From 2a3e6b02ffd7fb1225599ae0e3d754619bdbcab0 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 22 Sep 2026 11:47:06 +0100 Subject: [PATCH 1/5] Reinstate imprecise strings.Join model Preserve flow when Argument[0] is tainted as a whole but its array-element access path is unavailable. --- go/ql/lib/ext/strings.model.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/go/ql/lib/ext/strings.model.yml b/go/ql/lib/ext/strings.model.yml index 4a6d852baab4..8d23a1c2f09a 100644 --- a/go/ql/lib/ext/strings.model.yml +++ b/go/ql/lib/ext/strings.model.yml @@ -10,6 +10,7 @@ extensions: - ["strings", "", False, "CutSuffix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"] - ["strings", "", False, "Fields", "", "", "Argument[0]", "ReturnValue.ArrayElement", "taint", "manual"] - ["strings", "", False, "FieldsFunc", "", "", "Argument[0]", "ReturnValue.ArrayElement", "taint", "manual"] + - ["strings", "", False, "Join", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] - ["strings", "", False, "Join", "", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"] - ["strings", "", False, "Join", "", "", "Argument[1]", "ReturnValue", "taint", "manual"] - ["strings", "", False, "Map", "", "", "Argument[1]", "ReturnValue", "taint", "manual"] From aafc01c0a4b888badf0427cf74187a03793ef94e Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 22 Sep 2026 12:25:20 +0100 Subject: [PATCH 2/5] Remove stale generated notices from stdlib taint tests --- .../semmle/go/frameworks/StdlibTaintFlow/ArchiveTar.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/ArchiveZip.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Bufio.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Bytes.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/CompressBzip2.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/CompressFlate.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/CompressGzip.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/CompressLzw.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/CompressZlib.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/ContainerHeap.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/ContainerList.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/ContainerRing.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Context.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Crypto.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/CryptoCipher.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/CryptoRsa.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/CryptoTls.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/CryptoX509.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingAscii85.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingAsn1.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingBase32.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingBase64.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingBinary.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingCsv.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingGob.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingHex.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingJson.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingPem.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/EncodingXml.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Errors.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Expvar.go | 2 -- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Fmt.go | 3 --- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Html.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/HtmlTemplate.go | 2 -- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Io.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/IoIoutil.go | 2 -- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Log.go | 2 -- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Mime.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/MimeMultipart.go | 2 -- .../go/frameworks/StdlibTaintFlow/MimeQuotedprintable.go | 2 -- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Net.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/NetHttp.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/NetHttpHttputil.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/NetMail.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/NetTextproto.go | 2 -- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Os.go | 2 -- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Path.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/PathFilepath.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Reflect.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Regexp.go | 2 -- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Sort.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Strconv.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Strings.go | 2 -- .../library-tests/semmle/go/frameworks/StdlibTaintFlow/Sync.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/SyncAtomic.go | 3 --- .../semmle/go/frameworks/StdlibTaintFlow/Syscall.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/Syscall_non_win.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/TextScanner.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/TextTabwriter.go | 2 -- .../semmle/go/frameworks/StdlibTaintFlow/TextTemplate.go | 2 -- 62 files changed, 126 deletions(-) diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ArchiveTar.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ArchiveTar.go index 1e67bd1f3261..79be6519cc52 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ArchiveTar.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ArchiveTar.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ArchiveZip.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ArchiveZip.go index f968c5c11e03..6fac854e108b 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ArchiveZip.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ArchiveZip.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bufio.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bufio.go index bec4127686ca..02f21f9d858e 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bufio.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bufio.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go index d744819e2807..dd7fd12c1209 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressBzip2.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressBzip2.go index 2ca7bd8c9249..317c264e97d8 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressBzip2.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressBzip2.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressFlate.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressFlate.go index 8684b690f6fb..56f37c7d5cf6 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressFlate.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressFlate.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressGzip.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressGzip.go index 246b746025ce..b96f7969db5b 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressGzip.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressGzip.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressLzw.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressLzw.go index ff4a2875df7e..39c728db3147 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressLzw.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressLzw.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressZlib.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressZlib.go index 535ef1fe01b9..4773fd6f3eef 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressZlib.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressZlib.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerHeap.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerHeap.go index d09159a1c4ee..038a70e4a73c 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerHeap.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerHeap.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "container/heap" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerList.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerList.go index dba1c7e57fb2..6e5b0aa6075e 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerList.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerList.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "container/list" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerRing.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerRing.go index 6b086a141770..fbe4fb35635a 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerRing.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerRing.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "container/ring" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Context.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Context.go index 5b526f3b8c0a..1e6775e4ad86 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Context.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Context.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Crypto.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Crypto.go index 8a3e7fc29793..a739420049f3 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Crypto.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Crypto.