hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-15 16:23:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' of https://github.com/github/codeql into oscarsj/merge-back-rc-3.20

Browse Source
This commit is contained in:
Óscar San José
2025-12-05 19:31:47 +01:00
parent 5addb53e0f 9a95acadb5
commit bc6133de5c
602 changed files with 25261 additions and 3631 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.bazelversion
View File

@@ -1 +1 @@
8.1.1
8.4.2

5
.github/dependabot.yml vendored
View File

@@ -40,3 +40,8 @@ updates:
- dependency-name: "*"
reviewers:
- "github/codeql-go"
- package-ecosystem: bazel
directory: "/"
schedule:
interval: weekly

10
MODULE.bazel
View File

@@ -274,11 +274,11 @@ ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archi
# go to https://github.com/GoogleChrome/ripunzip/releases to find latest version and corresponding sha256s
ripunzip_archive(
name = "ripunzip",
sha256_linux = "ee0e8a957687a5dc3a66b2a4b25883bf762df4c9c07f0651af527a32a405054b",
sha256_macos_arm = "8a88eea54eac232d162a72a42065e0429b82dbf4f05e9642915dff9d7a81f846",
sha256_macos_intel = "4457a18bfcc5feabe09f5ea3d1157128e07b4873392cb404a870e611924abf64",
sha256_windows = "66d0c1375301bf5ab815348048f43b110631d3fa7200acd50d50a8ed8655ca62",
version = "2.0.3",
sha256_linux = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",
sha256_macos_arm = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",
sha256_macos_intel = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",
sha256_windows = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",
version = "2.0.4",
)
register_toolchains(

4
actions/ql/lib/change-notes/2025-11-28-fix-code-injection-alert-filtering.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: majorAnalysis
---
* The query `actions/code-injection/medium` has been updated to include results which were incorrectly excluded while filtering out results that are reported by `actions/code-injection/critical`.

42
actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll
View File

@@ -19,12 +19,7 @@ class CodeInjectionSink extends DataFlow::Node {
Event getRelevantCriticalEventForSink(DataFlow::Node sink) {
inPrivilegedContext(sink.asExpr(), result) and
not exists(ControlCheck check | check.protects(sink.asExpr(), result, "code-injection")) and
// exclude cases where the sink is a JS script and the expression uses toJson
not exists(UsesStep script |
script.getCallee() = "actions/github-script" and
script.getArgumentExpr("script") = sink.asExpr() and
exists(getAToJsonReferenceExpression(sink.asExpr().(Expression).getExpression(), _))
)
not isGithubScriptUsingToJson(sink.asExpr())
}
/**
@@ -91,3 +86,38 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
/** Tracks flow of unsafe user input that is used to construct and evaluate a code script. */
module CodeInjectionFlow = TaintTracking::Global<CodeInjectionConfig>;
/**
* Holds if there is a code injection flow from `source` to `sink` with
* critical severity, linked by `event`.
*/
predicate criticalSeverityCodeInjection(
CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Event event
) {
CodeInjectionFlow::flowPath(source, sink) and
event = getRelevantCriticalEventForSink(sink.getNode()) and
source.getNode().(RemoteFlowSource).getEventName() = event.getName()
}
/**
* Holds if there is a code injection flow from `source` to `sink` with medium severity.
*/
predicate mediumSeverityCodeInjection(
CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
) {
CodeInjectionFlow::flowPath(source, sink) and
not criticalSeverityCodeInjection(source, sink, _) and
not isGithubScriptUsingToJson(sink.getNode().asExpr())
}
/**
* Holds if `expr` is the `script` input to `actions/github-script` and it uses
* `toJson`.
*/
predicate isGithubScriptUsingToJson(Expression expr) {
exists(UsesStep script |
script.getCallee() = "actions/github-script" and
script.getArgumentExpr("script") = expr and
exists(getAToJsonReferenceExpression(expr.getExpression(), _))
)
}

5
actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
View File

@@ -20,10 +20,7 @@ import CodeInjectionFlow::PathGraph
import codeql.actions.security.ControlChecks
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Event event
where
CodeInjectionFlow::flowPath(source, sink) and
event = getRelevantCriticalEventForSink(sink.getNode()) and
source.getNode().(RemoteFlowSource).getEventName() = event.getName()
where criticalSeverityCodeInjection(source, sink, event)
select sink.getNode(), source, sink,
"Potential code injection in $@, which may be controlled by an external user ($@).", sink,
sink.getNode().asExpr().(Expression).getRawExpression(), event, event.getName()

10
actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql
View File

@@ -19,15 +19,7 @@ import codeql.actions.security.CodeInjectionQuery
import CodeInjectionFlow::PathGraph
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
where
CodeInjectionFlow::flowPath(source, sink) and
inNonPrivilegedContext(sink.getNode().asExpr()) and
// exclude cases where the sink is a JS script and the expression uses toJson
not exists(UsesStep script |
script.getCallee() = "actions/github-script" and
script.getArgumentExpr("script") = sink.getNode().asExpr() and
exists(getAToJsonReferenceExpression(sink.getNode().asExpr().(Expression).getExpression(), _))
)
where mediumSeverityCodeInjection(source, sink)
select sink.getNode(), source, sink,
"Potential code injection in $@, which may be controlled by an external user.", sink,
sink.getNode().asExpr().(Expression).getRawExpression()

2
actions/ql/src/Security/CWE-275/MissingActionsPermissions.md
View File

@@ -2,6 +2,8 @@
If a GitHub Actions job or workflow has no explicit permissions set, then the repository permissions are used. Repositories created under organizations inherit the organization permissions. The organizations or repositories created before February 2023 have the default permissions set to read-write. Often these permissions do not adhere to the principle of least privilege and can be reduced to read-only, leaving the `write` permission only to a specific types as `issues: write` or `pull-requests: write`.
Note that this query cannot check whether the organization or repository token settings are set to read-only. However, even if they are, it is recommended to define explicit permissions (`contents: read` and `packages: read` are equivalent to the read-only default) so that (a) the actual needs of the workflow are documented, and (b) the permissions will remain restricted if the default is subsequently changed, or the workflow is copied to a different repository or organization.
## Recommendation
Add the `permissions` key to the job or the root of workflow (in this case it is applied to all jobs in the workflow that do not have their own `permissions` key) and assign the least privileges required to complete the task.

18
actions/ql/test/query-tests/Security/CWE-094/.github/workflows/push_and_workflow_dispatch.yml vendored Normal file
View File

@@ -0,0 +1,18 @@
on:
push:
workflow_dispatch:
jobs:
echo-chamber:
runs-on: ubuntu-latest
steps:
- run: echo '${{ github.event.commits[11].message }}'
- run: echo '${{ github.event.commits[11].author.email }}'
- run: echo '${{ github.event.commits[11].author.name }}'
- run: echo '${{ github.event.head_commit.message }}'
- run: echo '${{ github.event.head_commit.author.email }}'
- run: echo '${{ github.event.head_commit.author.name }}'
- run: echo '${{ github.event.head_commit.committer.email }}'
- run: echo '${{ github.event.head_commit.committer.name }}'
- run: echo '${{ github.event.commits[11].committer.email }}'
- run: echo '${{ github.event.commits[11].committer.name }}'

10
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected
View File

@@ -435,6 +435,16 @@ nodes
| .github/workflows/push.yml:14:19:14:64 | github.event.head_commit.committer.name | semmle.label | github.event.head_commit.committer.name |
| .github/workflows/push.yml:15:19:15:65 | github.event.commits[11].committer.email | semmle.label | github.event.commits[11].committer.email |
| .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | semmle.label | github.event.commits[11].committer.name |
| .github/workflows/push_and_workflow_dispatch.yml:9:19:9:57 | github.event.commits[11].message | semmle.label | github.event.commits[11].message |
| .github/workflows/push_and_workflow_dispatch.yml:10:19:10:62 | github.event.commits[11].author.email | semmle.label | github.event.commits[11].author.email |
| .github/workflows/push_and_workflow_dispatch.yml:11:19:11:61 | github.event.commits[11].author.name | semmle.label | github.event.commits[11].author.name |
| .github/workflows/push_and_workflow_dispatch.yml:12:19:12:57 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
| .github/workflows/push_and_workflow_dispatch.yml:13:19:13:62 | github.event.head_commit.author.email | semmle.label | github.event.head_commit.author.email |
| .github/workflows/push_and_workflow_dispatch.yml:14:19:14:61 | github.event.head_commit.author.name | semmle.label | github.event.head_commit.author.name |
| .github/workflows/push_and_workflow_dispatch.yml:15:19:15:65 | github.event.head_commit.committer.email | semmle.label | github.event.head_commit.committer.email |
| .github/workflows/push_and_workflow_dispatch.yml:16:19:16:64 | github.event.head_commit.committer.name | semmle.label | github.event.head_commit.committer.name |
| .github/workflows/push_and_workflow_dispatch.yml:17:19:17:65 | github.event.commits[11].committer.email | semmle.label | github.event.commits[11].committer.email |
| .github/workflows/push_and_workflow_dispatch.yml:18:19:18:64 | github.event.commits[11].committer.name | semmle.label | github.event.commits[11].committer.name |
| .github/workflows/reusable-workflow-1.yml:6:7:6:11 | input taint | semmle.label | input taint |
| .github/workflows/reusable-workflow-1.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint |
| .github/workflows/reusable-workflow-1.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |

24
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected
View File

@@ -435,6 +435,16 @@ nodes
| .github/workflows/push.yml:14:19:14:64 | github.event.head_commit.committer.name | semmle.label | github.event.head_commit.committer.name |
| .github/workflows/push.yml:15:19:15:65 | github.event.commits[11].committer.email | semmle.label | github.event.commits[11].committer.email |
| .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | semmle.label | github.event.commits[11].committer.name |
| .github/workflows/push_and_workflow_dispatch.yml:9:19:9:57 | github.event.commits[11].message | semmle.label | github.event.commits[11].message |
| .github/workflows/push_and_workflow_dispatch.yml:10:19:10:62 | github.event.commits[11].author.email | semmle.label | github.event.commits[11].author.email |
| .github/workflows/push_and_workflow_dispatch.yml:11:19:11:61 | github.event.commits[11].author.name | semmle.label | github.event.commits[11].author.name |
| .github/workflows/push_and_workflow_dispatch.yml:12:19:12:57 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
| .github/workflows/push_and_workflow_dispatch.yml:13:19:13:62 | github.event.head_commit.author.email | semmle.label | github.event.head_commit.author.email |
| .github/workflows/push_and_workflow_dispatch.yml:14:19:14:61 | github.event.head_commit.author.name | semmle.label | github.event.head_commit.author.name |
| .github/workflows/push_and_workflow_dispatch.yml:15:19:15:65 | github.event.head_commit.committer.email | semmle.label | github.event.head_commit.committer.email |
| .github/workflows/push_and_workflow_dispatch.yml:16:19:16:64 | github.event.head_commit.committer.name | semmle.label | github.event.head_commit.committer.name |
| .github/workflows/push_and_workflow_dispatch.yml:17:19:17:65 | github.event.commits[11].committer.email | semmle.label | github.event.commits[11].committer.email |
| .github/workflows/push_and_workflow_dispatch.yml:18:19:18:64 | github.event.commits[11].committer.name | semmle.label | github.event.commits[11].committer.name |
| .github/workflows/reusable-workflow-1.yml:6:7:6:11 | input taint | semmle.label | input taint |
| .github/workflows/reusable-workflow-1.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint |
| .github/workflows/reusable-workflow-1.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
@@ -719,6 +729,16 @@ subpaths
| .github/workflows/push.yml:14:19:14:64 | github.event.head_commit.committer.name | .github/workflows/push.yml:14:19:14:64 | github.event.head_commit.committer.name | .github/workflows/push.yml:14:19:14:64 | github.event.head_commit.committer.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:14:19:14:64 | github.event.head_commit.committer.name | ${{ github.event.head_commit.committer.name }} |
| .github/workflows/push.yml:15:19:15:65 | github.event.commits[11].committer.email | .github/workflows/push.yml:15:19:15:65 | github.event.commits[11].committer.email | .github/workflows/push.yml:15:19:15:65 | github.event.commits[11].committer.email | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:15:19:15:65 | github.event.commits[11].committer.email | ${{ github.event.commits[11].committer.email }} |
| .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | ${{ github.event.commits[11].committer.name }} |
| .github/workflows/push_and_workflow_dispatch.yml:9:19:9:57 | github.event.commits[11].message | .github/workflows/push_and_workflow_dispatch.yml:9:19:9:57 | github.event.commits[11].message | .github/workflows/push_and_workflow_dispatch.yml:9:19:9:57 | github.event.commits[11].message | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:9:19:9:57 | github.event.commits[11].message | ${{ github.event.commits[11].message }} |
| .github/workflows/push_and_workflow_dispatch.yml:10:19:10:62 | github.event.commits[11].author.email | .github/workflows/push_and_workflow_dispatch.yml:10:19:10:62 | github.event.commits[11].author.email | .github/workflows/push_and_workflow_dispatch.yml:10:19:10:62 | github.event.commits[11].author.email | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:10:19:10:62 | github.event.commits[11].author.email | ${{ github.event.commits[11].author.email }} |
| .github/workflows/push_and_workflow_dispatch.yml:11:19:11:61 | github.event.commits[11].author.name | .github/workflows/push_and_workflow_dispatch.yml:11:19:11:61 | github.event.commits[11].author.name | .github/workflows/push_and_workflow_dispatch.yml:11:19:11:61 | github.event.commits[11].author.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:11:19:11:61 | github.event.commits[11].author.name | ${{ github.event.commits[11].author.name }} |
| .github/workflows/push_and_workflow_dispatch.yml:12:19:12:57 | github.event.head_commit.message | .github/workflows/push_and_workflow_dispatch.yml:12:19:12:57 | github.event.head_commit.message | .github/workflows/push_and_workflow_dispatch.yml:12:19:12:57 | github.event.head_commit.message | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:12:19:12:57 | github.event.head_commit.message | ${{ github.event.head_commit.message }} |
| .github/workflows/push_and_workflow_dispatch.yml:13:19:13:62 | github.event.head_commit.author.email | .github/workflows/push_and_workflow_dispatch.yml:13:19:13:62 | github.event.head_commit.author.email | .github/workflows/push_and_workflow_dispatch.yml:13:19:13:62 | github.event.head_commit.author.email | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:13:19:13:62 | github.event.head_commit.author.email | ${{ github.event.head_commit.author.email }} |
| .github/workflows/push_and_workflow_dispatch.yml:14:19:14:61 | github.event.head_commit.author.name | .github/workflows/push_and_workflow_dispatch.yml:14:19:14:61 | github.event.head_commit.author.name | .github/workflows/push_and_workflow_dispatch.yml:14:19:14:61 | github.event.head_commit.author.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:14:19:14:61 | github.event.head_commit.author.name | ${{ github.event.head_commit.author.name }} |
| .github/workflows/push_and_workflow_dispatch.yml:15:19:15:65 | github.event.head_commit.committer.email | .github/workflows/push_and_workflow_dispatch.yml:15:19:15:65 | github.event.head_commit.committer.email | .github/workflows/push_and_workflow_dispatch.yml:15:19:15:65 | github.event.head_commit.committer.email | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:15:19:15:65 | github.event.head_commit.committer.email | ${{ github.event.head_commit.committer.email }} |
| .github/workflows/push_and_workflow_dispatch.yml:16:19:16:64 | github.event.head_commit.committer.name | .github/workflows/push_and_workflow_dispatch.yml:16:19:16:64 | github.event.head_commit.committer.name | .github/workflows/push_and_workflow_dispatch.yml:16:19:16:64 | github.event.head_commit.committer.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:16:19:16:64 | github.event.head_commit.committer.name | ${{ github.event.head_commit.committer.name }} |
| .github/workflows/push_and_workflow_dispatch.yml:17:19:17:65 | github.event.commits[11].committer.email | .github/workflows/push_and_workflow_dispatch.yml:17:19:17:65 | github.event.commits[11].committer.email | .github/workflows/push_and_workflow_dispatch.yml:17:19:17:65 | github.event.commits[11].committer.email | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:17:19:17:65 | github.event.commits[11].committer.email | ${{ github.event.commits[11].committer.email }} |
| .github/workflows/push_and_workflow_dispatch.yml:18:19:18:64 | github.event.commits[11].committer.name | .github/workflows/push_and_workflow_dispatch.yml:18:19:18:64 | github.event.commits[11].committer.name | .github/workflows/push_and_workflow_dispatch.yml:18:19:18:64 | github.event.commits[11].committer.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push_and_workflow_dispatch.yml:18:19:18:64 | github.event.commits[11].committer.name | ${{ github.event.commits[11].committer.name }} |
| .github/workflows/reusable-workflow-1.yml:36:21:36:39 | inputs.taint | .github/workflows/reusable-workflow-caller-1.yml:11:15:11:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-1.yml:36:21:36:39 | inputs.taint | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/reusable-workflow-1.yml:36:21:36:39 | inputs.taint | ${{ inputs.taint }} |
| .github/workflows/reusable-workflow-1.yml:53:26:53:39 | env.log | .github/workflows/reusable-workflow-1.yml:44:19:44:56 | github.event.pull_request.title | .github/workflows/reusable-workflow-1.yml:53:26:53:39 | env.log | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/reusable-workflow-1.yml:53:26:53:39 | env.log | ${{ env.log }} |
| .github/workflows/reusable-workflow-1.yml:66:34:66:52 | env.prev_log | .github/workflows/reusable-workflow-1.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/reusable-workflow-1.yml:66:34:66:52 | env.prev_log | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/reusable-workflow-1.yml:66:34:66:52 | env.prev_log | ${{ env.prev_log }} |
@@ -729,6 +749,10 @@ subpaths
| .github/workflows/test10.yml:333:34:333:77 | github.event.workflow_run.head_branch | .github/workflows/test10.yml:333:34:333:77 | github.event.workflow_run.head_branch | .github/workflows/test10.yml:333:34:333:77 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test10.yml:333:34:333:77 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |
| .github/workflows/test10.yml:423:34:423:77 | github.event.workflow_run.head_branch | .github/workflows/test10.yml:423:34:423:77 | github.event.workflow_run.head_branch | .github/workflows/test10.yml:423:34:423:77 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test10.yml:423:34:423:77 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |
| .github/workflows/test10.yml:518:34:518:77 | github.event.workflow_run.head_branch | .github/workflows/test10.yml:518:34:518:77 | github.event.workflow_run.head_branch | .github/workflows/test10.yml:518:34:518:77 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test10.yml:518:34:518:77 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |
| .github/workflows/test20.yml:15:54:15:94 | github.event.pull_request.head.ref | .github/workflows/test20.yml:15:54:15:94 | github.event.pull_request.head.ref | .github/workflows/test20.yml:15:54:15:94 | github.event.pull_request.head.ref | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test20.yml:15:54:15:94 | github.event.pull_request.head.ref | ${{ github.event.pull_request.head.ref }} |
| .github/workflows/test21.yml:22:35:22:73 | github.event.head_commit.message | .github/workflows/test21.yml:22:35:22:73 | github.event.head_commit.message | .github/workflows/test21.yml:22:35:22:73 | github.event.head_commit.message | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test21.yml:22:35:22:73 | github.event.head_commit.message | ${{ github.event.head_commit.message }} |
| .github/workflows/test21.yml:23:36:23:74 | github.event.head_commit.message | .github/workflows/test21.yml:23:36:23:74 | github.event.head_commit.message | .github/workflows/test21.yml:23:36:23:74 | github.event.head_commit.message | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test21.yml:23:36:23:74 | github.event.head_commit.message | ${{ github.event.head_commit.message }} |
| .github/workflows/test21.yml:24:50:24:88 | github.event.head_commit.message | .github/workflows/test21.yml:24:50:24:88 | github.event.head_commit.message | .github/workflows/test21.yml:24:50:24:88 | github.event.head_commit.message | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test21.yml:24:50:24:88 | github.event.head_commit.message | ${{ github.event.head_commit.message }} |
| .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |
| .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |
| .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |

