Fix tests and simplify sanitizer

go/ql/lib/ext/os.model.yml

@@ -28,6 +28,7 @@ extensions:
       - ["os", "", False, "ReadDir", "", "", "Argument[0]", "path-injection", "manual"]
       - ["os", "", False, "ReadFile", "", "", "Argument[0]", "path-injection", "manual"]
       - ["os", "", False, "MkdirTemp", "", "", "Argument[0..1]", "path-injection", "manual"]
+      - ["os", "", False, "CreateTemp", "", "", "Argument[0]", "path-injection", "manual"]
       - ["os", "", False, "WriteFile", "", "", "Argument[0]", "path-injection", "manual"]
       # command-injection
       - ["os", "", False, "StartProcess", "", "", "Argument[0]", "command-injection", "manual"]

go/ql/lib/semmle/go/security/TaintedPathCustomizations.qll

@@ -87,14 +87,7 @@ module TaintedPath {
       exists(DataFlow::CallNode cleanCall, StringOps::Concatenation concatNode |
         cleanCall = any(Function f | f.hasQualifiedName("path/filepath", "Clean")).getACall() and
         concatNode = cleanCall.getArgument(0) and
-        (
-          concatNode.getOperand(0).asExpr().(StringLit).getValue() = "/"
-          or
-          exists(DeclaredConstant dc |
-            dc.hasQualifiedName("os", "PathSeparator") and
-            dc.getAReference() = concatNode.getOperand(0).asExpr().getAChildExpr*()
-          )
-        ) and
+        concatNode.getOperand(0).getStringValue().prefix(1) = ["/", "\\"] and
         this = cleanCall.getResult()
       )
     }

go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Os.go

@@ -178,6 +178,6 @@ func fsAccesses() {
 	os.ReadDir(path)                     // $ fsaccess=path
 	os.ReadFile(path)                    // $ fsaccess=path
 	os.MkdirTemp(path, part)             // $ fsaccess=path fsaccess=part
-	os.CreateTemp(path, part)            // $ fsaccess=path fsaccess=part
+	os.CreateTemp(path, part)            // $ fsaccess=path
 	os.WriteFile(path, []byte{}, 0600)   // $ fsaccess=path
 }

go/ql/test/query-tests/Security/CWE-022/TaintedPath.go

@@ -66,7 +66,7 @@ func handler(w http.ResponseWriter, r *http.Request) {
 
 	// GOOD: Sanitized by filepath.Clean with a prepended os.PathSeparator forcing interpretation
 	// as an absolute path, so that Clean will throw away any leading `..` components.
-	data, _ = ioutil.ReadFile(filepath.Clean(string(os.PathSeparator) + tainted_path))
+	data, _ = ioutil.ReadFile(filepath.Clean(string(os.PathSeparator) + "hardcoded" + tainted_path))
 	w.Write(data)
 
 	// BAD: Sanitized by path.Clean with a prepended '/' forcing interpretation