Merge pull request #426 from owen-mc/model-k8s-io-apimachinery-pkg-runtime

Model k8s.io/apimachinery/pkg/runtime

change-notes/2020-12-08-k8s-io-apimachinery-pkg-runtime.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Support for the [k8s.io/apimachinery/pkg/runtime](https://godoc.org/k8s.io/apimachinery/pkg/runtime) library has been added, which may lead to more results from the security queries.

ql/src/go.qll

@@ -35,6 +35,7 @@ import semmle.go.frameworks.Encoding
 import semmle.go.frameworks.EvanphxJsonPatch
 import semmle.go.frameworks.Gin
 import semmle.go.frameworks.Glog
+import semmle.go.frameworks.K8sIoApimachineryPkgRuntime
 import semmle.go.frameworks.Logrus
 import semmle.go.frameworks.HTTP
 import semmle.go.frameworks.Macaron

ql/src/semmle/go/frameworks/K8sIoApimachineryPkgRuntime.qll

@@ -0,0 +1,426 @@
+/** Provides models of commonly used functions in the `k8s.io/apimachinery/pkg/runtime` package. */
+
+import go
+
+/**
+ * Provides models of commonly used functions in the `k8s.io/apimachinery/pkg/runtime` package.
+ */
+module K8sIoApimachineryPkgRuntime {
+  /** Gets the package name. */
+  bindingset[result]
+  string packagePath() { result = package("k8s.io/apimachinery", "pkg/runtime") }
+
+  private class ConvertTypeToType extends TaintTracking::FunctionModel {
+    ConvertTypeToType() {
+      this
+          .hasQualifiedName(packagePath(),
+            [
+              "Convert_Slice_string_To_Pointer_int64", "Convert_Slice_string_To_int",
+              "Convert_Slice_string_To_int64", "Convert_Slice_string_To_string",
+              "Convert_runtime_Object_To_runtime_RawExtension",
+              "Convert_runtime_RawExtension_To_runtime_Object", "Convert_string_To_Pointer_int64",
+              "Convert_string_To_int64"
+            ])
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isParameter(1)
+    }
+  }
+
+  private class DecodeInto extends TaintTracking::FunctionModel, UnmarshalingFunction::Range {
+    DecodeInto() { this.hasQualifiedName(packagePath(), "DecodeInto") }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(1) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(2) }
+
+    override string getFormat() {
+      // The format is not fixed. It depends on parameter 1 or 2.
+      none()
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class DeepCopyJSON extends TaintTracking::FunctionModel {
+    DeepCopyJSON() { this.hasQualifiedName(packagePath(), ["DeepCopyJSON", "DeepCopyJSONValue"]) }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isResult()
+    }
+  }
+
+  private class Encode extends TaintTracking::FunctionModel, MarshalingFunction::Range {
+    Encode() { this.hasQualifiedName(packagePath(), ["Encode", "EncodeOrDie"]) }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(1) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isResult(0) }
+
+    override string getFormat() {
+      // The format is not fixed. It depends on the receiver.
+      none()
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class ReadField extends TaintTracking::FunctionModel {
+    ReadField() { this.hasQualifiedName(packagePath(), ["Field", "FieldPtr"]) }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isParameter(2)
+    }
+  }
+
+  private class SetField extends TaintTracking::FunctionModel {
+    SetField() { this.hasQualifiedName(packagePath(), "SetField") }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isParameter(1)
+    }
+  }
+
+  private class CacheableObjectCacheEncode extends TaintTracking::FunctionModel, Method,
+    MarshalingFunction::Range {
+    CacheableObjectCacheEncode() {
+      this.implements(packagePath(), "CacheableObject", "CacheEncode")
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isReceiver() }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(2) }
+
+    override string getFormat() {
+      // The format is not fixed. It depends on the receiver.
+      none()
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class CacheableObjectGetObject extends TaintTracking::FunctionModel, Method {
+    CacheableObjectGetObject() { this.implements(packagePath(), "CacheableObject", "GetObject") }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isReceiver() and outp.isResult()
+    }
+  }
+
+  private class DecoderDecode extends TaintTracking::FunctionModel, Method,
+    UnmarshalingFunction::Range {
+    DecoderDecode() {
+      this.implements(packagePath(), "Decoder", "Decode") or
+      this.hasQualifiedName(packagePath(), "WithoutVersionDecoder", "Decode")
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(0) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(2) or result.isResult(0) }
+
+    override string getFormat() {
+      // The format is not fixed. It depends on the receiver.
+      none()
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class EncoderEncode extends TaintTracking::FunctionModel, Method,
+    MarshalingFunction::Range {
+    EncoderEncode() {
+      this.implements(packagePath(), "Encoder", "Encode") or
+      this.hasQualifiedName(packagePath(), "WithVersionEncoder", "Encode")
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(0) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(1) }
+
+    override string getFormat() {
+      // The format is not fixed. It depends on the receiver.
+      none()
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class FramerNewFrameReader extends TaintTracking::FunctionModel, Method {
+    FramerNewFrameReader() { this.implements(packagePath(), "Framer", "NewFrameReader") }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isResult()
+    }
+  }
+
+  private class FramerNewFrameWriter extends TaintTracking::FunctionModel, Method {
+    FramerNewFrameWriter() { this.implements(packagePath(), "Framer", "NewFrameWriter") }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isResult()
+    }
+  }
+
+  private class ObjectDeepCopyObject extends TaintTracking::FunctionModel, Method {
+    ObjectDeepCopyObject() { this.implements(packagePath(), "Object", "DeepCopyObject") }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isReceiver() and outp.isResult()
+    }
+  }
+
+  private class Decode extends TaintTracking::FunctionModel, UnmarshalingFunction::Range {
+    Decode() { this.hasQualifiedName(packagePath(), "Decode") }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(1) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isResult(0) }
+
+    override string getFormat() {
+      // The format is not fixed. It depends on the parameter 0.
+      none()
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class NewEncodable extends TaintTracking::FunctionModel {
+    NewEncodable() { this.hasQualifiedName(packagePath(), ["NewEncodable", "NewEncodableList"]) }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(1) and outp.isResult()
