Merge pull request #39 from sauyon/go1.14

Go 1.14 support
2026-01-29 14:23:03 +01:00 · 2020-03-18 10:08:50 +00:00
parent 60ce9c5acd 0a59470640
commit f53732ec5a
21 changed files with 193 additions and 48 deletions
--- a/.github/workflows/codeqltest.yml
+++ b/.github/workflows/codeqltest.yml
@@ -7,10 +7,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:

-    - name: Set up Go 1.13
+    - name: Set up Go 1.14
      uses: actions/setup-go@v1
      with:
-        go-version: 1.13
+        go-version: 1.14
      id: go

    - name: Set up CodeQL CLI
@@ -40,10 +40,10 @@ jobs:
    name: Test MacOS
    runs-on: macOS-latest
    steps:
-    - name: Set up Go 1.13
+    - name: Set up Go 1.14
      uses: actions/setup-go@v1
      with:
-        go-version: 1.13
+        go-version: 1.14
      id: go

    - name: Set up CodeQL CLI
@@ -73,10 +73,10 @@ jobs:
    name: Test Windows
    runs-on: windows-latest
    steps:
-    - name: Set up Go 1.13
+    - name: Set up Go 1.14
      uses: actions/setup-go@v1
      with:
-        go-version: 1.13
+        go-version: 1.14
      id: go

    - name: Set up CodeQL CLI
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/github/codeql-go

-go 1.13
+go 1.14

 require (
 	golang.org/x/mod v0.2.0
--- a/ql/src/semmle/go/frameworks/HTTP.qll
+++ b/ql/src/semmle/go/frameworks/HTTP.qll
@@ -19,6 +19,10 @@ private module StdlibHttp {
    HeaderGetCall() { this.getTarget().hasQualifiedName("net/http", "Header", "Get") }
  }

+  private class HeaderValuesCall extends UntrustedFlowSource::Range, DataFlow::MethodCallNode {
+    HeaderValuesCall() { this.getTarget().hasQualifiedName("net/http", "Header", "Values") }
+  }
+
  private class StdlibResponseWriter extends HTTP::ResponseWriter::Range {
    StdlibResponseWriter() { this.getType().implements("net/http", "ResponseWriter") }

