Skip to content

Commit 848677e

Browse files
owen-mcowen-mc
authored
Merge pull request #20917 from owen-mc/go/enable-data-flow-consistency-checks
Go: enable data flow consistency checks
2 parents 464d2cd + 38cb6e5 commit 848677e

File tree

71 files changed

+957
-4
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

71 files changed

+957
-4
lines changed

‎go/Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,9 @@ ql/lib/go.dbscheme.stats: ql/lib/go.dbscheme build/stats/src.stamp extractor
5454
codeql dataset measure -o $@ build/stats/database/db-go
5555

5656
test: all build/testdb/check-upgrade-path
57-
codeql test run -j0 ql/test --search-path .. --check-diff-informed --consistency-queries ql/test/consistency --compilation-cache=$(cache) --dynamic-join-order-mode=$(rtjo) --check-databases --fail-on-trap-errors --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition
57+
codeql test run -j0 ql/test --search-path .. --check-diff-informed --consistency-queries ql/consistency-queries --compilation-cache=$(cache) --dynamic-join-order-mode=$(rtjo) --check-databases --fail-on-trap-errors --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition
5858
# use GOOS=linux because GOOS=darwin GOARCH=386 is no longer supported
59-
env GOOS=linux GOARCH=386 codeql$(EXE) test run -j0 ql/test/query-tests/Security/CWE-681 --search-path .. --check-diff-informed --consistency-queries ql/test/consistency --compilation-cache=$(cache) --dynamic-join-order-mode=$(rtjo)
59+
env GOOS=linux GOARCH=386 codeql$(EXE) test run -j0 ql/test/query-tests/Security/CWE-681 --search-path .. --check-diff-informed --consistency-queries ql/consistency-queries --compilation-cache=$(cache) --dynamic-join-order-mode=$(rtjo)
6060
cd extractor; $(BAZEL) test ...
6161
bash extractor-smoke-test/test.sh || (echo "Extractor smoke test FAILED"; exit 1)
6262

‎go/ql/test/consistency/UnexpectedFrontendErrors.ql‎ renamed to ‎go/ql/consistency-queries/UnexpectedFrontendErrors.ql‎

File renamed without changes.

‎go/ql/lib/change-notes/2025-11-26-unexpected-frontend-errors-query-moved.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: breaking
3+
---
4+
* The query `go/unexpected-frontend-error` has been moved from the `codeql/go-queries` query to the `codeql-go-consistency-queries` query pack.

‎go/ql/lib/semmle/go/dataflow/internal/DataFlowImplConsistency.qll‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,25 @@
55

66
private import go
77
private import DataFlowImplSpecific as Impl
8+
private import DataFlowUtil
89
private import TaintTrackingImplSpecific
910
private import codeql.dataflow.internal.DataFlowImplConsistency
1011
private import semmle.go.dataflow.internal.DataFlowNodes
1112

12-
private module Input implements InputSig<Location, Impl::GoDataFlow> { }
13+
private module Input implements InputSig<Location, Impl::GoDataFlow> {
14+
predicate missingLocationExclude(DataFlow::Node n) {
15+
n instanceof DataFlow::GlobalFunctionNode or n instanceof Private::FlowSummaryNode
16+
}
17+
18+
predicate uniqueNodeLocationExclude(DataFlow::Node n) { missingLocationExclude(n) }
19+
20+
predicate localFlowIsLocalExclude(DataFlow::Node n1, DataFlow::Node n2) {
21+
n1 instanceof DataFlow::FunctionNode and simpleLocalFlowStep(n1, n2, _)
22+
}
23+
24+
predicate argHasPostUpdateExclude(DataFlow::ArgumentNode n) {
25+
not DataFlow::insnHasPostUpdateNode(n.asInstruction())
26+
}
27+
}
1328

1429
module Consistency = MakeConsistency<Location, Impl::GoDataFlow, GoTaintTracking, Input>;

‎go/ql/test/consistency/UnexpectedFrontendErrors.expected‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎go/ql/test/example-tests/snippets/CONSISTENCY/DataFlowConsistency.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
identityLocalStep
2+
| main.go:46:18:46:18 | n | Node steps to itself |
3+
| main.go:47:3:47:3 | c | Node steps to itself |

‎go/ql/test/experimental/CWE-203/CONSISTENCY/DataFlowConsistency.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
reverseRead
2+
| timing.go:15:18:15:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
3+
| timing.go:28:18:28:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
4+
| timing.go:41:18:41:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
5+
| timing.go:53:18:53:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

‎go/ql/test/experimental/CWE-287/CONSISTENCY/DataFlowConsistency.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
reverseRead
2+
| ImproperLdapAuth.go:18:18:18:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
3+
| ImproperLdapAuth.go:39:18:39:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
4+
| ImproperLdapAuth.go:64:18:64:20 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

‎go/ql/test/experimental/CWE-321-V2/CONSISTENCY/DataFlowConsistency.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
reverseRead
2+
| go-jose.v3.go:16:17:16:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
3+
| golang-jwt-v5.go:22:17:22:17 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

‎go/ql/test/experimental/CWE-369/CONSISTENCY/DataFlowConsistency.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
reverseRead
2+
| DivideByZero.go:10:12:10:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
3+
| DivideByZero.go:17:12:17:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
4+
| DivideByZero.go:24:12:24:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
5+
| DivideByZero.go:31:12:31:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
6+
| DivideByZero.go:38:12:38:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
7+
| DivideByZero.go:45:12:45:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
8+
| DivideByZero.go:54:12:54:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
9+
| DivideByZero.go:63:12:63:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |
10+
| DivideByZero.go:72:12:72:12 | implicit dereference | Origin of readStep is missing a PostUpdateNode. |

0 commit comments

Comments
 (0)