+    }
+  }
+
+  private class UseOrCreateObject extends TaintTracking::FunctionModel {
+    UseOrCreateObject() { this.hasQualifiedName(packagePath(), "UseOrCreateObject") }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(3) and outp.isResult(0)
+    }
+  }
+
+  private class ObjectConvertorConvert extends TaintTracking::FunctionModel, Method {
+    ObjectConvertorConvert() { this.implements(packagePath(), "ObjectConvertor", "Convert") }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isParameter(1)
+    }
+  }
+
+  private class ObjectConvertorConvertToVersion extends TaintTracking::FunctionModel, Method {
+    ObjectConvertorConvertToVersion() {
+      this.implements(packagePath(), "ObjectConvertor", "ConvertToVersion")
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isResult(0)
+    }
+  }
+
+  private class ObjectVersionerConvertToVersion extends TaintTracking::FunctionModel, Method {
+    ObjectVersionerConvertToVersion() {
+      this.implements(packagePath(), "ObjectVersioner", "ConvertToVersion")
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isResult(0)
+    }
+  }
+
+  private class ParameterCodecDecodeParameters extends TaintTracking::FunctionModel, Method,
+    UnmarshalingFunction::Range {
+    ParameterCodecDecodeParameters() {
+      this.implements(packagePath(), "ParameterCodec", "DecodeParameters")
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(0) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(2) }
+
+    override string getFormat() {
+      // The format is not fixed. It depends on parameter 1.
+      none()
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class ParameterCodecEncodeParameters extends TaintTracking::FunctionModel, Method,
+    MarshalingFunction::Range {
+    ParameterCodecEncodeParameters() {
+      this.implements(packagePath(), "ParameterCodec", "EncodeParameters")
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(0) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isResult(0) }
+
+    override string getFormat() {
+      // The format is not fixed. It depends on parameter 1.
+      none()
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class ProtobufMarshallerMarshalTo extends TaintTracking::FunctionModel, Method,
+    MarshalingFunction::Range {
+    ProtobufMarshallerMarshalTo() {
+      this.implements(packagePath(), "ProtobufMarshaller", "MarshalTo") or
+      this.implements(packagePath(), "ProtobufReverseMarshaller", "MarshalToSizedBuffer")
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isReceiver() }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(0) }
+
+    override string getFormat() { result = "protobuf" }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class RawExtensionDeepCopy extends TaintTracking::FunctionModel, Method {
+    RawExtensionDeepCopy() { this.hasQualifiedName(packagePath(), "RawExtension", "DeepCopy") }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isReceiver() and outp.isResult()
+    }
+  }
+
+  private class RawExtensionDeepCopyInto extends TaintTracking::FunctionModel, Method {
+    RawExtensionDeepCopyInto() {
+      this.hasQualifiedName(packagePath(), "RawExtension", "DeepCopyInto")
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isReceiver() and outp.isParameter(0)
+    }
+  }
+
+  private class RawExtensionMarshal extends TaintTracking::FunctionModel, Method,
+    MarshalingFunction::Range {
+    RawExtensionMarshal() { this.hasQualifiedName(packagePath(), "RawExtension", "Marshal") }
+
+    override DataFlow::FunctionInput getAnInput() { result.isReceiver() }
+
+    override DataFlow::FunctionOutput getOutput() { result.isResult(0) }
+
+    override string getFormat() { result = "protobuf" }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class RawExtensionUnmarshal extends TaintTracking::FunctionModel, Method,
+    UnmarshalingFunction::Range {
+    RawExtensionUnmarshal() { this.hasQualifiedName(packagePath(), "RawExtension", "Unmarshal") }
+
+    override DataFlow::FunctionInput getAnInput() { result.isReceiver() }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(0) }
+
+    override string getFormat() { result = "protobuf" }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class UnknownDeepCopy extends TaintTracking::FunctionModel, Method {
+    UnknownDeepCopy() {
+      this.hasQualifiedName(packagePath(), "Unknown", ["DeepCopy", "DeepCopyObject"])
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isReceiver() and outp.isResult()
+    }
+  }
+
+  private class UnknownDeepCopyInto extends TaintTracking::FunctionModel, Method {
+    UnknownDeepCopyInto() { this.hasQualifiedName(packagePath(), "Unknown", "DeepCopyInto") }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isReceiver() and outp.isParameter(0)
+    }
+  }
+
+  private class UnknownMarshal extends TaintTracking::FunctionModel, Method,
+    MarshalingFunction::Range {
+    string methodName;
+
+    UnknownMarshal() {
+      methodName in ["Marshal", "NestedMarshalTo"] and
+      this.hasQualifiedName(packagePath(), "Unknown", methodName)
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isReceiver() }
+
+    override DataFlow::FunctionOutput getOutput() {
+      methodName = "Marshal" and result.isResult(0)
+      or
+      methodName = "NestedMarshalTo" and result.isParameter(0)
+    }
+
+    override string getFormat() { result = "protobuf" }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class UnknownUnmarshal extends TaintTracking::FunctionModel, Method,
+    UnmarshalingFunction::Range {
+    UnknownUnmarshal() { this.hasQualifiedName(packagePath(), "Unknown", "Unmarshal") }
+
+    override DataFlow::FunctionInput getAnInput() { result.isReceiver() }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(0) }
+
+    override string getFormat() { result = "protobuf" }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp = getAnInput() and outp = getOutput()
+    }
+  }
+
+  private class UnstructuredUnstructuredContent extends TaintTracking::FunctionModel, Method {
+    UnstructuredUnstructuredContent() {
+      this.implements(packagePath(), "Unstructured", "UnstructuredContent")
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isReceiver() and outp.isResult()
+    }
+  }
+
+  private class UnstructuredSetUnstructuredContent extends TaintTracking::FunctionModel, Method {
+    UnstructuredSetUnstructuredContent() {
+      this.implements(packagePath(), "Unstructured", "SetUnstructuredContent")
+    }
+
+    override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) {
+      inp.isParameter(0) and outp.isReceiver()
+    }
+  }
+}

ql/test/library-tests/semmle/go/frameworks/K8sIoApimachineryPkgRuntime/TaintFlowsInline.ql