2
cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll
View File

@@ -10,7 +10,7 @@ import ExternalAPIsSpecific
/** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) }
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) }

2
cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll
View File

@@ -10,7 +10,7 @@ import ExternalAPIsSpecific
/** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) }
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) }

4
cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql
View File

@@ -263,7 +263,7 @@ module FromSensitiveFlow = TaintTracking::Global<FromSensitiveConfig>;
* A taint flow configuration for flow from a sensitive expression to an encryption operation.
*/
module ToEncryptionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { FromSensitiveFlow::flow(source, _) }
predicate isSource(DataFlow::Node source) { FromSensitiveFlow::flowFrom(source) }
predicate isSink(DataFlow::Node sink) { isSinkEncrypt(sink, _) }
@@ -311,7 +311,7 @@ where
FromSensitiveFlow::flowPath(source, sink) and
isSinkSendRecv(sink.getNode(), networkSendRecv) and
// no flow from sensitive -> evidence of encryption
not ToEncryptionFlow::flow(source.getNode(), _) and
not ToEncryptionFlow::flowFrom(source.getNode()) and
not FromEncryptionFlow::flowTo(sink.getNode()) and
// construct result
if networkSendRecv instanceof NetworkSend

2
cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
View File

@@ -129,7 +129,7 @@ module PointerArithmeticToDerefFlow = DataFlow::Global<PointerArithmeticToDerefC
predicate pointerArithOverflow(PointerArithmeticInstruction pai, int delta) {
pointerArithOverflow0(pai, delta) and
PointerArithmeticToDerefFlow::flow(DataFlow::instructionNode(pai), _)
PointerArithmeticToDerefFlow::flowFrom(DataFlow::instructionNode(pai))
}
bindingset[v]

10
csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
View File

@@ -48,7 +48,7 @@ namespace Semmle.Autobuild.CSharp
{
// When a custom .NET CLI has been installed, `dotnet --info` has already been executed
// to verify the installation.
var ret = dotNetPath is null ? GetInfoCommand(builder.Actions, dotNetPath, environment) : BuildScript.Success;
var ret = dotNetPath is null ? DotNet.InfoScript(builder.Actions, DotNetCommand(builder.Actions, dotNetPath), environment, builder.Logger) : BuildScript.Success;
foreach (var projectOrSolution in builder.ProjectsOrSolutionsToBuild)
{
var cleanCommand = GetCleanCommand(builder.Actions, dotNetPath, environment);
@@ -111,14 +111,6 @@ namespace Semmle.Autobuild.CSharp
private static string DotNetCommand(IBuildActions actions, string? dotNetPath) =>
dotNetPath is not null ? actions.PathCombine(dotNetPath, "dotnet") : "dotnet";
private static BuildScript GetInfoCommand(IBuildActions actions, string? dotNetPath, IDictionary<string, string>? environment)
{
var info = new CommandBuilder(actions, null, environment).
RunCommand(DotNetCommand(actions, dotNetPath)).
Argument("--info");
return info.Script;
}
private static CommandBuilder GetCleanCommand(IBuildActions actions, string? dotNetPath, IDictionary<string, string>? environment)
{
var clean = new CommandBuilder(actions, null, environment).

57
csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
View File

@@ -3,6 +3,7 @@ using System.Collections.Generic;
using System.Collections.ObjectModel;
using System.IO;
using System.Linq;
using System.Threading;
using Newtonsoft.Json.Linq;
using Semmle.Util;
@@ -36,12 +37,29 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
public static IDotNet Make(ILogger logger, string? dotNetPath, TemporaryDirectory tempWorkingDirectory, DependabotProxy? dependabotProxy) => new DotNet(logger, dotNetPath, tempWorkingDirectory, dependabotProxy);
private static void HandleRetryExitCode143(string dotnet, int attempt, ILogger logger)
{
logger.LogWarning($"Running '{dotnet} --info' failed with exit code 143. Retrying...");
var sleep = Math.Pow(2, attempt) * 1000;
Thread.Sleep((int)sleep);
}
private void Info()
{
var res = dotnetCliInvoker.RunCommand("--info", silent: false);
if (!res)
// Allow up to four attempts (with up to three retries) to run `dotnet --info`, to mitigate transient issues
for (int attempt = 0; attempt < 4; attempt++)
{
throw new Exception($"{dotnetCliInvoker.Exec} --info failed.");
var exitCode = dotnetCliInvoker.RunCommandExitCode("--info", silent: false);
switch (exitCode)
{
case 0:
return;
case 143 when attempt < 3:
HandleRetryExitCode143(dotnetCliInvoker.Exec, attempt, logger);
continue;
default:
throw new Exception($"{dotnetCliInvoker.Exec} --info failed with exit code {exitCode}.");
}
}
}
@@ -193,6 +211,35 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
return BuildScript.Failure;
}
/// <summary>
/// Returns a script for running `dotnet --info`, with retries on exit code 143.
/// </summary>
public static BuildScript InfoScript(IBuildActions actions, string dotnet, IDictionary<string, string>? environment, ILogger logger)
{
var info = new CommandBuilder(actions, null, environment).
RunCommand(dotnet).
Argument("--info");
var script = info.Script;
for (var attempt = 0; attempt < 4; attempt++)
{
var attemptCopy = attempt; // Capture in local variable
script = BuildScript.Bind(script, ret =>
{
switch (ret)
{
case 0:
return BuildScript.Success;
case 143 when attemptCopy < 3:
HandleRetryExitCode143(dotnet, attemptCopy, logger);
return info.Script;
default:
return BuildScript.Failure;
}
});
}
return script;
}
/// <summary>
/// Returns a script for downloading specific .NET SDK versions, if the
/// versions are not already installed.
@@ -292,9 +339,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
};
}
var dotnetInfo = new CommandBuilder(actions, environment: MinimalEnvironment).
RunCommand(actions.PathCombine(path, "dotnet")).
Argument("--info").Script;
var dotnetInfo = InfoScript(actions, actions.PathCombine(path, "dotnet"), MinimalEnvironment.ToDictionary(), logger);
Func<string, BuildScript> getInstallAndVerify = version =>
// run `dotnet --info` after install, to check that it executes successfully

13
csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNetCliInvoker.cs
View File

@@ -57,15 +57,21 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
return startInfo;
}
private bool RunCommandAux(string args, string? workingDirectory, out IList<string> output, bool silent)
private int RunCommandExitCodeAux(string args, string? workingDirectory, out IList<string> output, out string dirLog, bool silent)
{
var dirLog = string.IsNullOrWhiteSpace(workingDirectory) ? "" : $" in {workingDirectory}";
dirLog = string.IsNullOrWhiteSpace(workingDirectory) ? "" : $" in {workingDirectory}";
var pi = MakeDotnetStartInfo(args, workingDirectory);
var threadId = Environment.CurrentManagedThreadId;
void onOut(string s) => logger.Log(silent ? Severity.Debug : Severity.Info, s, threadId);
void onError(string s) => logger.LogError(s, threadId);
logger.LogInfo($"Running '{Exec} {args}'{dirLog}");
var exitCode = pi.ReadOutput(out output, onOut, onError);
return exitCode;
}
private bool RunCommandAux(string args, string? workingDirectory, out IList<string> output, bool silent)
{
var exitCode = RunCommandExitCodeAux(args, workingDirectory, out output, out var dirLog, silent);
if (exitCode != 0)
{
logger.LogError($"Command '{Exec} {args}'{dirLog} failed with exit code {exitCode}");
@@ -77,6 +83,9 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
public bool RunCommand(string args, bool silent = true) =>
RunCommandAux(args, null, out _, silent);
public int RunCommandExitCode(string args, bool silent = true) =>
RunCommandExitCodeAux(args, null, out _, out _, silent);
public bool RunCommand(string args, out IList<string> output, bool silent = true) =>
RunCommandAux(args, null, out output, silent);

6
csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNetCliInvoker.cs
View File

@@ -30,6 +30,12 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
/// </summary>
bool RunCommand(string args, bool silent = true);
/// <summary>
/// Execute `dotnet <paramref name="args"/>` and return the exit code.
/// If `silent` is true the output of the command is logged as `debug` otherwise as `info`.
/// </summary>
int RunCommandExitCode(string args, bool silent = true);
/// <summary>
/// Execute `dotnet <paramref name="args"/>` and return true if the command succeeded, otherwise false.
/// The output of the command is returned in `output`.

11
csharp/extractor/Semmle.Extraction.Tests/DotNet.cs
View File

@@ -12,6 +12,7 @@ namespace Semmle.Extraction.Tests
private string lastArgs = "";
public string WorkingDirectory { get; private set; } = "";
public bool Success { get; set; } = true;
public int ExitCode { get; set; } = 0;
public DotNetCliInvokerStub(IList<string> output)
{
@@ -26,6 +27,12 @@ namespace Semmle.Extraction.Tests
return Success;
}
public int RunCommandExitCode(string args, bool silent)
{
lastArgs = args;
return ExitCode;
}
public bool RunCommand(string args, out IList<string> output, bool silent)
{
lastArgs = args;
@@ -83,7 +90,7 @@ namespace Semmle.Extraction.Tests
public void TestDotnetInfoFailure()
{
// Setup
var dotnetCliInvoker = new DotNetCliInvokerStub(new List<string>()) { Success = false };
var dotnetCliInvoker = new DotNetCliInvokerStub(new List<string>()) { ExitCode = 1 };
// Execute
try
@@ -94,7 +101,7 @@ namespace Semmle.Extraction.Tests
// Verify
catch (Exception e)
{
Assert.Equal("dotnet --info failed.", e.Message);
Assert.Equal("dotnet --info failed with exit code 1.", e.Message);
return;
}
Assert.Fail("Expected exception");

2
csharp/ql/integration-tests/all-platforms/dotnet_10/test.py
View File

@@ -1,9 +1,7 @@
import pytest
@pytest.mark.skip(reason=".NET 10 info command crashes")
def test1(codeql, csharp):
codeql.database.create()
@pytest.mark.skip(reason=".NET 10 info command crashes")
def test2(codeql, csharp):
codeql.database.create(build_mode="none")

4
csharp/ql/lib/change-notes/2025-12-03-run-tracer-after-compilation.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: fix
---
* Fixed an issue where compiler-generated files were not being extracted. The extractor now runs after compilation completes to ensure all generated files are properly analyzed.