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "crypto" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoCipher.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoCipher.go index c922498adcb7..c10e1c3085d2 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoCipher.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoCipher.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "crypto/cipher" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoRsa.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoRsa.go index bc1020f9a5e4..f05d3567df00 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoRsa.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoRsa.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "crypto/rsa" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoTls.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoTls.go index a35f30a1a991..f161c3cba118 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoTls.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoTls.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoX509.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoX509.go index a60b6eab2f4d..96bbb13170ba 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoX509.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CryptoX509.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go index 3e2f5af18bba..47cdc3536297 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go index ff572e9d889d..ba63f5dfcadd 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "database/sql/driver" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAscii85.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAscii85.go index 2e595f2fe7fe..b61d3d7049a8 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAscii85.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAscii85.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAsn1.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAsn1.go index 282cec2ac85a..6653817c2b29 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAsn1.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingAsn1.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "encoding/asn1" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase32.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase32.go index e1f49d7e9540..88923ae4410f 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase32.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase32.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase64.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase64.go index 9fb443c12a35..c87751d3e314 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase64.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBase64.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBinary.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBinary.go index 9a6300eaf30f..776a3b800544 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBinary.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingBinary.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingCsv.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingCsv.go index 462195a934ac..1eb306ee826a 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingCsv.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingCsv.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingGob.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingGob.go index 9c4bdd01d1ed..c0480bec4094 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingGob.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingGob.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingHex.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingHex.go index ef022b2061be..ff534e402f93 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingHex.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingHex.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingJson.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingJson.go index 289ac9b811d9..6e2427fff63b 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingJson.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingJson.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingPem.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingPem.go index 22efae6e6cdf..7b339760ca84 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingPem.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingPem.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingXml.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingXml.go index a213c7b3a810..c7c3ef598bff 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingXml.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingXml.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Errors.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Errors.go index 71b7f9441f81..af1d727b46e5 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Errors.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Errors.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "errors" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Expvar.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Expvar.go index 429612f221be..8ac0e3311def 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Expvar.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Expvar.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "expvar" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Fmt.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Fmt.go index 61df23367013..f21dad595128 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Fmt.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Fmt.go @@ -1,6 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox, with manual additions for -// go 1.19's new Append[f, ln] functions. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Html.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Html.go index b4c1300a7d38..22be462dab5c 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Html.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Html.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "html" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/HtmlTemplate.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/HtmlTemplate.go index 3758f595ef4c..d7ca0f0472cf 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/HtmlTemplate.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/HtmlTemplate.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Io.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Io.go index d06e9b6d8181..c2fbc47152c9 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Io.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Io.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "io" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/IoIoutil.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/IoIoutil.go index 5faa3bf8b0ae..3138780e83d8 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/IoIoutil.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/IoIoutil.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Log.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Log.go index 50dcfd1170bf..1b5b12a270bf 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Log.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Log.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Mime.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Mime.go index 5af469a74593..51ac4f3bdb45 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Mime.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Mime.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "mime" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/MimeMultipart.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/MimeMultipart.go index 06a7e8040939..8e6948715d54 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/MimeMultipart.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/MimeMultipart.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/MimeQuotedprintable.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/MimeQuotedprintable.go index c405fed3a7be..619c88f4921b 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/MimeQuotedprintable.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/MimeQuotedprintable.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Net.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Net.go index 6f18383f4498..0cfd4db6e8e7 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Net.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Net.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttp.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttp.go index 86129bedbff2..2f3fe3ceee0c 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttp.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttp.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttpHttputil.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttpHttputil.go index 1a2e81b03949..cee11c5c38c8 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttpHttputil.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttpHttputil.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetMail.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetMail.go index 595f71dac757..3448f44ba1a7 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetMail.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetMail.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetTextproto.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetTextproto.go index 8285400a142d..a592d9c63678 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetTextproto.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetTextproto.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Os.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Os.go index 859a3bbd3bd4..f7392c1e3e37 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Os.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Os.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Path.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Path.go index 04978ea7fa0b..754c031446a8 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Path.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Path.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "path" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/PathFilepath.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/PathFilepath.go index c84b22deee6f..cc8d9163c4d1 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/PathFilepath.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/PathFilepath.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "path/filepath" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Reflect.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Reflect.go index 497dfdb4e00f..c30883251dfb 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Reflect.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Reflect.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Regexp.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Regexp.go index 31937a695beb..908dc5fd9b68 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Regexp.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Regexp.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "regexp" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Sort.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Sort.go index 3cf3b09497ba..933c02e39203 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Sort.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Sort.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "sort" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strconv.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strconv.go index d7f84f6c031e..d1c4e851ddc4 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strconv.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strconv.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "strconv" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go index ac152a84c3b5..ac781189daa2 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Sync.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Sync.go index d7d1044acd6f..9ce734b3cbab 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Sync.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Sync.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "sync" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/SyncAtomic.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/SyncAtomic.go index dd7a8f778002..f5fbcd6795c2 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/SyncAtomic.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/SyncAtomic.go @@ -1,6 +1,3 @@ -// Code partially generated by https://github.com/gagliardetto/codebox, with manual additions -// for atomic.Pointer and Uintptr, as well as atomic.Value's Swap method. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Syscall.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Syscall.go index fce1d4dd34cf..db873c4ee7f8 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Syscall.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Syscall.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import "syscall" diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Syscall_non_win.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Syscall_non_win.go index 06db4fa3c0b5..6dbaf5692776 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Syscall_non_win.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Syscall_non_win.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - //go:build !windows // +build !windows diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextScanner.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextScanner.go index 875bc8e885e8..afcb61b86152 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextScanner.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextScanner.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextTabwriter.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextTabwriter.go index 50e725399240..202dbec4b23d 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextTabwriter.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextTabwriter.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextTemplate.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextTemplate.go index 79d3179e29cd..14e56a714442 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextTemplate.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/TextTemplate.go @@ -1,5 +1,3 @@ -// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT. - package main import ( From 17466f93e0ccb5e2c53041aa1f9d419c23ddd508 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 22 Sep 2026 12:26:16 +0100 Subject: [PATCH 3/5] Test whole-slice taint flow through strings.Join --- .../semmle/go/frameworks/StdlibTaintFlow/Strings.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go index ac781189daa2..e35305bf9d43 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go @@ -82,6 +82,12 @@ func TaintStepTest_StringsJoin_B0I0O0(sourceCQL interface{}) interface{} { return intoString957 } +func TaintStepTest_StringsJoin_B0I0O0_WholeSlice(sourceCQL interface{}) interface{} { + fromStrings := sourceCQL.([]string) + intoString := strings.Join(fromStrings, "") + return intoString +} + func TaintStepTest_StringsJoin_B0I1O0(sourceCQL interface{}) interface{} { fromString520 := sourceCQL.(string) intoString443 := strings.Join(nil, fromString520) From 33f115618a21685e66f46d304e5f4f5d4e6c25c6 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 22 Sep 2026 12:29:18 +0100 Subject: [PATCH 4/5] (trivial) Reformat headers in test file The formatter insisted on doing this. --- .../semmle/go/frameworks/StdlibTaintFlow/Context.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Context.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Context.go index 1e6775e4ad86..d0f372d3cc6d 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Context.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Context.go @@ -2,8 +2,9 @@ package main import ( "context" - oldcontext "golang.org/x/net/context" "time" + + oldcontext "golang.org/x/net/context" ) func TaintStepTest_ContextWithCancel_B0I0O0(sourceCQL interface{}) interface{} { From 702229c9e6368d382b1c973668748f7b83121c8b Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 22 Sep 2026 14:35:38 +0100 Subject: [PATCH 5/5] Update test output --- go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected b/go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected index d388a119214f..2dbec7f7b95e 100644 --- a/go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected +++ b/go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected @@ -59,9 +59,11 @@ edges | reflectedxsstest.go:51:14:51:26 | call to Query | reflectedxsstest.go:54:11:54:21 | type conversion | provenance | | | tst.go:14:15:14:20 | selection of Form | tst.go:14:15:14:36 | call to Get | provenance | Src:MaD:6 MaD:18 | | tst.go:14:15:14:36 | call to Get | tst.go:17:18:17:25 | username | provenance | | +| tst.go:14:15:14:36 | call to Get | tst.go:18:32:18:32 | a | provenance | | | tst.go:17:9:17:57 | slice literal [array] | tst.go:18:32:18:32 | a [array] | provenance | | | tst.go:17:18:17:25 | username | tst.go:17:9:17:57 | slice literal [array] | provenance | | | tst.go:18:19:18:38 | call to Join | tst.go:18:12:18:39 | type conversion | provenance | | +| tst.go:18:32:18:32 | a | tst.go:18:19:18:38 | call to Join | provenance | MaD:20 | | tst.go:18:32:18:32 | a [array] | tst.go:18:19:18:38 | call to Join | provenance | MaD:19 | | tst.go:48:14:48:19 | selection of Form | tst.go:48:14:48:34 | call to Get | provenance | Src:MaD:6 MaD:18 | | tst.go:48:14:48:34 | call to Get | tst.go:53:12:53:26 | type conversion | provenance | | @@ -91,6 +93,7 @@ models | 17 | Summary: net/url; URL; true; Query; ; ; Argument[receiver]; ReturnValue; taint; manual | | 18 | Summary: net/url; Values; true; Get; ; ; Argument[receiver]; ReturnValue; taint; manual | | 19 | Summary: strings; ; false; Join; ; ; Argument[0].ArrayElement; ReturnValue; taint; manual | +| 20 | Summary: strings; ; false; Join; ; ; Argument[0]; ReturnValue; taint; manual | nodes | ReflectedXss.go:11:15:11:20 | selection of Form | semmle.label | selection of Form | | ReflectedXss.go:11:15:11:36 | call to Get | semmle.label | call to Get | @@ -143,6 +146,7 @@ nodes | tst.go:17:18:17:25 | username | semmle.label | username | | tst.go:18:12:18:39 | type conversion | semmle.label | type conversion | | tst.go:18:19:18:38 | call to Join | semmle.label | call to Join | +| tst.go:18:32:18:32 | a | semmle.label | a | | tst.go:18:32:18:32 | a [array] | semmle.label | a [array] | | tst.go:48:14:48:19 | selection of Form | semmle.label | selection of Form | | tst.go:48:14:48:34 | call to Get | semmle.label | call to Get |