@@ -0,0 +1,38 @@
+import go
+import TestUtilities.InlineExpectationsTest
+
+class SourceFunction extends Function {
+  SourceFunction() { this.getName() = "source" }
+}
+
+class SinkFunction extends Function {
+  SinkFunction() { this.getName() = "sink" }
+}
+
+class TestConfig extends TaintTracking::Configuration {
+  TestConfig() { this = "testconfig" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source = any(SourceFunction f).getACall().getAResult()
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink = any(SinkFunction f).getACall().getAnArgument()
+  }
+}
+
+class K8sIoApimachineryPkgRuntimeTest extends InlineExpectationsTest {
+  K8sIoApimachineryPkgRuntimeTest() { this = "KsIoApimachineryPkgRuntimeTest" }
+
+  override string getARelevantTag() { result = "KsIoApimachineryPkgRuntime" }
+
+  override predicate hasActualResult(string file, int line, string element, string tag, string value) {
+    exists(TestConfig config, DataFlow::PathNode source, DataFlow::PathNode sink |
+      config.hasFlowPath(source, sink) and
+      sink.hasLocationInfo(file, line, _, _, _) and
+      element = sink.toString() and
+      value = "" and
+      tag = "KsIoApimachineryPkgRuntime"
+    )
+  }
+}

ql/test/library-tests/semmle/go/frameworks/K8sIoApimachineryPkgRuntime/go.mod

@@ -0,0 +1,7 @@
+module codeql-go-tests/frameworks/K8sIoApimachineryPkgRuntime
+
+go 1.14
+
+require (
+	k8s.io/apimachinery v0.19.4
+)