2
csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll
View File

@@ -52,7 +52,7 @@ class IDbCommandConstructionSqlExpr extends SqlExpr, ObjectCreation {
class DapperCommandDefinitionMethodCallSqlExpr extends SqlExpr, ObjectCreation {
DapperCommandDefinitionMethodCallSqlExpr() {
this.getObjectType() instanceof Dapper::CommandDefinitionStruct and
DapperCommandDefinitionMethodCallSql::flow(DataFlow::exprNode(this), _)
DapperCommandDefinitionMethodCallSql::flowFromExpr(this)
}
override Expr getSql() { result = this.getArgumentForName("commandText") }

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll
View File

@@ -85,7 +85,7 @@ module RemoteSourceToExternalApi = TaintTracking::Global<RemoteSourceToExternalA
/** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { RemoteSourceToExternalApi::flow(_, this) }
UntrustedExternalApiDataNode() { RemoteSourceToExternalApi::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { RemoteSourceToExternalApi::flow(result, this) }

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll
View File

@@ -91,7 +91,7 @@ class ExponentialRegexSink extends DataFlow::ExprNode, Sink {
ExponentialRegexSink() {
exists(RegexOperation regexOperation |
// Exponential regex flows to the pattern argument
ExponentialRegexDataFlow::flow(_, DataFlow::exprNode(regexOperation.getPattern()))
ExponentialRegexDataFlow::flowToExpr(regexOperation.getPattern())
|
// This is used as an input for this pattern
this.getExpr() = regexOperation.getInput() and

2
csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql
View File

@@ -53,7 +53,7 @@ where
// JsonConvert static method call, but with additional unsafe typename tracking
exists(DataFlow::Node settingsCallArg |
JsonConvertTracking::flowPath(userInput.asPathNode3(), deserializeCallArg.asPathNode3()) and
TypeNameTracking::flow(_, settingsCallArg) and
TypeNameTracking::flowTo(settingsCallArg) and
sameParent(deserializeCallArg.getNode(), settingsCallArg)
)
select deserializeCallArg, userInput, deserializeCallArg, "$@ flows to unsafe deserializer.",

5
csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql
View File

@@ -46,10 +46,7 @@ predicate insecureCookieOptionsCreation(ObjectCreation oc) {
// `Secure` property in `CookieOptions` passed to IResponseCookies.Append(...) wasn't set
oc.getType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
secureFalseOrNotSet(oc) and
exists(DataFlow::Node creation |
CookieOptionsTracking::flow(creation, _) and
creation.asExpr() = oc
)
CookieOptionsTracking::flowFromExpr(oc)
}
predicate insecureCookieAppend(Expr sink) {

2
csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
View File

@@ -260,6 +260,8 @@ module SummaryModelGeneratorInput implements SummaryModelGeneratorInputSig {
)
}
int contentAccessPathLimitInternal() { result = 2 }
bindingset[d]
private string getFullyQualifiedName(Declaration d) {
exists(string qualifier, string name |

4
csharp/tools/tracing-config.lua
View File

@@ -183,7 +183,7 @@ function RegisterExtractorPack(id)
MsBuildMatcher,
CreatePatternMatcher({ '^csc.*%.exe$' }, MatchCompilerName, extractor, {
prepend = { '--compiler', '"${compiler}"' },
order = ORDER_BEFORE
order = ORDER_AFTER
}),
CreatePatternMatcher({ '^fakes.*%.exe$', 'moles.*%.exe' },
MatchCompilerName, nil, { trace = false }),
@@ -224,7 +224,7 @@ function RegisterExtractorPack(id)
CreatePatternMatcher({ '^mcs%.exe$', '^csc%.exe$', '^csc$' }, MatchCompilerName,
extractor, {
prepend = { '--compiler', '${compiler}' },
order = ORDER_BEFORE
order = ORDER_AFTER
}),
MsBuildMatcher,
function(compilerName, compilerPath, compilerArguments, _languageId)

4
go/Makefile
View File

@@ -54,9 +54,9 @@ ql/lib/go.dbscheme.stats: ql/lib/go.dbscheme build/stats/src.stamp extractor
codeql dataset measure -o $@ build/stats/database/db-go
test: all build/testdb/check-upgrade-path
codeql test run -j0 ql/test --search-path .. --check-diff-informed --consistency-queries ql/test/consistency --compilation-cache=$(cache) --dynamic-join-order-mode=$(rtjo) --check-databases --fail-on-trap-errors --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition
codeql test run -j0 ql/test --search-path .. --check-diff-informed --consistency-queries ql/consistency-queries --compilation-cache=$(cache) --dynamic-join-order-mode=$(rtjo) --check-databases --fail-on-trap-errors --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition
# use GOOS=linux because GOOS=darwin GOARCH=386 is no longer supported
env GOOS=linux GOARCH=386 codeql$(EXE) test run -j0 ql/test/query-tests/Security/CWE-681 --search-path .. --check-diff-informed --consistency-queries ql/test/consistency --compilation-cache=$(cache) --dynamic-join-order-mode=$(rtjo)
env GOOS=linux GOARCH=386 codeql$(EXE) test run -j0 ql/test/query-tests/Security/CWE-681 --search-path .. --check-diff-informed --consistency-queries ql/consistency-queries --compilation-cache=$(cache) --dynamic-join-order-mode=$(rtjo)
cd extractor; $(BAZEL) test ...
bash extractor-smoke-test/test.sh || (echo "Extractor smoke test FAILED"; exit 1)

0
go/ql/test/consistency/UnexpectedFrontendErrors.ql → go/ql/consistency-queries/UnexpectedFrontendErrors.ql
View File

4
go/ql/lib/change-notes/2025-11-26-unexpected-frontend-errors-query-moved.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: breaking
---
* The query `go/unexpected-frontend-error` has been moved from the `codeql/go-queries` query to the `codeql-go-consistency-queries` query pack.

17
go/ql/lib/semmle/go/dataflow/internal/DataFlowImplConsistency.qll
View File

@@ -5,10 +5,25 @@
private import go
private import DataFlowImplSpecific as Impl
private import DataFlowUtil
private import TaintTrackingImplSpecific
private import codeql.dataflow.internal.DataFlowImplConsistency
private import semmle.go.dataflow.internal.DataFlowNodes
private module Input implements InputSig<Location, Impl::GoDataFlow> { }
private module Input implements InputSig<Location, Impl::GoDataFlow> {
predicate missingLocationExclude(DataFlow::Node n) {
n instanceof DataFlow::GlobalFunctionNode or n instanceof Private::FlowSummaryNode
}
predicate uniqueNodeLocationExclude(DataFlow::Node n) { missingLocationExclude(n) }
predicate localFlowIsLocalExclude(DataFlow::Node n1, DataFlow::Node n2) {
n1 instanceof DataFlow::FunctionNode and simpleLocalFlowStep(n1, n2, _)
}
predicate argHasPostUpdateExclude(DataFlow::ArgumentNode n) {
not DataFlow::insnHasPostUpdateNode(n.asInstruction())
}
}
module Consistency = MakeConsistency<Location, Impl::GoDataFlow, GoTaintTracking, Input>;

2
go/ql/lib/semmle/go/security/AllocationSizeOverflow.qll
View File

@@ -27,7 +27,7 @@ module AllocationSizeOverflow {
private module FindLargeLensFlow = TaintTracking::Global<FindLargeLensConfig>;
private DataFlow::CallNode getALargeLenCall() {
exists(DataFlow::Node lenArg | FindLargeLensFlow::flow(_, lenArg) |
exists(DataFlow::Node lenArg | FindLargeLensFlow::flowTo(lenArg) |
result.getArgument(0) = lenArg
)
}

2
go/ql/lib/semmle/go/security/ExternalAPIs.qll
View File

@@ -211,7 +211,7 @@ module UntrustedDataToUnknownExternalApiFlow =
/** A node representing untrusted data being passed to an external API. */
class UntrustedExternalApiDataNode extends ExternalApiDataNode {
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) }
UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flowTo(this) }
/** Gets a source of untrusted data which is passed to this external API data node. */
DataFlow::Node getAnUntrustedSource() { UntrustedDataToExternalApiFlow::flow(result, this) }

2
go/ql/lib/semmle/go/security/MissingJwtSignatureCheck.qll
View File

@@ -15,7 +15,7 @@ module MissingJwtSignatureCheck {
module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof Source and
not SafeParse::flow(source, _)
not SafeParse::flowFrom(source)
}
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

2
go/ql/lib/semmle/go/security/UnsafeUnzipSymlink.qll
View File

@@ -32,7 +32,7 @@ module UnsafeUnzipSymlink {
* Holds if `node` is an archive header field read that flows to a `path/filepath.EvalSymlinks` call.
*/
private predicate symlinksEvald(DataFlow::Node node) {
EvalSymlinksFlow::flow(getASimilarReadNode(node), _)
EvalSymlinksFlow::flowFrom(getASimilarReadNode(node))
}
private module Config implements DataFlow::ConfigSig {

