go:34:28:34:35 | password | semmle.label | password | -| passwords.go:36:10:38:2 | struct literal | semmle.label | struct literal | -| passwords.go:37:13:37:13 | x | semmle.label | x | -| passwords.go:39:14:39:17 | obj1 | semmle.label | obj1 | -| passwords.go:41:10:43:2 | struct literal | semmle.label | struct literal | -| passwords.go:42:6:42:13 | password | semmle.label | password | -| passwords.go:44:14:44:17 | obj2 | semmle.label | obj2 | -| passwords.go:48:11:48:18 | password | semmle.label | password | -| passwords.go:50:2:50:15 | definition of fixed_password | semmle.label | definition of fixed_password | -| passwords.go:51:14:51:27 | fixed_password | semmle.label | fixed_password | -| passwords.go:86:19:88:2 | struct literal | semmle.label | struct literal | -| passwords.go:87:16:87:36 | call to make | semmle.label | call to make | -| passwords.go:89:14:89:26 | utilityObject | semmle.label | utilityObject | -| passwords.go:92:23:92:28 | secret | semmle.label | secret | -| passwords.go:102:15:102:40 | ...+... | semmle.label | ...+... | -| passwords.go:102:33:102:40 | password | semmle.label | password | -| passwords.go:108:16:108:41 | ...+... | semmle.label | ...+... | -| passwords.go:108:34:108:41 | password | semmle.label | password | -| passwords.go:113:15:113:40 | ...+... | semmle.label | ...+... | -| passwords.go:113:33:113:40 | password | semmle.label | password | -| passwords.go:116:6:116:14 | definition of password1 | semmle.label | definition of password1 | -| passwords.go:117:14:117:45 | ...+... | semmle.label | ...+... | -| passwords.go:117:28:117:36 | password1 | semmle.label | password1 | -| passwords.go:117:28:117:45 | call to String | semmle.label | call to String | -| passwords.go:120:12:125:2 | struct literal | semmle.label | struct literal | -| passwords.go:120:12:125:2 | struct literal [x] | semmle.label | struct literal [x] | -| passwords.go:120:12:125:2 | struct literal [y] | semmle.label | struct literal [y] | -| passwords.go:121:13:121:14 | x3 | semmle.label | x3 | -| passwords.go:123:13:123:20 | password | semmle.label | password | -| passwords.go:124:13:124:25 | call to getPassword | semmle.label | call to getPassword | -| passwords.go:127:14:127:19 | config | semmle.label | config | -| passwords.go:128:14:128:19 | config [x] | semmle.label | config [x] | -| passwords.go:128:14:128:21 | selection of x | semmle.label | selection of x | -| passwords.go:129:14:129:19 | config [y] | semmle.label | config [y] | -| passwords.go:129:14:129:21 | selection of y | semmle.label | selection of y | +| passwords.go:33:13:33:20 | password | semmle.label | password | +| passwords.go:36:14:36:35 | ...+... | semmle.label | ...+... | +| passwords.go:36:28:36:35 | password | semmle.label | password | +| passwords.go:38:10:40:2 | struct literal | semmle.label | struct literal | +| passwords.go:39:13:39:13 | x | semmle.label | x | +| passwords.go:41:14:41:17 | obj1 | semmle.label | obj1 | +| passwords.go:43:10:45:2 | struct literal | semmle.label | struct literal | +| passwords.go:44:6:44:13 | password | semmle.label | password | +| passwords.go:46:14:46:17 | obj2 | semmle.label | obj2 | +| passwords.go:50:11:50:18 | password | semmle.label | password | +| passwords.go:52:2:52:15 | definition of fixed_password | semmle.label | definition of fixed_password | +| passwords.go:53:14:53:27 | fixed_password | semmle.label | fixed_password | +| passwords.go:88:19:90:2 | struct literal | semmle.label | struct literal | +| passwords.go:89:16:89:36 | call to make | semmle.label | call to make | +| passwords.go:91:14:91:26 | utilityObject | semmle.label | utilityObject | +| passwords.go:94:23:94:28 | secret | semmle.label | secret | +| passwords.go:104:15:104:40 | ...+... | semmle.label | ...+... | +| passwords.go:104:33:104:40 | password | semmle.label | password | +| passwords.go:110:16:110:41 | ...+... | semmle.label | ...+... | +| passwords.go:110:34:110:41 | password | semmle.label | password | +| passwords.go:115:15:115:40 | ...+... | semmle.label | ...+... | +| passwords.go:115:33:115:40 | password | semmle.label | password | +| passwords.go:118:6:118:14 | definition of password1 | semmle.label | definition of password1 | +| passwords.go:119:14:119:45 | ...+... | semmle.label | ...+... | +| passwords.go:119:28:119:36 | password1 | semmle.label | password1 | +| passwords.go:119:28:119:45 | call to String | semmle.label | call to String | +| passwords.go:122:12:127:2 | struct literal | semmle.label | struct literal | +| passwords.go:122:12:127:2 | struct literal [x] | semmle.label | struct literal [x] | +| passwords.go:122:12:127:2 | struct literal [y] | semmle.label | struct literal [y] | +| passwords.go:123:13:123:14 | x3 | semmle.label | x3 | +| passwords.go:125:13:125:20 | password | semmle.label | password | +| passwords.go:126:13:126:25 | call to getPassword | semmle.label | call to getPassword | +| passwords.go:129:14:129:19 | config | semmle.label | config | +| passwords.go:130:14:130:19 | config [x] | semmle.label | config [x] | +| passwords.go:130:14:130:21 | selection of x | semmle.label | selection of x | +| passwords.go:131:14:131:19 | config [y] | semmle.label | config [y] | +| passwords.go:131:14:131:21 | selection of y | semmle.label | selection of y | | protobuf.go:9:2:9:9 | definition of password | semmle.label | definition of password | | protobuf.go:12:2:12:6 | implicit dereference [postupdate] [Description] | semmle.label | implicit dereference [postupdate] [Description] | | protobuf.go:12:2:12:6 | query [postupdate] [pointer, Description] | semmle.label | query [postupdate] [pointer, Description] | diff --git a/go/ql/test/query-tests/Security/CWE-312/passwords.go b/go/ql/test/query-tests/Security/CWE-312/passwords.go index 38c977e41b8..dc569970a39 100644 --- a/go/ql/test/query-tests/Security/CWE-312/passwords.go +++ b/go/ql/test/query-tests/Security/CWE-312/passwords.go @@ -16,7 +16,7 @@ func redact(kind, value string) string { return value } -func test() { +func test(selector int) { name := "user" password := "P@ssw0rd" // $ Source x := "horsebatterystapleincorrect" @@ -29,7 +29,9 @@ func test() { myLog(password) - log.Panic(password) // $ Alert + if selector == 1 { + log.Panic(password) // $ Alert + } log.Println(name + ", " + password) // $ Alert