ql/test/library-tests/semmle/go/frameworks/K8sIoApimachineryPkgRuntime/main.go

@@ -0,0 +1,396 @@
+package main
+
+import (
+	"io"
+	"net/url"
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+//go:generate depstubber -vendor k8s.io/apimachinery/pkg/conversion Scope
+//go:generate depstubber -vendor k8s.io/apimachinery/pkg/runtime/schema GroupVersionKind,ObjectKind
+//go:generate depstubber -vendor k8s.io/apimachinery/pkg/runtime CacheableObject,Decoder,Encoder,Framer,WithVersionEncoder,WithoutVersionDecoder,ObjectConvertor,ObjectVersioner,ParameterCodec,ProtobufMarshaller,ProtobufReverseMarshaller,Unknown,Unstructured Convert_Slice_string_To_Pointer_int64,Convert_Slice_string_To_int,Convert_Slice_string_To_int64,Convert_Slice_string_To_string,Convert_runtime_Object_To_runtime_RawExtension,Convert_runtime_RawExtension_To_runtime_Object,Convert_string_To_Pointer_int64,Convert_string_To_int64,DecodeInto,DeepCopyJSON,DeepCopyJSONValue,Encode,EncodeOrDie,Field,FieldPtr,SetField,Decode,NewEncodable,NewEncodableList,UseOrCreateObject
+
+func source() interface{} {
+	return make([]byte, 1, 1)
+}
+
+func sink(interface{}) {
+}
+
+func main() {
+	var decoder myDecoder
+	var s conversion.Scope
+
+	var encoder myEncoder
+
+	{
+		// func Convert_Slice_string_To_Pointer_int64(in *[]string, out **int64, s conversion.Scope) error
+		var out **int64
+		runtime.Convert_Slice_string_To_Pointer_int64(source().(*[]string), out, s)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Convert_Slice_string_To_int(in *[]string, out *int, s conversion.Scope) error
+		var out *int
+		runtime.Convert_Slice_string_To_int(source().(*[]string), out, s)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Convert_Slice_string_To_int64(in *[]string, out *int64, s conversion.Scope) error
+		var out *int64
+		runtime.Convert_Slice_string_To_int64(source().(*[]string), out, s)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Convert_Slice_string_To_string(in *[]string, out *string, s conversion.Scope) error
+		var out *string
+		runtime.Convert_Slice_string_To_string(source().(*[]string), out, s)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Convert_runtime_Object_To_runtime_RawExtension(in *Object, out *RawExtension, s conversion.Scope) error
+		var out *runtime.RawExtension
+		runtime.Convert_runtime_Object_To_runtime_RawExtension(source().(*runtime.Object), out, s)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Convert_runtime_RawExtension_To_runtime_Object(in *RawExtension, out *Object, s conversion.Scope) error
+		var out *runtime.Object
+		runtime.Convert_runtime_RawExtension_To_runtime_Object(source().(*runtime.RawExtension), out, s)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Convert_string_To_Pointer_int64(in *string, out **int64, s conversion.Scope) error
+		var out **int64
+		runtime.Convert_string_To_Pointer_int64(source().(*string), out, s)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Convert_string_To_int64(in *string, out *int64, s conversion.Scope) error
+		var out *int64
+		runtime.Convert_string_To_int64(source().(*string), out, s)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func DecodeInto(d Decoder, data []byte, into Object) error
+		var o runtime.Object
+		runtime.DecodeInto(decoder, source().([]byte), o)
+		sink(o) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func DeepCopyJSON(x map[string]interface{}) map[string]interface{}
+		sink(runtime.DeepCopyJSON(source().(map[string]interface{}))) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func DeepCopyJSONValue(x interface{}) interface{}
+		sink(runtime.DeepCopyJSONValue(source().(map[string]interface{}))) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Encode(e Encoder, obj Object) ([]byte, error)
+		x, _ := runtime.Encode(encoder, source().(runtime.Object))
+		sink(x) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func EncodeOrDie(e Encoder, obj Object) string
+		sink(runtime.EncodeOrDie(encoder, source().(runtime.Object))) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Field(v reflect.Value, fieldName string, dest interface{}) error
+		var fieldName string
+		var dest interface{}
+		runtime.Field(source().(reflect.Value), fieldName, dest)
+		sink(dest) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func FieldPtr(v reflect.Value, fieldName string, dest interface{}) error
+		var fieldName string
+		var dest interface{}
+		runtime.FieldPtr(source().(reflect.Value), fieldName, dest)
+		sink(dest) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func SetField(src interface{}, v reflect.Value, fieldName string) error
+		var v reflect.Value
+		var fieldName string
+		runtime.SetField(source(), v, fieldName)
+		sink(v) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		//    CacheEncode(id Identifier, encode func(Object, io.Writer) error, w io.Writer) error
+		var id runtime.Identifier
+		var encode func(runtime.Object, io.Writer) error
+		var w io.Writer
+		source().(myCacheableObject).CacheEncode(id, encode, w)
+		sink(w) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		//    GetObject() Object
+		sink(source().(myCacheableObject).GetObject()) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// Decode(data []byte, defaults *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error)
+		var defaults *schema.GroupVersionKind
+		var into runtime.Object
+		x, _, _ := decoder.Decode(source().([]byte), defaults, into)
+		sink(x)    // $KsIoApimachineryPkgRuntime
+		sink(into) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// Decode(data []byte, defaults *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error)
+		var defaults *schema.GroupVersionKind
+		var into runtime.Object
+		var withoutVersionDecoder runtime.WithoutVersionDecoder
+		x, _, _ := withoutVersionDecoder.Decode(source().([]byte), defaults, into)
+		sink(x)    // $KsIoApimachineryPkgRuntime
+		sink(into) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// Encode(obj Object, w io.Writer) error
+		var w io.Writer
+		encoder.Encode(source().(runtime.Object), w)
+		sink(w) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// Encode(obj Object, w io.Writer) error
+		var w io.Writer
+		var withVersionEncoder runtime.WithVersionEncoder
+		withVersionEncoder.Encode(source().(runtime.Object), w)
+		sink(w) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		var framer myFramer
+
+		// NewFrameReader(r io.ReadCloser) io.ReadCloser
+		sink(framer.NewFrameReader(source().(io.ReadCloser))) // $KsIoApimachineryPkgRuntime
+
+		// NewFrameWriter(w io.Writer) io.Writer
+		sink(framer.NewFrameWriter(source().(io.Writer))) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// DeepCopyObject() Object
+		sink(source().(runtime.Object).DeepCopyObject()) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func Decode(d Decoder, data []byte) (Object, error)
+		o, _ := runtime.Decode(decoder, source().([]byte))
+		sink(o) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func NewEncodable(e Encoder, obj Object, versions ...schema.GroupVersion) Object
+		sink(runtime.NewEncodable(encoder, source().(runtime.Object))) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func NewEncodableList(e Encoder, objects []Object, versions ...schema.GroupVersion) []Object
