Go: convert all qlref tests to inline expectation tests using postprocessing#21965
Open
owen-mc wants to merge 4 commits into
Open
Go: convert all qlref tests to inline expectation tests using postprocessing#21965owen-mc wants to merge 4 commits into
owen-mc wants to merge 4 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Go CodeQL test suite to use inline expectation comments (for example // $ Alert[...], // $ Source[...], // $ Sink[...]) validated via the utils/test/InlineExpectationsTestQuery.ql postprocessor, and adjusts many .qlref files accordingly (often converting postprocess: from a scalar to a YAML list so multiple postprocessors can be applied).
Changes:
- Add inline expectation markers to many Go query-test and library-test
.gofiles. - Update
.qlreffiles to runInlineExpectationsTestQuery.ql(often in addition toPrettyPrintModels.ql). - Update a small number of
.expectedfiles to reflect line-number shifts / updated comment parsing.
Show a summary per file
| File | Description |
|---|---|
| go/ql/test/query-tests/Security/CWE-798/sanitizer.go | Add inline $ Alert[go/hardcoded-credentials] marker. |
| go/ql/test/query-tests/Security/CWE-798/main.go | Add inline $ Alert[go/hardcoded-credentials] marker. |
| go/ql/test/query-tests/Security/CWE-798/jwt.go | Add inline $ Alert[go/hardcoded-credentials] markers. |
| go/ql/test/query-tests/Security/CWE-798/HardcodedKeysBad.go | Add inline $ Alert[go/hardcoded-credentials] marker. |
| go/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.go | Add inline $ Alert[go/hardcoded-credentials] marker. |
| go/ql/test/query-tests/Security/CWE-798/AlertSuppressionExample.go | Add inline $ Alert[...] marker while preserving lgtm[...] suppression comment. |
| go/ql/test/query-tests/Security/CWE-643/XPathInjection.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-643/XPathInjection.go | Add $ Source[...] / $ Alert[...] markers for xpath injection flow. |
| go/ql/test/query-tests/Security/CWE-643/tst.go | Add $ Source[...] / $ Alert[...] markers for xpath injection cases. |
| go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/main.go | Add $ Source[...] / $ Sink[...] / $ Alert[...] markers for redirect checks. |
| go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/cves.go | Add inline markers for redirect check CVE examples. |
| go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/BadRedirectCheck.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/BadRedirectCheck.go | Add inline markers for redirect sanitizer example. |
| go/ql/test/query-tests/Security/CWE-352/ConstantOauth2State.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-352/ConstantOauth2State.go | Add $ Source / $ Alert markers for constant OAuth2 state. |
| go/ql/test/query-tests/Security/CWE-347/MissingJwtSignatureCheck.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-347/golang-jwt-v5.go | Add $ Source[...] / $ Alert[...] markers for unverified parse. |
| go/ql/test/query-tests/Security/CWE-347/go-jose.v3.go | Add $ Source[...] / $ Alert[...] markers for unsafe claims usage. |
| go/ql/test/query-tests/Security/CWE-338/InsecureRandomness/sample.go | Add $ Source[...] / $ Alert[...] markers for insecure randomness flow. |
| go/ql/test/query-tests/Security/CWE-338/InsecureRandomness/InsecureRandomness.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-338/InsecureRandomness/InsecureRandomness.go | Add $ Alert[...] marker for weak RNG password generation. |
| go/ql/test/query-tests/Security/CWE-327/UnsafeTLS.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-327/UnsafeTLS.go | Add $ Source[...] / $ Alert[...] markers for insecure TLS settings. |
| go/ql/test/query-tests/Security/CWE-326/InsufficientKeySize.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-326/InsufficientKeySize.go | Add $ Source / $ Alert markers for insufficient RSA key sizes. |
| go/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallbackExample.go | Add inline markers for insecure HostKeyCallback query tests (some markers appear inconsistent with existing expected results). |
| go/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallback.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-295/DisabledCertificateCheck/main.go | Add $ Alert markers for InsecureSkipVerify. |