2
go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql
View File

@@ -81,5 +81,5 @@ module Config implements DataFlow::ConfigSig {
module Flow = DataFlow::Global<Config>;
from DataFlow::Node source, string msg
where Flow::flow(source, _) and Config::isSourceString(source, msg)
where Flow::flowFrom(source) and Config::isSourceString(source, msg)
select source, msg

2
go/ql/src/Security/CWE-352/ConstantOauth2State.ql
View File

@@ -154,7 +154,7 @@ module FlowToPrintFlow = DataFlow::Global<FlowToPrintConfig>;
/** Holds if the provided `CallNode`'s result flows to an argument of a printer call. */
predicate resultFlowsToPrinter(DataFlow::CallNode authCodeUrlCall) {
FlowToPrintFlow::flow(authCodeUrlCall.getResult(), _)
FlowToPrintFlow::flowFrom(authCodeUrlCall.getResult())
}
/** Get a data-flow node that reads the value of `os.Stdin`. */

2
go/ql/src/Security/CWE-601/OpenUrlRedirect.ql
View File

@@ -21,6 +21,6 @@ where
OpenUrlRedirect::Flow::flowPath(source, sink) and
// this excludes flow from safe parts of request URLs, for example the full URL when the
// doing a redirect from `http://<path>` to `https://<path>`
not SafeUrlFlow::Flow::flow(_, sink.getNode())
not SafeUrlFlow::Flow::flowTo(sink.getNode())
select sink.getNode(), source, sink, "This path to an untrusted URL redirection depends on a $@.",
source.getNode(), "user-provided value"

2
go/ql/src/Security/CWE-918/RequestForgery.ql
View File

@@ -21,6 +21,6 @@ where
RequestForgery::Flow::flowPath(source, sink) and
request = sink.getNode().(RequestForgery::Sink).getARequest() and
// this excludes flow from safe parts of request URLs, for example the full URL
not SafeUrlFlow::Flow::flow(_, sink.getNode())
not SafeUrlFlow::Flow::flowTo(sink.getNode())
select request, source, sink, "The $@ of this request depends on a $@.", sink.getNode(),
sink.getNode().(RequestForgery::Sink).getKind(), source, "user-provided value"

3
go/ql/src/experimental/CWE-285/PamAuthBypass.ql
View File

@@ -70,5 +70,6 @@ module PamStartToAuthenticateFlow = TaintTracking::Global<PamStartToAuthenticate
from DataFlow::Node source, DataFlow::Node sink
where
not isInTestFile(source.asExpr()) and
(PamStartToAuthenticateFlow::flow(source, sink) and not PamStartToAcctMgmtFlow::flow(source, _))
PamStartToAuthenticateFlow::flow(source, sink) and
not PamStartToAcctMgmtFlow::flowFrom(source)
select source, "This Pam transaction may not be secure."

2
go/ql/src/experimental/CWE-321-V2/HardCodedKeys.ql
View File

@@ -24,7 +24,7 @@ module JwtParseWithConstantKeyConfig implements DataFlow::ConfigSig {
or
n = fd.(FuncDecl).getFunction().getARead()
|
GolangJwtKeyFunc::flow(n, _) and
GolangJwtKeyFunc::flowFrom(n) and
sink = rn and
rn.getRoot() = fd and
rn.getIndex() = 0

1
go/ql/test/consistency/UnexpectedFrontendErrors.expected
View File

@@ -1 +0,0 @@
| test.go:7:1:7:1 | expected declaration, found This |

1
go/ql/test/consistency/dummy.expected Normal file
View File

@@ -0,0 +1 @@
| This is a dummy query which is only needed so that the consistency tests will run |

1
go/ql/test/consistency/dummy.ql Normal file
View File

@@ -0,0 +1 @@
select "This is a dummy query which is only needed so that the consistency tests will run"

3
go/ql/test/example-tests/snippets/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
identityLocalStep
| main.go:46:18:46:18 | n | Node steps to itself |
| main.go:47:3:47:3 | c | Node steps to itself |

5
go/ql/test/experimental/CWE-203/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,5 @@
reverseRead
| timing.go:15:18:15:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| timing.go:28:18:28:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| timing.go:41:18:41:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| timing.go:53:18:53:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

4
go/ql/test/experimental/CWE-287/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,4 @@
reverseRead
| ImproperLdapAuth.go:18:18:18:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| ImproperLdapAuth.go:39:18:39:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| ImproperLdapAuth.go:64:18:64:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

3
go/ql/test/experimental/CWE-321-V2/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
reverseRead
| go-jose.v3.go:16:17:16:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| golang-jwt-v5.go:22:17:22:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

10
go/ql/test/experimental/CWE-369/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,10 @@
reverseRead
| DivideByZero.go:10:12:10:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| DivideByZero.go:17:12:17:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| DivideByZero.go:24:12:24:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| DivideByZero.go:31:12:31:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| DivideByZero.go:38:12:38:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| DivideByZero.go:45:12:45:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| DivideByZero.go:54:12:54:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| DivideByZero.go:63:12:63:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| DivideByZero.go:72:12:72:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

4
go/ql/test/experimental/CWE-400/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,4 @@
identityLocalStep
| DatabaseCallInLoop.go:9:3:9:4 | db | Node steps to itself |
| test.go:21:12:21:13 | db | Node steps to itself |
| test.go:25:15:25:16 | db | Node steps to itself |

58
go/ql/test/experimental/CWE-522-DecompressionBombs/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,58 @@
reverseRead
| test.go:60:15:60:21 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:61:24:61:30 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:62:13:62:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:63:17:63:23 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:64:8:64:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:65:12:65:18 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:66:8:66:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:67:12:67:18 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:68:17:68:23 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:69:21:69:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:70:13:70:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:71:17:71:23 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:72:16:72:22 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:73:20:73:26 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:74:7:74:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:75:11:75:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:76:9:76:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:77:13:77:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:78:18:78:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:79:22:79:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:80:5:80:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:81:9:81:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:82:7:82:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:83:11:83:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:84:15:84:21 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:85:16:85:22 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:86:20:86:26 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:87:16:87:22 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:88:20:88:26 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:89:17:89:23 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:90:21:90:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:91:15:91:21 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:92:19:92:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:93:5:93:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:94:9:94:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| test.go:114:37:114:38 | rc | Node steps to itself |
| test.go:198:27:198:29 | out | Node steps to itself |
| test.go:224:27:224:29 | out | Node steps to itself |
| test.go:249:27:249:29 | out | Node steps to itself |
| test.go:274:27:274:29 | out | Node steps to itself |
| test.go:299:27:299:29 | out | Node steps to itself |
| test.go:324:26:324:28 | out | Node steps to itself |
| test.go:349:26:349:28 | out | Node steps to itself |
| test.go:375:28:375:30 | out | Node steps to itself |
| test.go:403:28:403:30 | out | Node steps to itself |
| test.go:431:24:431:26 | out | Node steps to itself |
| test.go:463:26:463:28 | out | Node steps to itself |
| test.go:490:26:490:28 | out | Node steps to itself |
| test.go:517:27:517:29 | out | Node steps to itself |
| test.go:546:26:546:28 | out | Node steps to itself |
| test.go:571:26:571:28 | out | Node steps to itself |
| test.go:601:24:601:26 | out | Node steps to itself |
| test.go:614:15:614:21 | tarRead | Node steps to itself |
| test.go:622:3:622:7 | files | Node steps to itself |
| test.go:637:10:637:16 | tarRead | Node steps to itself |
| test.go:647:10:647:16 | tarRead | Node steps to itself |

13
go/ql/test/experimental/CWE-807/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,13 @@
reverseRead
| SensitiveConditionBypassBad.go:7:5:7:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:16:5:16:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:25:5:25:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:34:5:34:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:41:5:41:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:41:35:41:35 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:49:5:49:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:56:5:56:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:63:5:63:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:70:5:70:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:77:5:77:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:84:5:84:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

7
go/ql/test/experimental/CWE-840/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,7 @@
reverseRead
| ConditionalBypassBad.go:9:5:9:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| ConditionalBypassGood.go:9:5:9:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:9:5:9:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:16:5:16:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:16:41:16:41 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| condition.go:23:5:23:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

8
go/ql/test/experimental/CWE-918/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,8 @@
reverseRead
| builtin.go:115:31:115:31 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| builtin.go:124:32:124:32 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| builtin.go:133:54:133:54 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| builtin.go:142:55:142:55 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| new-tests.go:62:31:62:33 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| new-tests.go:78:18:78:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| new-tests.go:81:37:81:39 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

18
go/ql/test/experimental/CWE-942/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,18 @@
reverseRead
| CorsMisconfiguration.go:52:14:52:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:59:14:59:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:66:17:66:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:74:14:74:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:81:14:81:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:88:14:88:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:101:14:101:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:112:14:112:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:126:15:126:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:141:14:141:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:156:14:156:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:170:14:170:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:194:17:194:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CorsMisconfiguration.go:206:14:206:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| CorsMisconfiguration.go:208:13:208:18 | origin | Node steps to itself |
| CorsMisconfiguration.go:235:6:235:8 | try | Node steps to itself |

6
go/ql/test/experimental/Unsafe/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,6 @@
reverseRead
| WrongUsageOfUnsafe.go:34:40:34:47 | harmless | Origin of readStep is missing a PostUpdateNode. |
| WrongUsageOfUnsafe.go:55:40:55:47 | harmless | Origin of readStep is missing a PostUpdateNode. |
| WrongUsageOfUnsafe.go:77:43:77:50 | harmless | Origin of readStep is missing a PostUpdateNode. |
| WrongUsageOfUnsafe.go:111:47:111:54 | harmless | Origin of readStep is missing a PostUpdateNode. |
| WrongUsageOfUnsafe.go:211:47:211:54 | harmless | Origin of readStep is missing a PostUpdateNode. |