+		sink(runtime.NewEncodableList(encoder, source().([]runtime.Object))) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func UseOrCreateObject(t ObjectTyper, c ObjectCreater, gvk schema.GroupVersionKind, obj Object) (Object, error)
+		var t runtime.ObjectTyper
+		var c runtime.ObjectCreater
+		var gvk schema.GroupVersionKind
+		o, _ := runtime.UseOrCreateObject(t, c, gvk, source().(runtime.Object))
+		sink(o) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		var objectConverter myObjectConverter
+
+		//    Convert(in, out, context interface{}) error
+		var out, context interface{}
+		objectConverter.Convert(source(), out, context)
+		sink(out) // $KsIoApimachineryPkgRuntime
+
+		//    ConvertToVersion(in Object, gv GroupVersioner) (out Object, err error)
+		var gv runtime.GroupVersioner
+		o, _ := objectConverter.ConvertToVersion(source().(runtime.Object), gv)
+		sink(o) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		var parameterCodec myParameterCodec
+
+		//    DecodeParameters(parameters url.Values, from schema.GroupVersion, into Object) error
+		var gv schema.GroupVersion
+		var into runtime.Object
+		parameterCodec.DecodeParameters(source().(url.Values), gv, into)
+		sink(into) // $KsIoApimachineryPkgRuntime
+
+		//    EncodeParameters(obj Object, to schema.GroupVersion) (url.Values, error)
+		urlValues, _ := parameterCodec.EncodeParameters(source().(runtime.Object), gv)
+		sink(urlValues) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		//    MarshalTo(data []byte) (int, error)
+		var data []byte
+		source().(myProtobufMarshaller).MarshalTo(data)
+		sink(data) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		//    MarshalToSizedBuffer(data []byte) (int, error)
+		var data []byte
+		source().(myProtobufReverseMarshaller).MarshalToSizedBuffer(data)
+		sink(data) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (in *RawExtension) DeepCopy() *RawExtension
+		sink(source().(*runtime.RawExtension).DeepCopy()) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (in *RawExtension) DeepCopyInto(out *RawExtension)
+		var out *runtime.RawExtension
+		source().(*runtime.RawExtension).DeepCopyInto(out)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (m *RawExtension) Marshal() (dAtA []byte, err error)
+		dAtA, _ := source().(*runtime.RawExtension).Marshal()
+		sink(dAtA) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (m *RawExtension) MarshalTo(dAtA []byte) (int, error)
+		var dAtA []byte
+		source().(*runtime.RawExtension).MarshalTo(dAtA)
+		sink(dAtA) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (m *RawExtension) MarshalToSizedBuffer(dAtA []byte) (int, error)
+		var dAtA []byte
+		source().(*runtime.RawExtension).MarshalToSizedBuffer(dAtA)
+		sink(dAtA) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (m *RawExtension) Unmarshal(dAtA []byte) error
+		var dAtA []byte
+		source().(*runtime.RawExtension).Unmarshal(dAtA)
+		sink(dAtA) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (in *Unknown) DeepCopy() *Unknown
+		sink(source().(*runtime.Unknown).DeepCopy()) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (in *Unknown) DeepCopyObject() Object
+		sink(source().(*runtime.Unknown).DeepCopyObject()) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (in *Unknown) DeepCopyInto(out *Unknown)
+		var out *runtime.Unknown
+		source().(*runtime.Unknown).DeepCopyInto(out)
+		sink(out) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (m *Unknown) Marshal() (dAtA []byte, err error)
+		dAtA, _ := source().(*runtime.Unknown).Marshal()
+		sink(dAtA) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (m *Unknown) MarshalTo(dAtA []byte) (int, error)
+		var dAtA []byte
+		source().(*runtime.Unknown).MarshalTo(dAtA)
+		sink(dAtA) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (m *Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error)
+		var dAtA []byte
+		source().(*runtime.Unknown).MarshalToSizedBuffer(dAtA)
+		sink(dAtA) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (m *Unknown) NestedMarshalTo(data []byte, b ProtobufMarshaller, size uint64) (int, error)
+		var dAtA []byte
+		var b myProtobufMarshaller
+		source().(*runtime.Unknown).NestedMarshalTo(dAtA, b, 1)
+		sink(dAtA) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		// func (m *Unknown) Unmarshal(dAtA []byte) error
+		var dAtA []byte
+		source().(*runtime.Unknown).Unmarshal(dAtA)
+		sink(dAtA) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		//    UnstructuredContent() map[string]interface{}
+		sink(source().(myUnstructured).UnstructuredContent()) // $KsIoApimachineryPkgRuntime
+	}
+	{
+		//    SetUnstructuredContent(map[string]interface{})
+		var unstructured myUnstructured
+		unstructured.SetUnstructuredContent(source().(map[string]interface{}))
+		sink(unstructured) // $KsIoApimachineryPkgRuntime
+	}
+}
+
+type myCacheableObject struct{}
+
+func (m myCacheableObject) CacheEncode(id runtime.Identifier, encode func(runtime.Object, io.Writer) error, w io.Writer) error {
+	return nil
+}
+
+func (m myCacheableObject) GetObject() runtime.Object {
+	return nil
+}
+
+type myDecoder struct{}
+
+func (m myDecoder) Decode(data []byte, defaults *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	return nil, nil, nil
+}
+
+type myEncoder struct{}
+
+func (m myEncoder) Encode(obj runtime.Object, w io.Writer) error { return nil }
+func (m myEncoder) Identifier() runtime.Identifier               { return "" }
+
+type myFramer struct{}
+
+func (m myFramer) NewFrameReader(r io.ReadCloser) io.ReadCloser { return nil }
+func (m myFramer) NewFrameWriter(w io.Writer) io.Writer         { return nil }
+
+type myObjectConverter struct{}
+
+func (m myObjectConverter) Convert(in, out, context interface{}) error { return nil }
+func (m myObjectConverter) ConvertToVersion(in runtime.Object, gv runtime.GroupVersioner) (out runtime.Object, err error) {
+	return nil, nil
+}
+
+func (m myObjectConverter) ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error) {
+	return "", "", nil
+}
+
+type myParameterCodec struct{}
+
+func (m myParameterCodec) DecodeParameters(parameters url.Values, from schema.GroupVersion, into runtime.Object) error {
+	return nil
+}
+
+func (m myParameterCodec) EncodeParameters(obj runtime.Object, to schema.GroupVersion) (url.Values, error) {
+	return nil, nil
+}
+
+type myProtobufMarshaller struct{}
+
+func (m myProtobufMarshaller) MarshalTo(data []byte) (int, error) { return 0, nil }
+
+type myProtobufReverseMarshaller struct{}
+
+func (m myProtobufReverseMarshaller) MarshalToSizedBuffer(data []byte) (int, error) { return 0, nil }
+
+type myUnstructured struct {
+	runtime.Object
+}
+
+var objectForUnstructured runtime.Object
+
+func (m myUnstructured) NewEmptyInstance() runtime.Unstructured {
+	return myUnstructured{objectForUnstructured}
+}
+
+func (m myUnstructured) UnstructuredContent() map[string]interface{} { return nil }
+
+func (m myUnstructured) SetUnstructuredContent(map[string]interface{}) {}
+
+func (m myUnstructured) IsList() bool { return false }
+
+func (m myUnstructured) EachListItem(func(runtime.Object) error) error { return nil }