--- a/ql/test/extractor-tests/go1.14/interfaces.expected
+++ b/ql/test/extractor-tests/go1.14/interfaces.expected
@@ -0,0 +1,17 @@
+| A | A | tst.go:4:2:4:2 | m |
+| AA | AA | tst.go:4:2:4:2 | m |
+| AB | AB | tst.go:4:2:4:2 | m |
+| AB | AB | tst.go:9:2:9:2 | n |
+| ABC | ABC | tst.go:4:2:4:2 | m |
+| ABC | ABC | tst.go:9:2:9:2 | n |
+| ABC | ABC | tst.go:14:2:14:2 | o |
+| AC | AC | tst.go:4:2:4:2 | m |
+| AC | AC | tst.go:13:2:13:2 | n |
+| AC | AC | tst.go:14:2:14:2 | o |
+| B | B | tst.go:8:2:8:2 | m |
+| B | B | tst.go:9:2:9:2 | n |
+| BC | BC | tst.go:8:2:8:2 | m |
+| BC | BC | tst.go:9:2:9:2 | n |
+| BC | BC | tst.go:14:2:14:2 | o |
+| C | C | tst.go:13:2:13:2 | n |
+| C | C | tst.go:14:2:14:2 | o |
--- a/ql/test/extractor-tests/go1.14/interfaces.ql
+++ b/ql/test/extractor-tests/go1.14/interfaces.ql
@@ -0,0 +1,5 @@
+import go
+
+from NamedType t
+where t.getPackage().getName().matches("%main")
+select t, t.getName(), t.getMethod(_)
--- a/ql/test/extractor-tests/go1.14/tst.go
+++ b/ql/test/extractor-tests/go1.14/tst.go
@@ -0,0 +1,44 @@
+package main
+
+type A interface {
+	m()
+}
+
+type B interface {
+	m()
+	n()
+}
+
+type C interface {
+	n()
+	o()
+}
+
+type AA interface {
+	A
+	A
+}
+
+type AB interface {
+	A
+	B
+}
+
+type BC interface {
+	B
+	C
+}
+
+type AC interface {
+	A
+	C
+}
+
+type ABC interface {
+	A
+	B
+	C
+}
+
+func main() {
+}
--- a/ql/test/library-tests/semmle/go/Scopes/DeclaredEntity.expected
+++ b/ql/test/library-tests/semmle/go/Scopes/DeclaredEntity.expected
@@ -13,10 +13,13 @@
 | types.go:7:6:7:15 | twoMethods | types.go:7:6:7:15 | twoMethods |
 | types.go:8:2:8:6 | meth1 | types.go:8:2:8:6 | meth1 |
 | types.go:9:2:9:6 | meth2 | types.go:9:2:9:6 | meth2 |
-| types.go:12:6:12:13 | starImpl | types.go:12:6:12:13 | starImpl |
-| types.go:14:18:14:22 | meth1 | types.go:14:18:14:22 | meth1 |
-| types.go:18:17:18:21 | meth2 | types.go:18:17:18:21 | meth2 |
-| types.go:22:6:22:12 | notImpl | types.go:22:6:22:12 | notImpl |
-| types.go:24:16:24:20 | meth1 | types.go:24:16:24:20 | meth1 |
-| types.go:24:22:24:22 | a | types.go:24:22:24:22 | a |
-| types.go:28:16:28:20 | meth2 | types.go:28:16:28:20 | meth2 |
+| types.go:12:6:12:15 | meth1Iface | types.go:12:6:12:15 | meth1Iface |
+| types.go:13:2:13:6 | meth1 | types.go:13:2:13:6 | meth1 |
+| types.go:16:6:16:23 | twoMethodsEmbedded | types.go:16:6:16:23 | twoMethodsEmbedded |
+| types.go:21:6:21:13 | starImpl | types.go:21:6:21:13 | starImpl |
+| types.go:23:18:23:22 | meth1 | types.go:23:18:23:22 | meth1 |
+| types.go:27:17:27:21 | meth2 | types.go:27:17:27:21 | meth2 |
+| types.go:31:6:31:12 | notImpl | types.go:31:6:31:12 | notImpl |
+| types.go:33:16:33:20 | meth1 | types.go:33:16:33:20 | meth1 |
+| types.go:33:22:33:22 | a | types.go:33:22:33:22 | a |
+| types.go:37:16:37:20 | meth2 | types.go:37:16:37:20 | meth2 |
--- a/ql/test/library-tests/semmle/go/Scopes/EntityRead.expected
+++ b/ql/test/library-tests/semmle/go/Scopes/EntityRead.expected
@@ -1,5 +1,5 @@
 | file://:0:0:0:0 | Println | main.go:10:2:10:12 | selection of Println |
-| file://:0:0:0:0 | false | types.go:15:9:15:13 | false |
+| file://:0:0:0:0 | false | types.go:24:9:24:13 | false |
 | main.go:6:2:6:2 | x | main.go:14:9:14:14 | selection of x |
 | main.go:6:2:6:2 | x | main.go:24:2:24:7 | selection of x |
 | main.go:13:7:13:10 | recv | main.go:14:9:14:12 | recv |
@@ -10,4 +10,4 @@
 | main.go:17:26:17:26 | y | main.go:20:12:20:12 | y |
 | main.go:23:7:23:10 | recv | main.go:24:2:24:5 | recv |
 | types.go:4:2:4:5 | meth | main.go:18:2:18:7 | selection of meth |
-| types.go:24:22:24:22 | a | types.go:25:9:25:9 | a |
+| types.go:33:22:33:22 | a | types.go:34:9:34:9 | a |
--- a/ql/test/library-tests/semmle/go/Scopes/EntityReference.expected
+++ b/ql/test/library-tests/semmle/go/Scopes/EntityReference.expected