| go/ql/test/query-tests/Security/CWE-295/DisabledCertificateCheck/DisabledCertificateCheck.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-295/DisabledCertificateCheck/DisabledCertificateCheck.go | Add $ Alert markers for InsecureSkipVerify transport. |
| go/ql/test/query-tests/Security/CWE-209/test.go | Add $ Source / $ Alert markers for stack trace exposure. |
| go/ql/test/query-tests/Security/CWE-209/StackTraceExposure.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-190/tst3.go | Add $ Source[...] / $ Alert[...] markers for allocation size overflow cases. |
| go/ql/test/query-tests/Security/CWE-190/tst2.go | Add $ Source[...] / $ Alert[...] markers for allocation size overflow cases. |
| go/ql/test/query-tests/Security/CWE-190/tst.go | Add $ Source[...] / $ Alert[...] markers for allocation size overflow cases. |
| go/ql/test/query-tests/Security/CWE-190/AllocationSizeOverflow.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-190/AllocationSizeOverflow.go | Add $ Source[...] / $ Alert[...] markers for computed allocation size. |
| go/ql/test/query-tests/Security/CWE-089/StringBreakMismatched.go | Reorder imports and add $ Source[...] / $ Alert[...] markers. |
| go/ql/test/query-tests/Security/CWE-089/StringBreak.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-089/StringBreak.go | Add $ Source[...] / $ Alert[...] markers for unsafe quoting. |
| go/ql/test/query-tests/Security/CWE-089/StringBreak.expected | Update expected locations to match line shifts. |
| go/ql/test/query-tests/Security/CWE-089/SqlInjection.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-089/SqlInjection.go | Add $ Source[...] / $ Alert[...] markers for SQL injection. |
| go/ql/test/query-tests/Security/CWE-089/mongoDB.go | Add $ Source[...] / $ Alert[...] markers for MongoDB API test coverage. |
| go/ql/test/query-tests/Security/CWE-089/main.go | Add $ Source[...] / $ Alert[...] markers for SQL injection examples. |
| go/ql/test/query-tests/Security/CWE-089/issue48.go | Add $ Source[...] / $ Alert[...] markers for SQL injection issue reproduction. |
| go/ql/test/query-tests/Security/CWE-078/StoredCommand.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-078/StoredCommand.go | Add $ Source[...] / $ Alert[...] markers for stored command execution. |
| go/ql/test/query-tests/Security/CWE-078/SanitizingDoubleDash.go | Add $ Source[...] / $ Alert[...] markers for command injection cases. |
| go/ql/test/query-tests/Security/CWE-078/GitSubcommands.go | Add $ Source[...] / $ Alert[...] markers for vulnerable git subcommands. |
| go/ql/test/query-tests/Security/CWE-078/CommandInjection2.go | Add $ Source[...] / $ Alert[...] markers for shell command injection examples. |
| go/ql/test/query-tests/Security/CWE-078/CommandInjection.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-078/CommandInjection.go | Add $ Source[...] / $ Alert[...] markers for command injection. |
| go/ql/test/query-tests/Security/CWE-078/ArgumentInjection.go | Add $ Source[...] / $ Alert[...] markers for argument injection. |
| go/ql/test/query-tests/Security/CWE-022/ZipSlip.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-022/ZipSlip.go | Add $ Sink[...] / $ Alert[...] markers for ZipSlip. |
| go/ql/test/query-tests/Security/CWE-022/UnsafeUnzipSymlinkGood.go | Add $ Sink[...] / $ Alert[...] markers for ZipSlip-related sanitization. |
| go/ql/test/query-tests/Security/CWE-022/UnsafeUnzipSymlink.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-022/UnsafeUnzipSymlink.go | Add $ Sink[...] / $ Alert[...] markers for unsafe symlink writes. |
| go/ql/test/query-tests/Security/CWE-022/tst.go | Add $ Sink[...] / $ Alert[...] markers for ZipSlip variants. |
| go/ql/test/query-tests/Security/CWE-022/tarslip.go | Add $ Sink[...] / $ Alert[...] markers for tar slip. |
| go/ql/test/query-tests/Security/CWE-022/TaintedPath.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-022/TaintedPath.go | Add $ Source[...] / $ Alert[...] markers for path injection. |
| go/ql/test/query-tests/Security/CWE-022/GorillaMuxSkipClean/TaintedPath.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-022/GorillaMuxSkipClean/MuxClean.go | Add $ Source[...] / $ Alert[...] markers for Gorilla mux SkipClean case. |
| go/ql/test/query-tests/Security/CWE-022/GorillaMuxDefault/TaintedPath.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-020/SuspiciousCharacterInRegexp/test.go | Add $ Alert[...] markers for suspicious regex escapes. |