ql/test/library-tests/semmle/go/frameworks/K8sIoApimachineryPkgRuntime/vendor/k8s.io/apimachinery/pkg/conversion/stub.go

@@ -0,0 +1,33 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for k8s.io/apimachinery/pkg/conversion, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: k8s.io/apimachinery/pkg/conversion (exports: Scope; functions: )
+
+// Package conversion is a stub of k8s.io/apimachinery/pkg/conversion, generated by depstubber.
+package conversion
+
+import (
+	reflect "reflect"
+)
+
+type FieldMappingFunc func(string, reflect.StructTag, reflect.StructTag) (string, string)
+
+type FieldMatchingFlags int
+
+func (_ FieldMatchingFlags) IsSet(_ FieldMatchingFlags) bool {
+	return false
+}
+
+type Meta struct {
+	KeyNameMapping FieldMappingFunc
+	Context        interface{}
+}
+
+type Scope interface {
+	Convert(_ interface{}, _ interface{}, _ FieldMatchingFlags) error
+	DestTag() reflect.StructTag
+	Flags() FieldMatchingFlags
+	Meta() *Meta
+	SrcTag() reflect.StructTag
+}

ql/test/library-tests/semmle/go/frameworks/K8sIoApimachineryPkgRuntime/vendor/k8s.io/apimachinery/pkg/runtime/schema/stub.go

@@ -0,0 +1,126 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for k8s.io/apimachinery/pkg/runtime/schema, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: k8s.io/apimachinery/pkg/runtime/schema (exports: GroupVersionKind,ObjectKind; functions: )
+
+// Package schema is a stub of k8s.io/apimachinery/pkg/runtime/schema, generated by depstubber.
+package schema
+
+import ()
+
+type GroupKind struct {
+	Group string
+	Kind  string
+}
+
+func (_ GroupKind) Empty() bool {
+	return false
+}
+
+func (_ GroupKind) String() string {
+	return ""
+}
+
+func (_ GroupKind) WithVersion(_ string) GroupVersionKind {
+	return GroupVersionKind{}
+}
+
+type GroupResource struct {
+	Group    string
+	Resource string
+}
+
+func (_ GroupResource) Empty() bool {
+	return false
+}
+
+func (_ GroupResource) String() string {
+	return ""
+}
+
+func (_ GroupResource) WithVersion(_ string) GroupVersionResource {
+	return GroupVersionResource{}
+}
+
+type GroupVersion struct {
+	Group   string
+	Version string
+}
+
+func (_ GroupVersion) Empty() bool {
+	return false
+}
+
+func (_ GroupVersion) Identifier() string {
+	return ""
+}
+
+func (_ GroupVersion) KindForGroupVersionKinds(_ []GroupVersionKind) (GroupVersionKind, bool) {
+	return GroupVersionKind{}, false
+}
+
+func (_ GroupVersion) String() string {
+	return ""
+}
+
+func (_ GroupVersion) WithKind(_ string) GroupVersionKind {
+	return GroupVersionKind{}
+}
+
+func (_ GroupVersion) WithResource(_ string) GroupVersionResource {
+	return GroupVersionResource{}
+}
+
+type GroupVersionKind struct {
+	Group   string
+	Version string
+	Kind    string
+}
+
+func (_ GroupVersionKind) Empty() bool {
+	return false
+}
+
+func (_ GroupVersionKind) GroupKind() GroupKind {
+	return GroupKind{}
+}
+
+func (_ GroupVersionKind) GroupVersion() GroupVersion {
+	return GroupVersion{}
+}
+
+func (_ GroupVersionKind) String() string {
+	return ""
+}
+
+func (_ GroupVersionKind) ToAPIVersionAndKind() (string, string) {
+	return "", ""
+}
+
+type GroupVersionResource struct {
+	Group    string
+	Version  string
+	Resource string
+}
+
+func (_ GroupVersionResource) Empty() bool {
+	return false
+}
+
+func (_ GroupVersionResource) GroupResource() GroupResource {
+	return GroupResource{}
+}
+
+func (_ GroupVersionResource) GroupVersion() GroupVersion {
+	return GroupVersion{}
+}
+
+func (_ GroupVersionResource) String() string {
+	return ""
+}
+
+type ObjectKind interface {
+	GroupVersionKind() GroupVersionKind
+	SetGroupVersionKind(_ GroupVersionKind)
+}

ql/test/library-tests/semmle/go/frameworks/K8sIoApimachineryPkgRuntime/vendor/k8s.io/apimachinery/pkg/runtime/stub.go