@@ -1,17 +1,18 @@
 | file://:0:0:0:0 | Println | <library> | main.go:10:2:10:12 | selection of Println |
 | file://:0:0:0:0 | Println | <library> | main.go:10:6:10:12 | Println |
 | file://:0:0:0:0 | bool | <library> | types.go:8:10:8:13 | bool |
-| file://:0:0:0:0 | bool | <library> | types.go:14:26:14:29 | bool |
-| file://:0:0:0:0 | bool | <library> | types.go:24:29:24:32 | bool |
-| file://:0:0:0:0 | false | <library> | types.go:15:9:15:13 | false |
+| file://:0:0:0:0 | bool | <library> | types.go:13:10:13:13 | bool |
+| file://:0:0:0:0 | bool | <library> | types.go:23:26:23:29 | bool |
+| file://:0:0:0:0 | bool | <library> | types.go:33:29:33:32 | bool |
+| file://:0:0:0:0 | false | <library> | types.go:24:9:24:13 | false |
 | file://:0:0:0:0 | fmt | <library> | main.go:10:2:10:4 | fmt |
 | file://:0:0:0:0 | int | <library> | main.go:6:4:6:6 | int |
 | file://:0:0:0:0 | int | <library> | main.go:13:23:13:25 | int |
 | file://:0:0:0:0 | int | <library> | types.go:4:9:4:11 | int |
 | file://:0:0:0:0 | int | <library> | types.go:9:10:9:12 | int |
-| file://:0:0:0:0 | int | <library> | types.go:18:25:18:27 | int |
-| file://:0:0:0:0 | int | <library> | types.go:24:24:24:26 | int |
-| file://:0:0:0:0 | int | <library> | types.go:28:24:28:26 | int |
+| file://:0:0:0:0 | int | <library> | types.go:27:25:27:27 | int |
+| file://:0:0:0:0 | int | <library> | types.go:33:24:33:26 | int |
+| file://:0:0:0:0 | int | <library> | types.go:37:24:37:26 | int |
 | main.go:5:6:5:6 | t | main.go@5:6:5:6 | main.go:5:6:5:6 | t |
 | main.go:5:6:5:6 | t | main.go@5:6:5:6 | main.go:13:13:13:13 | t |
 | main.go:5:6:5:6 | t | main.go@5:6:5:6 | main.go:17:29:17:29 | t |
@@ -45,17 +46,22 @@
 | types.go:4:2:4:5 | meth | types.go@4:2:4:5 | main.go:18:4:18:7 | meth |
 | types.go:4:2:4:5 | meth | types.go@4:2:4:5 | types.go:4:2:4:5 | meth |
 | types.go:7:6:7:15 | twoMethods | types.go@7:6:7:15 | types.go:7:6:7:15 | twoMethods |
+| types.go:7:6:7:15 | twoMethods | types.go@7:6:7:15 | types.go:18:2:18:11 | twoMethods |
 | types.go:8:2:8:6 | meth1 | types.go@8:2:8:6 | types.go:8:2:8:6 | meth1 |
 | types.go:9:2:9:6 | meth2 | types.go@9:2:9:6 | types.go:9:2:9:6 | meth2 |
-| types.go:12:6:12:13 | starImpl | types.go@12:6:12:13 | types.go:12:6:12:13 | starImpl |
-| types.go:12:6:12:13 | starImpl | types.go@12:6:12:13 | types.go:14:8:14:15 | starImpl |
-| types.go:12:6:12:13 | starImpl | types.go@12:6:12:13 | types.go:18:7:18:14 | starImpl |
-| types.go:14:18:14:22 | meth1 | types.go@14:18:14:22 | types.go:14:18:14:22 | meth1 |
-| types.go:18:17:18:21 | meth2 | types.go@18:17:18:21 | types.go:18:17:18:21 | meth2 |
-| types.go:22:6:22:12 | notImpl | types.go@22:6:22:12 | types.go:22:6:22:12 | notImpl |
-| types.go:22:6:22:12 | notImpl | types.go@22:6:22:12 | types.go:24:7:24:13 | notImpl |
-| types.go:22:6:22:12 | notImpl | types.go@22:6:22:12 | types.go:28:7:28:13 | notImpl |
-| types.go:24:16:24:20 | meth1 | types.go@24:16:24:20 | types.go:24:16:24:20 | meth1 |
-| types.go:24:22:24:22 | a | types.go@24:22:24:22 | types.go:24:22:24:22 | a |
-| types.go:24:22:24:22 | a | types.go@24:22:24:22 | types.go:25:9:25:9 | a |
-| types.go:28:16:28:20 | meth2 | types.go@28:16:28:20 | types.go:28:16:28:20 | meth2 |
+| types.go:12:6:12:15 | meth1Iface | types.go@12:6:12:15 | types.go:12:6:12:15 | meth1Iface |
+| types.go:12:6:12:15 | meth1Iface | types.go@12:6:12:15 | types.go:17:2:17:11 | meth1Iface |
+| types.go:13:2:13:6 | meth1 | types.go@13:2:13:6 | types.go:13:2:13:6 | meth1 |
+| types.go:16:6:16:23 | twoMethodsEmbedded | types.go@16:6:16:23 | types.go:16:6:16:23 | twoMethodsEmbedded |
+| types.go:21:6:21:13 | starImpl | types.go@21:6:21:13 | types.go:21:6:21:13 | starImpl |
+| types.go:21:6:21:13 | starImpl | types.go@21:6:21:13 | types.go:23:8:23:15 | starImpl |