| go/ql/test/query-tests/Security/CWE-020/SuspiciousCharacterInRegexp/SuspiciousCharacterInRegexp.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-020/SuspiciousCharacterInRegexp/SuspiciousCharacterInRegexp.go | Add $ Alert[...] marker for suspicious regex escape in compiled regex. |
| go/ql/test/query-tests/Security/CWE-020/MissingRegexpAnchor/MissingRegexpAnchor.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-020/MissingRegexpAnchor/MissingRegexpAnchor.go | Add $ Alert marker for missing regexp anchor. |
| go/ql/test/query-tests/Security/CWE-020/MissingRegexpAnchor/main.go | Add $ Alert markers for missing anchor examples. |
| go/ql/test/query-tests/Security/CWE-020/IncompleteUrlSchemeCheck/main.go | Add $ Alert marker for incomplete URL scheme check. |
| go/ql/test/query-tests/Security/CWE-020/IncompleteUrlSchemeCheck/IncompleteUrlSchemeCheck.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-020/IncompleteUrlSchemeCheck/IncompleteUrlSchemeCheck.go | Add $ Alert marker for javascript scheme check. |
| go/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegexp/main.go | Add $ Source[...] / $ Sink[...] / $ Alert[...] markers for hostname regexp. |
| go/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegexp/IncompleteHostnameRegexp.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegexp/IncompleteHostnameRegexp.go | Add $ Alert[...] / $ Sink[...] markers for incomplete hostname regexp. |
| go/ql/test/query-tests/RedundantCode/UnreachableStatement/UnreachableStatement.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/UnreachableStatement/UnreachableStatement.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/UnreachableStatement/main.go | Add $ Alert markers for unreachable statement examples. |
| go/ql/test/query-tests/RedundantCode/ShiftOutOfRange/ShiftOutOfRange.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/ShiftOutOfRange/ShiftOutOfRange.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/ShiftOutOfRange/main.go | Add $ Alert markers for shift-out-of-range examples. |
| go/ql/test/query-tests/RedundantCode/SelfAssignment/tst.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/SelfAssignment/SelfAssignment.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/SelfAssignment/SelfAssignment.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/RedundantRecover/tst.go | Add $ Alert[...] marker. |
| go/ql/test/query-tests/RedundantCode/RedundantRecover/RedundantRecover2.go | Add $ Alert[...] marker. |
| go/ql/test/query-tests/RedundantCode/RedundantRecover/RedundantRecover1.go | Add $ Alert[...] marker. |
| go/ql/test/query-tests/RedundantCode/RedundantRecover/RedundantRecover.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/RedundantExpr/tst.go | Add $ Alert[...] marker. |
| go/ql/test/query-tests/RedundantCode/RedundantExpr/RedundantExpr.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/RedundantExpr/RedundantExpr.go | Add $ Alert[...] marker. |
| go/ql/test/query-tests/RedundantCode/NegativeLengthCheck/NegativeLengthCheck.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/NegativeLengthCheck/NegativeLengthCheck.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/NegativeLengthCheck/main.go | Add $ Alert markers for negative-length comparisons. |
| go/ql/test/query-tests/RedundantCode/ImpossibleInterfaceNilCheck/tst.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/ImpossibleInterfaceNilCheck/ImpossibleInterfaceNilCheck.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/ImpossibleInterfaceNilCheck/ImpossibleInterfaceNilCheck.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/ExprHasNoEffect/main.go | Add $ Alert markers for no-effect expressions. |
| go/ql/test/query-tests/RedundantCode/ExprHasNoEffect/ExprHasNoEffect.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/ExprHasNoEffect/ExprHasNoEffect.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/DuplicateSwitchCase/tst.go | Add $ Alert[...] marker. |
| go/ql/test/query-tests/RedundantCode/DuplicateSwitchCase/DuplicateSwitchCase.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/DuplicateSwitchCase/DuplicateSwitchCase.go | Add $ Alert[...] marker. |
| go/ql/test/query-tests/RedundantCode/DuplicateCondition/tst.go | Add $ Source / $ Alert markers. |