@@ -0,0 +1,417 @@
+// Code generated by depstubber. DO NOT EDIT.
+// This is a simple stub for k8s.io/apimachinery/pkg/runtime, strictly for use in testing.
+
+// See the LICENSE file for information about the licensing of the original library.
+// Source: k8s.io/apimachinery/pkg/runtime (exports: CacheableObject,Decoder,Encoder,Framer,WithVersionEncoder,WithoutVersionDecoder,ObjectConvertor,ObjectVersioner,ParameterCodec,ProtobufMarshaller,ProtobufReverseMarshaller,Unknown,Unstructured; functions: Convert_Slice_string_To_Pointer_int64,Convert_Slice_string_To_int,Convert_Slice_string_To_int64,Convert_Slice_string_To_string,Convert_runtime_Object_To_runtime_RawExtension,Convert_runtime_RawExtension_To_runtime_Object,Convert_string_To_Pointer_int64,Convert_string_To_int64,DecodeInto,DeepCopyJSON,DeepCopyJSONValue,Encode,EncodeOrDie,Field,FieldPtr,SetField,Decode,NewEncodable,NewEncodableList,UseOrCreateObject)
+
+// Package runtime is a stub of k8s.io/apimachinery/pkg/runtime, generated by depstubber.
+package runtime
+
+import (
+	io "io"
+	url "net/url"
+	reflect "reflect"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type CacheableObject interface {
+	CacheEncode(_ Identifier, _ func(Object, io.Writer) error, _ io.Writer) error
+	GetObject() Object
+}
+
+func Convert_Slice_string_To_Pointer_int64(_ *[]string, _ **int64, _ conversion.Scope) error {
+	return nil
+}
+
+func Convert_Slice_string_To_int(_ *[]string, _ *int, _ conversion.Scope) error {
+	return nil
+}
+
+func Convert_Slice_string_To_int64(_ *[]string, _ *int64, _ conversion.Scope) error {
+	return nil
+}
+
+func Convert_Slice_string_To_string(_ *[]string, _ *string, _ conversion.Scope) error {
+	return nil
+}
+
+func Convert_runtime_Object_To_runtime_RawExtension(_ *Object, _ *RawExtension, _ conversion.Scope) error {
+	return nil
+}
+
+func Convert_runtime_RawExtension_To_runtime_Object(_ *RawExtension, _ *Object, _ conversion.Scope) error {
+	return nil
+}
+
+func Convert_string_To_Pointer_int64(_ *string, _ **int64, _ conversion.Scope) error {
+	return nil
+}
+
+func Convert_string_To_int64(_ *string, _ *int64, _ conversion.Scope) error {
+	return nil
+}
+
+func Decode(_ Decoder, _ []byte) (Object, error) {
+	return nil, nil
+}
+
+func DecodeInto(_ Decoder, _ []byte, _ Object) error {
+	return nil
+}
+
+type Decoder interface {
+	Decode(_ []byte, _ *schema.GroupVersionKind, _ Object) (Object, *schema.GroupVersionKind, error)
+}
+
+func DeepCopyJSON(_ map[string]interface{}) map[string]interface{} {
+	return nil
+}
+
+func DeepCopyJSONValue(_ interface{}) interface{} {
+	return nil
+}
+
+func Encode(_ Encoder, _ Object) ([]byte, error) {
+	return nil, nil
+}
+
+func EncodeOrDie(_ Encoder, _ Object) string {
+	return ""
+}
+
+type Encoder interface {
+	Encode(_ Object, _ io.Writer) error
+	Identifier() Identifier
+}
+
+func Field(_ reflect.Value, _ string, _ interface{}) error {
+	return nil
+}
+
+func FieldPtr(_ reflect.Value, _ string, _ interface{}) error {
+	return nil
+}
+
+type Framer interface {
+	NewFrameReader(_ io.ReadCloser) io.ReadCloser
+	NewFrameWriter(_ io.Writer) io.Writer
+}
+
+type GroupVersioner interface {
+	Identifier() string
+	KindForGroupVersionKinds(_ []schema.GroupVersionKind) (schema.GroupVersionKind, bool)
+}
+
+type Identifier string
+
+func NewEncodable(_ Encoder, _ Object, _ ...schema.GroupVersion) Object {
+	return nil
+}
+
+func NewEncodableList(_ Encoder, _ []Object, _ ...schema.GroupVersion) []Object {
+	return nil
+}
+
+type Object interface {
+	DeepCopyObject() Object
+	GetObjectKind() schema.ObjectKind
+}
+
+type ObjectConvertor interface {
+	Convert(_ interface{}, _ interface{}, _ interface{}) error
+	ConvertFieldLabel(_ schema.GroupVersionKind, _ string, _ string) (string, string, error)
+	ConvertToVersion(_ Object, _ GroupVersioner) (Object, error)
+}
+
+type ObjectCreater interface {
+	New(_ schema.GroupVersionKind) (Object, error)
+}
+
+type ObjectTyper interface {
+	ObjectKinds(_ Object) ([]schema.GroupVersionKind, bool, error)
+	Recognizes(_ schema.GroupVersionKind) bool
+}
+
+type ObjectVersioner interface {
+	ConvertToVersion(_ Object, _ GroupVersioner) (Object, error)
+}
+
+type ParameterCodec interface {
+	DecodeParameters(_ url.Values, _ schema.GroupVersion, _ Object) error
+	EncodeParameters(_ Object, _ schema.GroupVersion) (url.Values, error)
+}
+
+type ProtobufMarshaller interface {
+	MarshalTo(_ []byte) (int, error)
+}
+
+type ProtobufReverseMarshaller interface {
+	MarshalToSizedBuffer(_ []byte) (int, error)
+}
+
+type RawExtension struct {
+	Raw    []byte
+	Object Object
+}
+
+func (_ RawExtension) MarshalJSON() ([]byte, error) {
+	return nil, nil
+}
+
+func (_ *RawExtension) DeepCopy() *RawExtension {
+	return nil
+}
+
+func (_ *RawExtension) DeepCopyInto(_ *RawExtension) {}
+
+func (_ *RawExtension) Descriptor() ([]byte, []int) {
+	return nil, nil
+}
+
+func (_ *RawExtension) Marshal() ([]byte, error) {
+	return nil, nil
+}
+
+func (_ *RawExtension) MarshalTo(_ []byte) (int, error) {
