Commit Graph

4 Commits

Author SHA1 Message Date
Owen Mansel-Chan
40768332d8 Remove empty imports from stubs 2025-03-20 12:32:12 +00:00
Owen Mansel-Chan
81e85010f9 List subpackages in vendor/modules.txt
These were all generated by running depstubber.
2025-03-20 12:30:57 +00:00
Chris Smowton
0c6c135967 Go: exclude protobuf read steps from cleartext-logging query
This query already treats structs differently to usual: it includes field -> whole struct taint steps, but explicitly excludes struct -> field steps. This means that a logging framework sinking an entire struct with a tainted field yields an alert, but we don't get FPs caused by writing field `x` but then reading field `y`.

However, protobuf messages have a special treatment, with taint usually associated with the whole struct and getter methods propagating that taint out. Suppressing these getter method steps specifically for the cleartext-logging query mirrors its treatment of structs in general and avoids this sort of field-mismatch FP.

On the downside we will miss same-field propagation like `m.field = password; Log(m.GetField())` if we don't have source code for the implementation of `m`. However this is hopefully unusual since the typical use of protobufs is to serialize and deserialize, rather than using the struct as a general-purpose datastructure.
2022-10-29 11:40:57 +01:00
Chuan-kai Lin
aa514fff32 codeql-go merge prep: move into go/ directory 2022-05-20 10:07:19 -07:00