| go/ql/test/query-tests/RedundantCode/DuplicateCondition/DuplicateCondition.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/DuplicateCondition/DuplicateCondition.go | Add $ Source / $ Alert markers. |
| go/ql/test/query-tests/RedundantCode/DuplicateBranches/main.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/DuplicateBranches/DuplicateBranches.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/DuplicateBranches/DuplicateBranches.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/DeadStoreOfLocal/testdata.go | Add $ Alert[...] markers for useless assignments. |
| go/ql/test/query-tests/RedundantCode/DeadStoreOfLocal/main.go | Add $ Alert[...] marker. |
| go/ql/test/query-tests/RedundantCode/DeadStoreOfLocal/DeadStoreOfLocal.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/DeadStoreOfField/DeadStoreOfField.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/DeadStoreOfField/DeadStoreOfField.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/CompareIdenticalValues/vp.go | Add $ Alert marker. |
| go/ql/test/query-tests/RedundantCode/CompareIdenticalValues/tst.go | Add $ Alert markers. |
| go/ql/test/query-tests/RedundantCode/CompareIdenticalValues/CompareIdenticalValues.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/RedundantCode/CompareIdenticalValues/CompareIdenticalValues.go | Add $ Alert marker. |
| go/ql/test/query-tests/InconsistentCode/WrappedErrorAlwaysNil/WrappedErrorAlwaysNil.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/InconsistentCode/WrappedErrorAlwaysNil/WrappedErrorAlwaysNil.go | Add $ Alert markers. |
| go/ql/test/query-tests/InconsistentCode/WhitespaceContradictsPrecedence/WhitespaceContradictsPrecedence.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/InconsistentCode/WhitespaceContradictsPrecedence/WhitespaceContradictsPrecedence.go | Add $ Alert marker. |
| go/ql/test/query-tests/InconsistentCode/WhitespaceContradictsPrecedence/main.go | Add $ Alert markers and whitespace adjustment. |
| go/ql/test/query-tests/InconsistentCode/MistypedExponentiation/MistypedExponentiation.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/InconsistentCode/MistypedExponentiation/MistypedExponentiation.go | Add $ Alert marker. |
| go/ql/test/query-tests/InconsistentCode/MistypedExponentiation/main.go | Add $ Alert markers. |
| go/ql/test/query-tests/InconsistentCode/MissingErrorCheck/tests.go | Add $ Alert[...] markers. |
| go/ql/test/query-tests/InconsistentCode/MissingErrorCheck/MissingErrorCheck.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/InconsistentCode/LengthComparisonOffByOne/main.go | Add $ Alert / $ Source markers. |
| go/ql/test/query-tests/InconsistentCode/LengthComparisonOffByOne/LengthComparisonOffByOne.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/InconsistentCode/LengthComparisonOffByOne/LengthComparisonOffByOne.go | Add $ Alert / $ Source markers. |
| go/ql/test/query-tests/InconsistentCode/InconsistentLoopOrientation/main.go | Add $ Alert markers. |
| go/ql/test/query-tests/InconsistentCode/InconsistentLoopOrientation/InconsistentLoopOrientation.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/InconsistentCode/InconsistentLoopOrientation/InconsistentLoopOrientation.go | Add $ Alert marker. |
| go/ql/test/query-tests/InconsistentCode/ConstantLengthComparison/ConstantLengthComparison.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/query-tests/InconsistentCode/ConstantLengthComparison/ConstantLengthComparison.go | Add $ Alert marker. |
| go/ql/test/library-tests/semmle/go/frameworks/XNetHtml/test.go | Add $ Source[...] / $ Alert[...] markers for XSS and SQL injection. |
| go/ql/test/library-tests/semmle/go/frameworks/XNetHtml/SqlInjection.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/XNetHtml/ReflectedXss.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/Twirp/tests.ql | Adjust parsing to ignore trailing $ ... inline markers in test: comments. |
| go/ql/test/library-tests/semmle/go/frameworks/Twirp/tests.expected | Update expected ranges affected by changed comment parsing. |
| go/ql/test/library-tests/semmle/go/frameworks/Twirp/server/main.go | Add $ Source[...] / $ Alert[...] markers without breaking test: comment parsing. |
| go/ql/test/library-tests/semmle/go/frameworks/Twirp/rpc/notes/service.twirp.go | Add $ Source[...] marker on request body read. |