+| types.go:21:6:21:13 | starImpl | types.go@21:6:21:13 | types.go:27:7:27:14 | starImpl |
+| types.go:23:18:23:22 | meth1 | types.go@23:18:23:22 | types.go:23:18:23:22 | meth1 |
+| types.go:27:17:27:21 | meth2 | types.go@27:17:27:21 | types.go:27:17:27:21 | meth2 |
+| types.go:31:6:31:12 | notImpl | types.go@31:6:31:12 | types.go:31:6:31:12 | notImpl |
+| types.go:31:6:31:12 | notImpl | types.go@31:6:31:12 | types.go:33:7:33:13 | notImpl |
+| types.go:31:6:31:12 | notImpl | types.go@31:6:31:12 | types.go:37:7:37:13 | notImpl |
+| types.go:33:16:33:20 | meth1 | types.go@33:16:33:20 | types.go:33:16:33:20 | meth1 |
+| types.go:33:22:33:22 | a | types.go@33:22:33:22 | types.go:33:22:33:22 | a |
+| types.go:33:22:33:22 | a | types.go@33:22:33:22 | types.go:34:9:34:9 | a |
+| types.go:37:16:37:20 | meth2 | types.go@37:16:37:20 | types.go:37:16:37:20 | meth2 |
--- a/ql/test/library-tests/semmle/go/Scopes/EntityType.expected
+++ b/ql/test/library-tests/semmle/go/Scopes/EntityType.expected
@@ -13,10 +13,13 @@
 | types.go:7:6:7:15 | twoMethods | twoMethods |
 | types.go:8:2:8:6 | meth1 | func() bool |
 | types.go:9:2:9:6 | meth2 | func() int |
-| types.go:12:6:12:13 | starImpl | starImpl |
-| types.go:14:18:14:22 | meth1 | func() bool |
-| types.go:18:17:18:21 | meth2 | func() int |
-| types.go:22:6:22:12 | notImpl | notImpl |
-| types.go:24:16:24:20 | meth1 | func(int) bool |
-| types.go:24:22:24:22 | a | int |
-| types.go:28:16:28:20 | meth2 | func() int |
+| types.go:12:6:12:15 | meth1Iface | meth1Iface |
+| types.go:13:2:13:6 | meth1 | func() bool |
+| types.go:16:6:16:23 | twoMethodsEmbedded | twoMethodsEmbedded |
+| types.go:21:6:21:13 | starImpl | starImpl |
+| types.go:23:18:23:22 | meth1 | func() bool |
+| types.go:27:17:27:21 | meth2 | func() int |
+| types.go:31:6:31:12 | notImpl | notImpl |
+| types.go:33:16:33:20 | meth1 | func(int) bool |
+| types.go:33:22:33:22 | a | int |
+| types.go:37:16:37:20 | meth2 | func() int |
--- a/ql/test/library-tests/semmle/go/Scopes/EntityWrite.expected
+++ b/ql/test/library-tests/semmle/go/Scopes/EntityWrite.expected
@@ -3,4 +3,4 @@
 | main.go:17:10:17:10 | x | main.go:17:10:17:10 | initialization of x |
 | main.go:17:26:17:26 | y | main.go:17:26:17:26 | initialization of y |
 | main.go:23:7:23:10 | recv | main.go:23:7:23:10 | initialization of recv |
-| types.go:24:22:24:22 | a | types.go:24:22:24:22 | initialization of a |
+| types.go:33:22:33:22 | a | types.go:33:22:33:22 | initialization of a |
--- a/ql/test/library-tests/semmle/go/Scopes/MethodImplements.expected
+++ b/ql/test/library-tests/semmle/go/Scopes/MethodImplements.expected
@@ -1,6 +1,10 @@
 | iHaveAMethod | meth | iHaveAMethod | meth |
+| meth1Iface | meth1 | meth1Iface | meth1 |
+| meth1Iface | meth1 | twoMethods | meth1 |
 | pointer type | meth | iHaveAMethod | meth |
+| pointer type | meth1 | meth1Iface | meth1 |
 | pointer type | meth1 | twoMethods | meth1 |
 | starImpl | meth2 | twoMethods | meth2 |
+| twoMethods | meth1 | meth1Iface | meth1 |
 | twoMethods | meth1 | twoMethods | meth1 |
 | twoMethods | meth2 | twoMethods | meth2 |
--- a/ql/test/library-tests/semmle/go/Scopes/MethodImplementsName.expected
+++ b/ql/test/library-tests/semmle/go/Scopes/MethodImplementsName.expected
@@ -1,6 +1,15 @@
 | iHaveAMethod | meth | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | iHaveAMethod | meth |
+| meth1Iface | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | meth1Iface | meth1 |
+| meth1Iface | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethods | meth1 |
+| meth1Iface | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethodsEmbedded | meth1 |
 | pointer type | meth | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | iHaveAMethod | meth |
+| pointer type | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | meth1Iface | meth1 |