2
go/ql/test/experimental/frameworks/CleverGo/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
reverseRead
| RemoteSources.go:98:9:98:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

11
go/ql/test/library-tests/semmle/go/Types/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,11 @@
reverseRead
| pkg1/embedding.go:56:29:56:39 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| pkg1/embedding.go:57:33:57:46 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| pkg1/embedding.go:58:14:58:22 | implicit read of field embedder | Origin of readStep is missing a PostUpdateNode. |
| pkg1/embedding.go:58:31:58:42 | implicit read of field embedder | Origin of readStep is missing a PostUpdateNode. |
| pkg1/tst.go:43:6:43:6 | t | Origin of readStep is missing a PostUpdateNode. |
| pkg1/tst.go:46:6:46:6 | t | Origin of readStep is missing a PostUpdateNode. |
| pkg1/tst.go:50:2:50:2 | t | Origin of readStep is missing a PostUpdateNode. |
| pkg1/tst.go:53:6:53:7 | t2 | Origin of readStep is missing a PostUpdateNode. |
| pkg1/tst.go:55:6:55:7 | t2 | Origin of readStep is missing a PostUpdateNode. |
| promoted.go:18:6:18:6 | t | Origin of readStep is missing a PostUpdateNode. |

9
go/ql/test/library-tests/semmle/go/concepts/HTTP/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,9 @@
reverseRead
| main.go:49:2:49:4 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:50:2:50:4 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:58:2:58:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:63:49:63:49 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| server.go:8:6:8:6 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| server.go:9:6:9:6 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| server.go:10:6:10:6 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| server.go:13:6:13:6 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

6
go/ql/test/library-tests/semmle/go/dataflow/DefaultTaintSanitizer/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,6 @@
reverseRead
| Builtin.go:7:2:7:10 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Builtin.go:13:2:13:10 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Builtin.go:22:2:22:10 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Builtin.go:32:2:32:10 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Builtin.go:39:2:39:10 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

37
go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,37 @@
reverseRead
| test_methods.go:44:7:44:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:45:7:45:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:46:2:46:2 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:50:7:50:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:51:7:51:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:52:2:52:2 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:92:7:92:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:93:7:93:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:94:2:94:2 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:98:7:98:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:99:7:99:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:100:2:100:2 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:104:7:104:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:105:7:105:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:106:2:106:2 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:110:7:110:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:111:7:111:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:112:2:112:2 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:140:7:140:7 | implicit read of field SEmbedI1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:141:7:141:7 | implicit read of field SEmbedI1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:142:2:142:2 | implicit read of field SEmbedI1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:146:7:146:7 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:147:7:147:7 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:148:2:148:2 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:152:7:152:7 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:153:7:153:7 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:154:2:154:2 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:158:7:158:7 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:159:7:159:7 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:160:2:160:2 | implicit read of field SEmbedS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:164:7:164:7 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:165:7:165:7 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:166:2:166:2 | implicit read of field SEmbedPtrS1 | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:170:7:170:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:171:7:171:7 | t | Origin of readStep is missing a PostUpdateNode. |
| test_methods.go:172:2:172:2 | t | Origin of readStep is missing a PostUpdateNode. |

15
go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,15 @@
reverseRead
| test.go:90:10:90:15 | taint8 | Origin of readStep is missing a PostUpdateNode. |
| test.go:104:12:104:18 | taint10 | Origin of readStep is missing a PostUpdateNode. |
| test.go:150:10:150:14 | slice | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| test.go:92:3:92:3 | b | Node steps to itself |
| test.go:95:3:95:3 | b | Node steps to itself |
| test.go:106:3:106:3 | b | Node steps to itself |
| test.go:109:3:109:3 | b | Node steps to itself |
| test.go:119:3:119:3 | b | Node steps to itself |
| test.go:122:3:122:3 | b | Node steps to itself |
| test.go:125:3:125:3 | b | Node steps to itself |
| test.go:128:3:128:3 | b | Node steps to itself |
| test.go:138:3:138:3 | b | Node steps to itself |
| test.go:141:3:141:3 | b | Node steps to itself |

15
go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,15 @@
reverseRead
| test.go:90:10:90:15 | taint8 | Origin of readStep is missing a PostUpdateNode. |
| test.go:104:12:104:18 | taint10 | Origin of readStep is missing a PostUpdateNode. |
| test.go:150:10:150:14 | slice | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| test.go:92:3:92:3 | b | Node steps to itself |
| test.go:95:3:95:3 | b | Node steps to itself |
| test.go:106:3:106:3 | b | Node steps to itself |
| test.go:109:3:109:3 | b | Node steps to itself |
| test.go:119:3:119:3 | b | Node steps to itself |
| test.go:122:3:122:3 | b | Node steps to itself |
| test.go:125:3:125:3 | b | Node steps to itself |
| test.go:128:3:128:3 | b | Node steps to itself |
| test.go:138:3:138:3 | b | Node steps to itself |
| test.go:141:3:141:3 | b | Node steps to itself |

3
go/ql/test/library-tests/semmle/go/dataflow/GlobalValueNumbering/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
reverseRead
| regressions.go:21:3:21:3 | x | Origin of readStep is missing a PostUpdateNode. |
| regressions.go:22:3:22:3 | y | Origin of readStep is missing a PostUpdateNode. |

3
go/ql/test/library-tests/semmle/go/dataflow/GlobalVariableSideEffects/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
reverseRead
| globalVariable.go:17:7:17:17 | globalArray | Origin of readStep is missing a PostUpdateNode. |
| globalVariable.go:18:7:18:17 | globalSlice | Origin of readStep is missing a PostUpdateNode. |

2
go/ql/test/library-tests/semmle/go/dataflow/PostUpdateNodes/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
reverseRead
| test.go:23:12:23:12 | a | Origin of readStep is missing a PostUpdateNode. |

7
go/ql/test/library-tests/semmle/go/dataflow/PromotedMethods/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,7 @@
reverseRead
| methods.go:48:2:48:6 | base1 | Origin of readStep is missing a PostUpdateNode. |
| methods.go:58:2:58:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| methods.go:67:2:67:6 | base2 | Origin of readStep is missing a PostUpdateNode. |
| methods.go:68:2:68:6 | base2 | Origin of readStep is missing a PostUpdateNode. |
| methods.go:77:2:77:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| methods.go:78:2:78:7 | base2p | Origin of readStep is missing a PostUpdateNode. |

3
go/ql/test/library-tests/semmle/go/dataflow/SSA/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
reverseRead
| main.go:97:2:97:8 | wrapper | Origin of readStep is missing a PostUpdateNode. |
| main.go:117:2:117:2 | p | Origin of readStep is missing a PostUpdateNode. |

2
go/ql/test/library-tests/semmle/go/dataflow/ThreatModels/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
reverseRead
| test.go:32:11:32:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

28
go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/database/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,28 @@
reverseRead
| test_couchbase_gocb_v2.go:151:2:151:10 | call to Next | Origin of readStep is missing a PostUpdateNode. |
| test_couchbase_gocb_v2.go:161:2:161:3 | r7 | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:66:6:66:9 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:69:9:69:12 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:80:18:80:19 | db | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:89:8:89:11 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:91:6:91:9 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:94:9:94:12 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:151:8:151:11 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:153:6:153:9 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:156:9:156:12 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:198:18:198:21 | stmt | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:207:8:207:11 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:209:6:209:9 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:212:9:212:12 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:254:18:254:19 | tx | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:263:8:263:11 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:265:6:265:9 | rows | Origin of readStep is missing a PostUpdateNode. |
| test_jmoiron_sqlx.go:268:9:268:12 | rows | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| test_couchbase_gocb_v1.go:20:6:20:7 | r1 | Node steps to itself |
| test_couchbase_gocb_v1.go:40:6:40:7 | r2 | Node steps to itself |
| test_mongo_driver_mongo.go:80:24:80:26 | ctx | Node steps to itself |
| test_mongo_driver_mongo.go:103:24:103:26 | ctx | Node steps to itself |
| test_mongo_driver_mongo.go:116:24:116:26 | ctx | Node steps to itself |
| test_uptrace_bun.go:27:3:27:4 | db | Node steps to itself |
| test_uptrace_bun.go:27:14:27:16 | ctx | Node steps to itself |

2
go/ql/test/library-tests/semmle/go/frameworks/Afero/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
reverseRead
| test.go:19:14:19:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

19
go/ql/test/library-tests/semmle/go/frameworks/Beego/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,19 @@
reverseRead
| test.go:142:3:142:9 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:143:3:143:9 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:143:23:143:29 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:208:18:208:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:208:18:208:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:229:21:229:25 | files | Origin of readStep is missing a PostUpdateNode. |
| test.go:259:2:259:2 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:270:37:270:37 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:283:44:283:48 | files | Origin of readStep is missing a PostUpdateNode. |
| test.go:297:51:297:62 | genericFiles | Origin of readStep is missing a PostUpdateNode. |
| test.go:298:54:298:62 | untainted | Origin of readStep is missing a PostUpdateNode. |
| test.go:317:13:317:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:318:20:318:22 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:324:17:324:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:324:17:324:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| test.go:278:3:278:14 | genericFiles | Node steps to itself |
| test.go:278:21:278:25 | files | Node steps to itself |

2
go/ql/test/library-tests/semmle/go/frameworks/BeegoOrm/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
reverseRead
| test.go:110:20:110:23 | objs | Origin of readStep is missing a PostUpdateNode. |

2
go/ql/test/library-tests/semmle/go/frameworks/Chi/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
reverseRead
| test.go:13:12:13:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

4
go/ql/test/library-tests/semmle/go/frameworks/Echo/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,4 @@
reverseRead
| test.go:89:16:89:22 | cookies | Origin of readStep is missing a PostUpdateNode. |
| test.go:193:10:193:22 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:216:20:216:26 | cookies | Origin of readStep is missing a PostUpdateNode. |