| go/ql/test/library-tests/semmle/go/frameworks/Twirp/RequestForgery.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/Revel/TaintedPath.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/Revel/Revel.go | Add inline expectation markers alongside existing $ responsebody=... annotations. |
| go/ql/test/library-tests/semmle/go/frameworks/Revel/ReflectedXss.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/Revel/OpenRedirect.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/Revel/examples/booking/app/init.go | Add inline markers for reflected XSS in HTTP mux handlers. |
| go/ql/test/library-tests/semmle/go/frameworks/Revel/EndToEnd.go | Add $ Source[...] / $ Alert[...] markers for multiple query scenarios. |
| go/ql/test/library-tests/semmle/go/frameworks/GoMicro/main.go | Add inline markers for log injection example. |
| go/ql/test/library-tests/semmle/go/frameworks/GoMicro/LogInjection.qlref | Convert to YAML .qlref and enable inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/Echo/test.go | Add $ Source[...] / $ Alert[...] markers for XSS/open redirect/path injection. |
| go/ql/test/library-tests/semmle/go/frameworks/Echo/TaintedPath.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/Echo/ReflectedXss.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/Echo/OpenRedirect.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/Chi/test.go | Add $ Source[...] / $ Alert[...] markers for reflected XSS. |
| go/ql/test/library-tests/semmle/go/frameworks/Chi/ReflectedXss.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/BeegoOrm/test.go | Add $ Source[...] / $ Alert[...] markers for SQL injection and stored XSS. |
| go/ql/test/library-tests/semmle/go/frameworks/BeegoOrm/StoredXss.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/library-tests/semmle/go/frameworks/BeegoOrm/SqlInjection.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/experimental/Unsafe/WrongUsageOfUnsafe.qlref | Enable inline-expectations postprocess. |
| go/ql/test/experimental/Unsafe/WrongUsageOfUnsafe.go | Add inline markers (some appear inconsistent with current expected results). |
| go/ql/test/experimental/InconsistentCode/test.go | Add $ Alert[...] markers for experimental inconsistent-code examples. |
| go/ql/test/experimental/InconsistentCode/GORMErrorNotChecked.qlref | Enable inline-expectations postprocess. |
| go/ql/test/experimental/InconsistentCode/GORMErrorNotChecked.go | Add $ Alert[...] marker. |
| go/ql/test/experimental/InconsistentCode/DeferInLoop.qlref | Enable inline-expectations postprocess. |
| go/ql/test/experimental/InconsistentCode/DeferInLoop.go | Add $ Alert[...] marker. |
| go/ql/test/experimental/CWE-840/ConditionalBypassBad.go | Add $ Alert[...] marker. |
| go/ql/test/experimental/CWE-840/ConditionalBypass.qlref | Enable inline-expectations postprocess. |
| go/ql/test/experimental/CWE-840/condition.go | Add $ Alert[...] markers. |
| go/ql/test/experimental/CWE-807/SensitiveConditionBypassBad.go | Add $ Alert[...] marker. |
| go/ql/test/experimental/CWE-807/SensitiveConditionBypass.qlref | Enable inline-expectations postprocess. |
| go/ql/test/experimental/CWE-807/condition.go | Add $ Alert[...] markers. |
| go/ql/test/experimental/CWE-74/DsnInjectionLocal.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/experimental/CWE-74/DsnInjection.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/experimental/CWE-74/Dsn.go | Add $ Source[...] / $ Alert[...] markers for DSN injection flows. |
| go/ql/test/experimental/CWE-525/WebCacheDeceptionHTTPRouter.go | Add $ Alert[...] marker. |
| go/ql/test/experimental/CWE-525/WebCacheDeceptionGoChi.go | Add $ Alert[...] marker. |
| go/ql/test/experimental/CWE-525/WebCacheDeceptionFiber.go | Add $ Alert[...] markers. |
| go/ql/test/experimental/CWE-525/WebCacheDeceptionBad.go | Add $ Alert[...] marker. |
| go/ql/test/experimental/CWE-525/WebCacheDeception.qlref | Enable inline-expectations postprocess. |
| go/ql/test/experimental/CWE-522-DecompressionBombs/test.go | Add $ Source[...] / $ Alert[...] markers for decompression bomb flows. |
| go/ql/test/experimental/CWE-522-DecompressionBombs/DecompressionBombs.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/experimental/CWE-400/test.go | Add inline markers for database-call-in-loop examples (including block-end markers). |