 | pointer type | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethods | meth1 |
+| pointer type | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethodsEmbedded | meth1 |
 | starImpl | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethods | meth2 |
+| starImpl | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethodsEmbedded | meth2 |
+| twoMethods | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | meth1Iface | meth1 |
 | twoMethods | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethods | meth1 |
+| twoMethods | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethodsEmbedded | meth1 |
 | twoMethods | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethods | meth2 |
+| twoMethods | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes | twoMethodsEmbedded | meth2 |
--- a/ql/test/library-tests/semmle/go/Scopes/Methods.expected
+++ b/ql/test/library-tests/semmle/go/Scopes/Methods.expected
@@ -3,7 +3,10 @@
 | types.go:4:2:4:5 | meth | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.iHaveAMethod.meth | file://:0:0:0:0 |  | iHaveAMethod |
 | types.go:8:2:8:6 | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.twoMethods.meth1 | file://:0:0:0:0 |  | twoMethods |
 | types.go:9:2:9:6 | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.twoMethods.meth2 | file://:0:0:0:0 |  | twoMethods |
-| types.go:14:18:14:22 | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.starImpl.meth1 | file://:0:0:0:0 |  | * starImpl |
-| types.go:18:17:18:21 | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.starImpl.meth2 | file://:0:0:0:0 |  | starImpl |
-| types.go:24:16:24:20 | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.notImpl.meth1 | file://:0:0:0:0 |  | notImpl |
-| types.go:28:16:28:20 | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.notImpl.meth2 | file://:0:0:0:0 |  | notImpl |
+| types.go:9:2:9:6 | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.twoMethodsEmbedded.meth2 | file://:0:0:0:0 |  | twoMethods |
+| types.go:13:2:13:6 | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.meth1Iface.meth1 | file://:0:0:0:0 |  | meth1Iface |
+| types.go:13:2:13:6 | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.twoMethodsEmbedded.meth1 | file://:0:0:0:0 |  | meth1Iface |
+| types.go:23:18:23:22 | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.starImpl.meth1 | file://:0:0:0:0 |  | * starImpl |
+| types.go:27:17:27:21 | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.starImpl.meth2 | file://:0:0:0:0 |  | starImpl |
+| types.go:33:16:33:20 | meth1 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.notImpl.meth1 | file://:0:0:0:0 |  | notImpl |
+| types.go:37:16:37:20 | meth2 | github.com/github/codeql-go/ql/test/library-tests/semmle/go/Scopes.notImpl.meth2 | file://:0:0:0:0 |  | notImpl |
--- a/ql/test/library-tests/semmle/go/Scopes/TypeImplements.expected
+++ b/ql/test/library-tests/semmle/go/Scopes/TypeImplements.expected
@@ -1,6 +1,17 @@
+| * starImpl | meth1Iface |
 | * starImpl | twoMethods |
+| * starImpl | twoMethodsEmbedded |
 | * t | iHaveAMethod |
 | iHaveAMethod | iHaveAMethod |
+| interface { meth1 func() bool } | meth1Iface |
+| interface { meth1 func() bool; meth2 func() int } | meth1Iface |
 | interface { meth1 func() bool; meth2 func() int } | twoMethods |
+| interface { meth1 func() bool; meth2 func() int } | twoMethodsEmbedded |
 | interface { meth func() int } | iHaveAMethod |
+| meth1Iface | meth1Iface |
+| twoMethods | meth1Iface |
 | twoMethods | twoMethods |
+| twoMethods | twoMethodsEmbedded |
+| twoMethodsEmbedded | meth1Iface |
+| twoMethodsEmbedded | twoMethods |
+| twoMethodsEmbedded | twoMethodsEmbedded |
--- a/ql/test/library-tests/semmle/go/Scopes/types.go
+++ b/ql/test/library-tests/semmle/go/Scopes/types.go
@@ -9,6 +9,15 @@ type twoMethods interface {
 	meth2() int
 }