22
go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,22 @@
reverseRead
| fasthttp.go:75:28:75:35 | lbclient | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:102:7:102:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:162:3:162:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:163:3:163:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:164:3:164:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:165:15:165:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:166:15:166:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:167:15:167:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:168:15:168:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:170:3:170:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:172:3:172:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:173:3:173:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:174:3:174:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:175:3:175:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:183:3:183:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:184:3:184:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:185:16:185:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:194:3:194:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:195:3:195:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:196:3:196:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| fasthttp.go:197:3:197:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

5
go/ql/test/library-tests/semmle/go/frameworks/Gin/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,5 @@
reverseRead
| Gin.go:26:18:26:18 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Gin.go:26:28:26:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Gin.go:158:10:158:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Gin.go:162:13:162:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

14
go/ql/test/library-tests/semmle/go/frameworks/GoMicro/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,14 @@
reverseRead
| proto/Hello.pb.go:34:10:34:40 | file_proto_Hello_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.go:47:9:47:39 | file_proto_Hello_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.go:81:10:81:40 | file_proto_Hello_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.go:94:9:94:39 | file_proto_Hello_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.go:169:13:169:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.go:171:13:171:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.go:173:13:173:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.go:181:13:181:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.go:183:13:183:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.go:185:13:185:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.micro.go:55:9:55:9 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.micro.go:57:9:57:9 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| proto/Hello.pb.micro.go:86:9:86:9 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

2
go/ql/test/library-tests/semmle/go/frameworks/Macaron/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
reverseRead
| main.go:19:2:19:4 | ctx | Origin of readStep is missing a PostUpdateNode. |

32
go/ql/test/library-tests/semmle/go/frameworks/Protobuf/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,32 @@
reverseRead
| protos/query/query.pb.go:58:9:58:34 | file_query_proto_enumTypes | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:62:10:62:35 | file_query_proto_enumTypes | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:88:10:88:34 | file_query_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:101:9:101:33 | file_query_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:156:10:156:34 | file_query_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:169:9:169:33 | file_query_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:204:10:204:34 | file_query_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:217:9:217:33 | file_query_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:318:13:318:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:320:13:320:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:322:13:322:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:330:13:330:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:332:13:332:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:334:13:334:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:342:13:342:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:344:13:344:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| protos/query/query.pb.go:346:13:346:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| testDeprecatedApi.go:74:24:74:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| testDeprecatedApi.go:85:24:85:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| testDeprecatedApi.go:98:13:98:24 | selection of Alerts | Origin of readStep is missing a PostUpdateNode. |
| testDeprecatedApi.go:124:12:124:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| testDeprecatedApi.go:167:12:167:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| testDeprecatedApi.go:176:24:176:28 | query | Origin of readStep is missing a PostUpdateNode. |
| testModernApi.go:94:12:94:21 | serialized | Origin of readStep is missing a PostUpdateNode. |
| testModernApi.go:102:24:102:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| testModernApi.go:113:24:113:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| testModernApi.go:126:13:126:24 | selection of Alerts | Origin of readStep is missing a PostUpdateNode. |
| testModernApi.go:162:12:162:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| testModernApi.go:186:12:186:21 | serialized | Origin of readStep is missing a PostUpdateNode. |
| testModernApi.go:224:12:224:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| testModernApi.go:233:24:233:28 | query | Origin of readStep is missing a PostUpdateNode. |

173
go/ql/test/library-tests/semmle/go/frameworks/Revel/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,173 @@
reverseRead
| EndToEnd.go:30:9:30:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:30:35:30:35 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:30:35:30:42 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:36:18:36:18 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:36:18:36:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:37:9:37:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:44:18:44:18 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:44:18:44:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:45:9:45:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:51:20:51:20 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:51:20:51:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:52:9:52:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:58:18:58:18 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:58:18:58:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:59:9:59:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:64:9:64:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:64:26:64:26 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:64:26:64:33 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:69:9:69:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:69:22:69:22 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:69:22:69:29 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:74:9:74:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:74:22:74:22 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:74:22:74:29 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:79:9:79:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:79:35:79:35 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:79:35:79:42 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:84:9:84:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:84:22:84:22 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:84:22:84:29 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:89:9:89:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:89:21:89:21 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:89:21:89:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:94:9:94:9 | c | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:94:20:94:20 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| EndToEnd.go:94:20:94:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:26:7:26:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:26:7:26:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:27:7:27:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:27:7:27:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:30:2:30:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:33:7:33:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:37:7:37:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:37:7:37:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:38:24:38:24 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:42:7:42:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:43:24:43:24 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:47:7:47:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:51:7:51:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:52:7:52:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:56:7:56:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:56:7:56:27 | index expression | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:60:7:60:7 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:60:7:60:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:63:2:63:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:70:22:70:22 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:71:2:71:2 | c | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:75:7:75:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:76:7:76:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:77:7:77:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:77:7:77:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:78:7:78:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:79:7:79:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:80:7:80:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:82:13:82:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:85:13:85:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:88:13:88:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:89:7:89:28 | index expression | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:91:7:91:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:91:7:91:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:91:7:91:41 | index expression | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:93:28:93:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:96:15:96:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:99:7:99:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:101:7:101:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:103:15:103:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:109:7:109:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:111:7:111:7 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:116:2:116:2 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:116:2:116:10 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:120:2:120:2 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:120:2:120:10 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:125:13:125:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:125:13:125:21 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:128:14:128:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:128:14:128:22 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| Revel.go:133:13:133:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:34:2:34:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:45:10:45:10 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:47:2:47:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:48:9:48:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:52:9:52:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:56:2:56:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:57:2:57:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:59:16:59:16 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:61:5:61:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:62:3:62:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:63:3:63:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:64:10:64:10 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:68:2:68:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:69:9:69:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:79:5:79:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:81:5:81:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:83:4:83:4 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:84:11:84:11 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:89:2:89:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:90:9:90:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:95:10:95:10 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/app.go:97:9:97:9 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:43:13:43:13 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:44:3:44:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:45:10:45:10 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:51:2:51:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:54:9:54:9 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:107:9:107:9 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:118:9:118:9 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:132:10:132:10 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:135:9:135:9 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:139:9:139:9 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:143:26:143:26 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:144:2:144:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:146:2:146:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:148:5:148:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:149:3:149:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:150:10:150:10 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:153:2:153:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:154:9:154:9 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:160:10:160:10 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:165:17:165:17 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:166:19:166:19 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:168:5:168:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:168:33:168:33 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:168:33:168:40 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:169:3:169:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:170:3:170:3 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:171:10:171:10 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:174:5:174:5 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:174:5:174:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:175:3:175:3 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:176:4:176:10 | booking | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:177:10:177:10 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:180:9:180:9 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:184:2:184:2 | implicit read of field Controller | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:185:9:185:9 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:191:10:191:10 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/controllers/hotels.go:195:9:195:9 | c | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/init.go:36:44:36:44 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/init.go:40:49:40:49 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/init.go:52:2:52:2 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/init.go:52:2:52:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/init.go:53:2:53:2 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/init.go:53:2:53:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/init.go:54:2:54:2 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/init.go:54:2:54:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:33:13:33:19 | booking | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:34:13:34:19 | booking | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:35:13:35:19 | booking | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:36:13:36:19 | booking | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:49:9:49:9 | b | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:53:14:53:14 | b | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:53:38:53:38 | b | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:67:3:67:3 | b | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:68:3:68:3 | b | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:69:3:69:3 | b | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:73:39:73:39 | b | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:73:47:73:47 | b | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:81:13:81:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:82:14:82:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:83:17:83:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| examples/booking/app/models/booking.go:84:18:84:18 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| examples/booking/app/controllers/app.go:95:10:95:10 | c | Node steps to itself |

2
go/ql/test/library-tests/semmle/go/frameworks/SystemCommandExecutors/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
reverseRead
| SystemCommandExecutors.go:25:12:25:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

3
go/ql/test/library-tests/semmle/go/frameworks/TaintSteps/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
reverseRead
| main.go:28:2:28:4 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:34:2:34:4 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

103
go/ql/test/library-tests/semmle/go/frameworks/Twirp/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,103 @@
reverseRead
| rpc/notes/service.pb.go:36:10:36:46 | file_rpc_notes_service_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:49:9:49:45 | file_rpc_notes_service_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:97:10:97:46 | file_rpc_notes_service_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:110:9:110:45 | file_rpc_notes_service_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:142:10:142:46 | file_rpc_notes_service_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:155:9:155:45 | file_rpc_notes_service_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:182:10:182:46 | file_rpc_notes_service_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:195:9:195:45 | file_rpc_notes_service_proto_msgTypes | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:297:13:297:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:299:13:299:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:301:13:301:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:309:13:309:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:311:13:311:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:313:13:313:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:321:13:321:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:323:13:323:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:325:13:325:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:333:13:333:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:335:13:335:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.pb.go:337:13:337:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:82:40:82:49 | clientOpts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:118:37:118:37 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:118:47:118:52 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:124:24:124:29 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:128:34:128:39 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:164:37:164:37 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:164:47:164:52 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:170:24:170:29 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:174:34:174:39 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:221:40:221:49 | clientOpts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:257:33:257:33 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:257:43:257:48 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:263:24:263:29 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:267:34:267:39 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:303:33:303:33 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:303:43:303:48 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:309:24:309:29 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:313:34:313:39 | selection of opts | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:350:45:350:54 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:360:29:360:29 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:389:38:389:38 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:397:58:397:60 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:402:47:402:49 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:404:48:404:50 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:405:58:405:60 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:409:95:409:97 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:410:58:410:60 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:422:48:422:50 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:423:58:423:60 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:429:12:429:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:440:53:440:55 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:441:43:441:45 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:449:36:449:36 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:455:23:455:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:477:13:477:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:494:41:494:41 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:507:34:507:34 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:524:24:524:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:526:24:526:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:532:36:532:36 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:538:25:538:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:558:13:558:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:575:41:575:41 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:588:34:588:34 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:603:24:603:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:605:24:605:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:609:12:609:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:620:53:620:55 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:621:43:621:45 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:629:36:629:36 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:635:23:635:25 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:657:13:657:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:674:41:674:41 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:687:34:687:34 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:704:24:704:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:706:24:706:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:712:36:712:36 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:718:25:718:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:738:13:738:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:755:41:755:41 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:768:34:768:34 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:783:24:783:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:785:24:785:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:969:8:969:13 | copied | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:984:2:984:4 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:985:2:985:4 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:986:2:986:4 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:1032:15:1032:18 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:1037:35:1037:38 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:1116:66:1116:66 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:1159:98:1159:98 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:1227:21:1227:24 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:1237:35:1237:38 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:1278:11:1278:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| rpc/notes/service.twirp.go:1292:23:1292:26 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| server/main.go:33:19:33:19 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| rpc/notes/service.twirp.go:60:6:60:15 | clientOpts | Node steps to itself |
| rpc/notes/service.twirp.go:199:6:199:15 | clientOpts | Node steps to itself |
| rpc/notes/service.twirp.go:852:6:852:15 | serverOpts | Node steps to itself |
| rpc/notes/service.twirp.go:854:29:854:38 | serverOpts | Node steps to itself |
| rpc/notes/service.twirp.go:965:4:965:9 | copied | Node steps to itself |