| go/ql/test/experimental/CWE-400/DatabaseCallInLoop.qlref | Enable inline-expectations postprocess. |
| go/ql/test/experimental/CWE-400/DatabaseCallInLoop.go | Add $ Source[...] / $ Alert[...] markers for DB call in loop. |
| go/ql/test/experimental/CWE-369/DivideByZero.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/experimental/CWE-369/DivideByZero.go | Add $ Source[...] / $ Alert[...] markers for divide-by-zero examples. |
| go/ql/test/experimental/CWE-321-V2/HardCodedKeys.qlref | Enable inline-expectations postprocess. |
| go/ql/test/experimental/CWE-321-V2/golang-jwt-v5.go | Add $ Source[...] / $ Alert[...] markers for hardcoded key JWT parsing. |
| go/ql/test/experimental/CWE-321-V2/go-jose.v3.go | Add $ Source[...] / $ Alert[...] markers for hardcoded key usage. |
| go/ql/test/experimental/CWE-287/ImproperLdapAuth.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/experimental/CWE-287/ImproperLdapAuth.go | Add $ Source[...] / $ Alert[...] markers for LDAP bind issues. |
| go/ql/test/experimental/CWE-285/PamAuthBypass.qlref | Enable inline-expectations postprocess. |
| go/ql/test/experimental/CWE-285/main.go | Add $ Alert[...] marker for PAM callback. |
| go/ql/test/experimental/CWE-203/Timing.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/experimental/CWE-203/timing.go | Add $ Source[...] / $ Alert[...] markers for timing-attack comparisons. |
| go/ql/test/experimental/CWE-090/LDAPInjection.qlref | Switch postprocess to YAML list and add inline-expectations postprocess. |
| go/ql/test/experimental/CWE-090/LDAPInjection.go | Add $ Source[...] / $ Alert[...] markers for LDAP injection. |
Copilot's findings
- Files reviewed: 203/203 changed files
- Comments generated: 17
| // Read before secret without overflowing to secret: | ||
| // NOTE: unsafe.Pointer(&harmless) == unsafe.Pointer(&harmless[0]) | ||
| var data = (*[8]byte)(unsafe.Pointer(&harmless)) // OK | ||
| var data = (*[8]byte)(unsafe.Pointer(&harmless)) // $ Alert[go/wrong-usage-of-unsafe] // OK |
| // Read before secret without overflowing to secret: | ||
| // NOTE: unsafe.Pointer(&harmless) == unsafe.Pointer(&harmless[0]) | ||
| var data = (*[8]byte)(unsafe.Pointer(&harmless[0])) // OK | ||
| var data = (*[8]byte)(unsafe.Pointer(&harmless[0])) // $ Alert[go/wrong-usage-of-unsafe] // OK |
| // the end of `harmless` is 8 bytes), | ||
| // which does not cross into `secret`. | ||
| var data = (*[8]byte)(unsafe.Pointer(&harmless[3])) // OK | ||
| var data = (*[8]byte)(unsafe.Pointer(&harmless[3])) // $ Alert[go/wrong-usage-of-unsafe] // OK |
|
|
||
| // Read before secret: | ||
| var data = (*int)(unsafe.Pointer(&harmless)) // TODO: is this really OK? | ||
| var data = (*int)(unsafe.Pointer(&harmless)) // $ Alert[go/wrong-usage-of-unsafe] // TODO: is this really OK? |
| func(hostname string, remote net.Addr, key ssh.PublicKey) error { | ||
| return nil | ||
| }) | ||
| }) // $ Source[go/insecure-hostkeycallback] Alert[go/insecure-hostkeycallback] |
| func(hostname string, remote net.Addr, key ssh.PublicKey) error { | ||
| return nil | ||
| }) | ||
| }) // $ Alert[go/insecure-hostkeycallback] |
| }) // $ Alert[go/insecure-hostkeycallback] | ||
|
|
||
| potentialInsecureSSHClientConfig(insecureCallback) | ||
| potentialInsecureSSHClientConfig(insecureCallback) // $ Source[go/insecure-hostkeycallback] Alert[go/insecure-hostkeycallback] |
| } | ||
| return fmt.Errorf("ssh: Unexpected host for key") | ||
| }) | ||
| }) // $ Alert[go/insecure-hostkeycallback] |
|
|
||
| potentialInsecureSSHClientConfig(potentiallySecureCallback) | ||
| potentialInsecureSSHClientConfig(ssh.InsecureIgnoreHostKey()) | ||
| potentialInsecureSSHClientConfig(potentiallySecureCallback) // $ Source[go/insecure-hostkeycallback] Alert[go/insecure-hostkeycallback] |
| potentialInsecureSSHClientConfig(ssh.InsecureIgnoreHostKey()) // $ Alert[go/insecure-hostkeycallback] | ||
|
|
||
| potentialInsecureSSHClientConfigTwoWrites(potentiallySecureCallback) | ||
| potentialInsecureSSHClientConfigTwoWrites(potentiallySecureCallback) // $ Source[go/insecure-hostkeycallback] Alert[go/insecure-hostkeycallback] |
Contributor
|
Nice, we should do this for all languages. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This was done by copilot.