+type meth1Iface interface {
+	meth1() bool
+}
+
+type twoMethodsEmbedded interface {
+	meth1Iface
+	twoMethods
+}
+
 type starImpl struct{}

 func (*starImpl) meth1() bool {
--- a/ql/test/library-tests/semmle/go/frameworks/HTTP/Header.expected
+++ b/ql/test/library-tests/semmle/go/frameworks/HTTP/Header.expected
@@ -2,7 +2,7 @@
 | main.go:31:2:31:51 | call to Set | "Authorization" | "Basic example:example" | authorization | Basic example:example |
 | main.go:32:2:32:26 | call to Add | "Age" | "342232" | age | 342232 |
 | main.go:34:2:34:55 | call to Add | server | call to Sprintf | n/a | n/a |
-| main.go:35:2:35:36 | call to Set | LOC_HEADER | ...+... | n/a | n/a |
+| main.go:35:2:35:45 | call to Set | LOC_HEADER | ...+... | n/a | n/a |
 | main.go:36:2:36:5 | head | "Unknown-Header" | composite literal | n/a | n/a |
 | main.go:48:2:48:43 | call to Add | "Not-A-Response" | "Header" | not-a-response | Header |
 | main.go:49:2:49:42 | call to Set | "Accept" | "nota/response" | accept | nota/response |
--- a/ql/test/library-tests/semmle/go/frameworks/HTTP/UntrustedFlowSources.expected
+++ b/ql/test/library-tests/semmle/go/frameworks/HTTP/UntrustedFlowSources.expected
@@ -9,3 +9,9 @@
 | main.go:48:2:48:11 | selection of Header |
 | main.go:49:2:49:11 | selection of Header |
 | main.go:50:2:50:11 | selection of Header |
+| server.go:8:6:8:13 | selection of Header |
+| server.go:9:6:9:13 | selection of Header |
+| server.go:9:6:9:38 | call to Values |
+| server.go:10:6:10:13 | selection of Header |
+| server.go:10:6:10:35 | call to Get |
+| server.go:13:6:13:11 | selection of Body |
--- a/ql/test/library-tests/semmle/go/frameworks/HTTP/main.go
+++ b/ql/test/library-tests/semmle/go/frameworks/HTTP/main.go
@@ -32,7 +32,7 @@ func handler(w http.ResponseWriter, r *http.Request) {
 	head.Add("Age", "342232")
 	server := "Server"
 	head.Add(server, fmt.Sprintf("Server: %s", "example"))
-	head.Set(LOC_HEADER, rfs4+"/redir")
+	head.Set(LOC_HEADER, rfs4.String()+"/redir")
 	head["Unknown-Header"] = []string{"Some value!"}

 	w.Write([]byte("Some more body text\n"))
--- a/ql/test/library-tests/semmle/go/frameworks/HTTP/server.go
+++ b/ql/test/library-tests/semmle/go/frameworks/HTTP/server.go
@@ -0,0 +1,19 @@
+package main
+
+import (
+	"net/http"
+)
+
+func Handler(r *http.Request) {
+	use(r.Header)
+	use(r.Header.Values("X-Forwarded-By"))
+	use(r.Header.Get("Authentication"))
+
+	buf := make([]byte, 100)
+	use(r.Body.Read(buf))
+	body, err := r.GetBody()
+	if err != nil {
+		return
+	}
+	use(body.Read(buf))
+}
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,9 +1,11 @@
 # golang.org/x/mod v0.2.0
+## explicit
 golang.org/x/mod/internal/lazyregexp
 golang.org/x/mod/modfile
 golang.org/x/mod/module
 golang.org/x/mod/semver
 # golang.org/x/tools v0.0.0-20200302225559-9b52d559c609
+## explicit
 golang.org/x/tools/go/gcexportdata
 golang.org/x/tools/go/internal/gcimporter
 golang.org/x/tools/go/internal/packagesdriver