2
go/ql/test/library-tests/semmle/go/frameworks/WebSocket/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
reverseRead
| WebSocketReadWrite.go:27:9:27:9 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

12
go/ql/test/library-tests/semmle/go/frameworks/XNetHtml/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,12 @@
reverseRead
| test.go:12:12:12:18 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:17:24:17:30 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:20:36:20:42 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:23:33:23:39 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:24:22:24:26 | nodes | Origin of readStep is missing a PostUpdateNode. |
| test.go:26:45:26:51 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:27:22:27:27 | nodes2 | Origin of readStep is missing a PostUpdateNode. |
| test.go:31:33:31:39 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:39:49:39:55 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:43:31:43:37 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| test.go:48:32:48:38 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

6
go/ql/test/query-tests/InconsistentCode/InconsistentLoopOrientation/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,6 @@
identityLocalStep
| InconsistentLoopOrientation.go:6:3:6:3 | a | Node steps to itself |
| InconsistentLoopOrientationGood.go:6:3:6:3 | a | Node steps to itself |
| main.go:9:26:9:26 | s | Node steps to itself |
| main.go:14:29:14:29 | l | Node steps to itself |
| main.go:20:3:20:3 | a | Node steps to itself |

3
go/ql/test/query-tests/InconsistentCode/LengthComparisonOffByOne/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
identityLocalStep
| LengthComparisonOffByOne.go:10:19:10:28 | searchName | Node steps to itself |
| LengthComparisonOffByOneGood.go:9:14:9:23 | searchName | Node steps to itself |

4
go/ql/test/query-tests/RedundantCode/DeadStoreOfLocal/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,4 @@
reverseRead
| testdata.go:206:7:206:7 | x | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| testdata.go:583:7:583:7 | x | Node steps to itself |

3
go/ql/test/query-tests/RedundantCode/UnreachableStatement/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
identityLocalStep
| main.go:35:6:35:9 | cond | Node steps to itself |
| main.go:44:6:44:9 | cond | Node steps to itself |

5
go/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegexp/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,5 @@
reverseRead
| IncompleteHostnameRegexp.go:12:42:12:44 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| IncompleteHostnameRegexpGood2.go:12:42:12:44 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| IncompleteHostnameRegexpGood.go:12:42:12:44 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:18:57:18:57 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

3
go/ql/test/query-tests/Security/CWE-020/MissingRegexpAnchor/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
reverseRead
| MissingRegexpAnchor.go:12:42:12:44 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| MissingRegexpAnchorGood.go:12:42:12:44 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

22
go/ql/test/query-tests/Security/CWE-022/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,22 @@
reverseRead
| TaintedPath.go:15:18:15:18 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| TaintedPath.go:84:28:84:32 | files | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| UnsafeUnzipSymlink.go:26:18:26:18 | r | Node steps to itself |
| UnsafeUnzipSymlink.go:30:29:30:34 | target | Node steps to itself |
| UnsafeUnzipSymlink.go:42:22:42:27 | target | Node steps to itself |
| UnsafeUnzipSymlink.go:58:18:58:18 | r | Node steps to itself |
| UnsafeUnzipSymlink.go:62:3:62:7 | links | Node steps to itself |
| UnsafeUnzipSymlink.go:79:18:79:18 | r | Node steps to itself |
| UnsafeUnzipSymlink.go:85:29:85:34 | target | Node steps to itself |
| UnsafeUnzipSymlink.go:94:18:94:18 | r | Node steps to itself |
| UnsafeUnzipSymlink.go:98:29:98:34 | target | Node steps to itself |
| UnsafeUnzipSymlink.go:121:32:121:32 | r | Node steps to itself |
| UnsafeUnzipSymlink.go:125:29:125:34 | target | Node steps to itself |
| UnsafeUnzipSymlink.go:146:32:146:32 | r | Node steps to itself |
| UnsafeUnzipSymlink.go:150:29:150:34 | target | Node steps to itself |
| UnsafeUnzipSymlinkGood.go:30:18:30:18 | r | Node steps to itself |
| UnsafeUnzipSymlinkGood.go:34:33:34:38 | target | Node steps to itself |
| UnsafeUnzipSymlinkGood.go:46:26:46:31 | target | Node steps to itself |
| UnsafeUnzipSymlinkGood.go:72:18:72:18 | r | Node steps to itself |
| UnsafeUnzipSymlinkGood.go:76:41:76:46 | target | Node steps to itself |

11
go/ql/test/query-tests/Security/CWE-078/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,11 @@
reverseRead
| ArgumentInjection.go:9:10:9:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CommandInjection2.go:13:15:13:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CommandInjection2.go:21:15:21:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CommandInjection2.go:41:15:41:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| CommandInjection.go:9:13:9:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| GitSubcommands.go:11:13:11:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| GitSubcommands.go:22:13:22:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| GitSubcommands.go:33:13:33:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| SanitizingDoubleDash.go:9:13:9:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| SanitizingDoubleDash.go:92:13:92:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

26
go/ql/test/query-tests/Security/CWE-079/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,26 @@
reverseRead
| HtmlTemplateEscapingBypassXss.go:99:9:99:9 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| ReflectedXss.go:11:15:11:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| ReflectedXssGood.go:15:15:15:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| contenttype.go:11:11:11:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| contenttype.go:25:11:25:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| contenttype.go:39:11:39:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| contenttype.go:49:11:49:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| contenttype.go:61:11:61:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| contenttype.go:71:11:71:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| contenttype.go:86:11:86:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| contenttype.go:98:11:98:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| contenttype.go:111:11:111:11 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| reflectedxsstest.go:15:13:15:13 | r | Origin of readStep is missing a PostUpdateNode. |
| reflectedxsstest.go:21:13:21:13 | r | Origin of readStep is missing a PostUpdateNode. |
| reflectedxsstest.go:51:14:51:14 | r | Origin of readStep is missing a PostUpdateNode. |
| tst.go:14:15:14:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| tst.go:33:15:33:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| tst.go:48:14:48:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| tst.go:66:15:66:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| websocketXss.go:26:9:26:9 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
identityLocalStep
| StoredXss.go:13:18:13:18 | w | Node steps to itself |
| StoredXssGood.go:17:3:17:10 | template | Node steps to itself |
| stored.go:30:19:30:19 | w | Node steps to itself |
| stored.go:51:20:51:20 | w | Node steps to itself |

23
go/ql/test/query-tests/Security/CWE-089/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,23 @@
reverseRead
| SqlInjection.go:11:3:11:5 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| SqlInjection.go:11:3:11:17 | call to Query | Origin of readStep is missing a PostUpdateNode. |
| SqlInjectionGood.go:10:14:10:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| SqlInjectionGood.go:10:14:10:28 | call to Query | Origin of readStep is missing a PostUpdateNode. |
| issue48.go:17:25:17:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| issue48.go:21:3:21:21 | RequestDataFromJson | Origin of readStep is missing a PostUpdateNode. |
| issue48.go:27:26:27:28 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| issue48.go:31:3:31:22 | RequestDataFromJson2 | Origin of readStep is missing a PostUpdateNode. |
| issue48.go:37:24:37:26 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| issue48.go:40:3:40:22 | RequestDataFromJson3 | Origin of readStep is missing a PostUpdateNode. |
| main.go:15:63:15:63 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:15:63:15:75 | call to Query | Origin of readStep is missing a PostUpdateNode. |
| main.go:16:63:16:63 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:30:13:30:15 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:34:3:34:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:40:25:40:27 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:43:3:43:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:49:28:49:30 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:52:3:52:13 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:58:28:58:30 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| main.go:61:4:61:15 | star expression | Origin of readStep is missing a PostUpdateNode. |
| main.go:68:18:68:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

11
go/ql/test/query-tests/Security/CWE-117/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,11 @@
reverseRead
| LogInjection.go:32:14:32:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| LogInjection.go:33:14:33:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| LogInjection.go:34:18:34:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| LogInjection.go:35:14:35:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| LogInjection.go:447:14:447:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| LogInjection.go:455:14:455:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| LogInjection.go:463:14:463:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| LogInjection.go:498:14:498:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| LogInjection.go:499:14:499:16 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| LogInjection.go:724:12:724:14 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

3
go/ql/test/query-tests/Security/CWE-190/CONSISTENCY/DataFlowConsistency.expected Normal file
View File

@@ -0,0 +1,3 @@
reverseRead
| array_vs_contents.go:16:25:16:31 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
| array_vs_contents.go:33:25:33:31 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

Some files were not shown because too many files have changed in this diff Show More