+	return 0, nil
+}
+
+func (_ *RawExtension) MarshalToSizedBuffer(_ []byte) (int, error) {
+	return 0, nil
+}
+
+func (_ *RawExtension) ProtoMessage() {}
+
+func (_ *RawExtension) Reset() {}
+
+func (_ *RawExtension) Size() int {
+	return 0
+}
+
+func (_ *RawExtension) String() string {
+	return ""
+}
+
+func (_ *RawExtension) Unmarshal(_ []byte) error {
+	return nil
+}
+
+func (_ *RawExtension) UnmarshalJSON(_ []byte) error {
+	return nil
+}
+
+func (_ *RawExtension) XXX_DiscardUnknown() {}
+
+func (_ *RawExtension) XXX_Marshal(_ []byte, _ bool) ([]byte, error) {
+	return nil, nil
+}
+
+func (_ *RawExtension) XXX_Merge(_ interface{}) {}
+
+func (_ *RawExtension) XXX_Size() int {
+	return 0
+}
+
+func (_ *RawExtension) XXX_Unmarshal(_ []byte) error {
+	return nil
+}
+
+func SetField(_ interface{}, _ reflect.Value, _ string) error {
+	return nil
+}
+
+type TypeMeta struct {
+	APIVersion string
+	Kind       string
+}
+
+func (_ *TypeMeta) Descriptor() ([]byte, []int) {
+	return nil, nil
+}
+
+func (_ *TypeMeta) GetObjectKind() schema.ObjectKind {
+	return nil
+}
+
+func (_ *TypeMeta) GroupVersionKind() schema.GroupVersionKind {
+	return schema.GroupVersionKind{}
+}
+
+func (_ *TypeMeta) Marshal() ([]byte, error) {
+	return nil, nil
+}
+
+func (_ *TypeMeta) MarshalTo(_ []byte) (int, error) {
+	return 0, nil
+}
+
+func (_ *TypeMeta) MarshalToSizedBuffer(_ []byte) (int, error) {
+	return 0, nil
+}
+
+func (_ *TypeMeta) ProtoMessage() {}
+
+func (_ *TypeMeta) Reset() {}
+
+func (_ *TypeMeta) SetGroupVersionKind(_ schema.GroupVersionKind) {}
+
+func (_ *TypeMeta) Size() int {
+	return 0
+}
+
+func (_ *TypeMeta) String() string {
+	return ""
+}
+
+func (_ *TypeMeta) Unmarshal(_ []byte) error {
+	return nil
+}
+
+func (_ *TypeMeta) XXX_DiscardUnknown() {}
+
+func (_ *TypeMeta) XXX_Marshal(_ []byte, _ bool) ([]byte, error) {
+	return nil, nil
+}
+
+func (_ *TypeMeta) XXX_Merge(_ interface{}) {}
+
+func (_ *TypeMeta) XXX_Size() int {
+	return 0
+}
+
+func (_ *TypeMeta) XXX_Unmarshal(_ []byte) error {
+	return nil
+}
+
+type Unknown struct {
+	TypeMeta        TypeMeta
+	Raw             []byte
+	ContentEncoding string
+	ContentType     string
+}
+
+func (_ Unknown) MarshalJSON() ([]byte, error) {
+	return nil, nil
+}
+
+func (_ *Unknown) DeepCopy() *Unknown {
+	return nil
+}
+
+func (_ *Unknown) DeepCopyInto(_ *Unknown) {}
+
+func (_ *Unknown) DeepCopyObject() Object {
+	return nil
+}
+
+func (_ *Unknown) Descriptor() ([]byte, []int) {
+	return nil, nil
+}
+
+func (_ *Unknown) GetObjectKind() schema.ObjectKind {
+	return nil
+}
+
+func (_ *Unknown) GroupVersionKind() schema.GroupVersionKind {
+	return schema.GroupVersionKind{}
+}
+
+func (_ *Unknown) Marshal() ([]byte, error) {
+	return nil, nil
+}
+
+func (_ *Unknown) MarshalTo(_ []byte) (int, error) {
+	return 0, nil
+}
+
+func (_ *Unknown) MarshalToSizedBuffer(_ []byte) (int, error) {
+	return 0, nil
+}
+
+func (_ *Unknown) NestedMarshalTo(_ []byte, _ ProtobufMarshaller, _ uint64) (int, error) {
+	return 0, nil
+}
+
+func (_ *Unknown) ProtoMessage() {}
+
+func (_ *Unknown) Reset() {}
+
+func (_ *Unknown) SetGroupVersionKind(_ schema.GroupVersionKind) {}
+
+func (_ *Unknown) Size() int {
+	return 0
+}
+
+func (_ *Unknown) String() string {
+	return ""
+}
+
+func (_ *Unknown) Unmarshal(_ []byte) error {
+	return nil
+}
+
+func (_ *Unknown) UnmarshalJSON(_ []byte) error {
+	return nil
+}
+
+func (_ *Unknown) XXX_DiscardUnknown() {}
+
+func (_ *Unknown) XXX_Marshal(_ []byte, _ bool) ([]byte, error) {
+	return nil, nil
+}
+
+func (_ *Unknown) XXX_Merge(_ interface{}) {}
+
+func (_ *Unknown) XXX_Size() int {
+	return 0
+}
+
+func (_ *Unknown) XXX_Unmarshal(_ []byte) error {
+	return nil
+}
+
+type Unstructured interface {
+	DeepCopyObject() Object
+	EachListItem(_ func(Object) error) error
+	GetObjectKind() schema.ObjectKind
+	IsList() bool
+	NewEmptyInstance() Unstructured
+	SetUnstructuredContent(_ map[string]interface{})
+	UnstructuredContent() map[string]interface{}
+}
+
+func UseOrCreateObject(_ ObjectTyper, _ ObjectCreater, _ schema.GroupVersionKind, _ Object) (Object, error) {
+	return nil, nil
+}
+
+type WithVersionEncoder struct {
+	Version     GroupVersioner
+	Encoder     Encoder
+	ObjectTyper ObjectTyper
+}
+
+func (_ WithVersionEncoder) Encode(_ Object, _ io.Writer) error {
+	return nil
+}
+
+func (_ WithVersionEncoder) Identifier() Identifier {
+	return ""
+}
+
+func (_ WithVersionEncoder) ObjectKinds(_ Object) ([]schema.GroupVersionKind, bool, error) {
+	return nil, false, nil
+}
+
+func (_ WithVersionEncoder) Recognizes(_ schema.GroupVersionKind) bool {
+	return false
+}
+
+type WithoutVersionDecoder struct {
+	Decoder Decoder
+}
+
+func (_ WithoutVersionDecoder) Decode(_ []byte, _ *schema.GroupVersionKind, _ Object) (Object, schema.GroupVersionKind, error) {
+	return nil, schema.GroupVersionKind{}, nil
+}

ql/test/library-tests/semmle/go/frameworks/K8sIoApimachineryPkgRuntime/vendor/modules.txt

@@ -0,0 +1,3 @@
+# k8s.io/apimachinery v0.19.4
+## explicit
+k8s.io/apimachinery