Go: Add new import path for nhooyr.io/websocket

go/ql/lib/change-notes/2026-09-22-nhooyr-package-rename.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Models for the `nhooyr.io/websocket` package have been updated to also support its new import path `github.com/coder/websocket`.

go/ql/lib/ext/github.com.coder.websocket.model.yml

@@ -0,0 +1,13 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: packageGrouping
+    data:
+      - ["coder/websocket", "github.com/coder/websocket"]
+      - ["coder/websocket", "nhooyr.io/websocket"]
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sourceModel
+    data:
+      - ["group:coder/websocket", "Conn", True, "Read", "", "", "ReturnValue[1]", "remote", "manual"]
+      - ["group:coder/websocket", "Conn", True, "Reader", "", "", "ReturnValue[1]", "remote", "manual"]

go/ql/lib/semmle/go/frameworks/WebSocket.qll

@@ -102,10 +102,10 @@ module WebSocketRequestCall {
   /**
    * A call to the `Dial` function of the `nhooyr.io/websocket` package.
    */
-  private class NhooyrWebSocketDialFunc extends Range {
-    NhooyrWebSocketDialFunc() {
+  private class CoderWebSocketDialFunc extends Range {
+    CoderWebSocketDialFunc() {
       // func Dial(ctx context.Context, u string, opts *DialOptions) (*Conn, *http.Response, error)
-      this.getTarget().hasQualifiedName(NhooyrWebSocket::packagePath(), "Dial")
+      this.getTarget().hasQualifiedName(CoderWebSocket::packagePath(), "Dial")
     }
 
     override DataFlow::Node getRequestUrl() { result = this.getArgument(1) }
@@ -188,10 +188,10 @@ module WebSocketReader {
   /**
    * The `Conn.Read` method of the `nhooyr.io/websocket` package.
    */
-  private class NhooyrWebSocketRead extends Range, Method {
-    NhooyrWebSocketRead() {
+  private class CoderWebSocketRead extends Range, Method {
+    CoderWebSocketRead() {
       // func (c *Conn) Read(ctx context.Context) (MessageType, []byte, error)
-      this.hasQualifiedName(NhooyrWebSocket::packagePath(), "Conn", "Read")
+      this.hasQualifiedName(CoderWebSocket::packagePath(), "Conn", "Read")
     }
 
     override FunctionOutput getAnOutput() { result.isResult(1) }
@@ -200,10 +200,10 @@ module WebSocketReader {
   /**
    * The `Conn.Reader` method of the `nhooyr.io/websocket` package.
    */
-  private class NhooyrWebSocketReader extends Range, Method {
-    NhooyrWebSocketReader() {
+  private class CoderWebSocketReader extends Range, Method {
+    CoderWebSocketReader() {
       // func (c *Conn) Reader(ctx context.Context) (MessageType, io.Reader, error)
-      this.hasQualifiedName(NhooyrWebSocket::packagePath(), "Conn", "Reader")
+      this.hasQualifiedName(CoderWebSocket::packagePath(), "Conn", "Reader")
     }
 
     override FunctionOutput getAnOutput() { result.isResult(1) }
@@ -313,12 +313,14 @@ module GolangOrgXNetWebsocket {
 }
 
 /**
- * Provides classes for working with the [nhooyr.io/websocket](http://nhooyr.io/websocket)
+ * Provides classes for working with the [coder/websocket](http://github.com/coder/websocket)
  * package.
  */
-module NhooyrWebSocket {
-  /** Gets the package name `nhooyr.io/websocket/`. */
-  string packagePath() { result = package("nhooyr.io/websocket", "") }
+module CoderWebSocket {
+  /** Gets the package name `github.com/coder/websocket` or `nhooyr.io/websocket`. */
+  string packagePath() {
+    result = package(["github.com/coder/websocket", "nhooyr.io/websocket"], "")
+  }
 }
 
 /**

go/ql/test/query-tests/Security/CWE-079/CONSISTENCY/DataFlowConsistency.expected

@@ -18,4 +18,4 @@ reverseRead
 | tst.go:33:15:33:15 | implicit-deref r | Origin of readStep is missing a PostUpdateNode. |
 | tst.go:48:14:48:14 | implicit-deref r | Origin of readStep is missing a PostUpdateNode. |
 | tst.go:66:15:66:15 | implicit-deref r | Origin of readStep is missing a PostUpdateNode. |
-| websocketXss.go:26:9:26:9 | implicit-deref r | Origin of readStep is missing a PostUpdateNode. |
+| websocketXss.go:27:9:27:9 | implicit-deref r | Origin of readStep is missing a PostUpdateNode. |

go/ql/test/query-tests/Security/CWE-079/go.mod

@@ -3,6 +3,7 @@ module codeql-go-tests/CWE-079
 go 1.24
 
 require (
+	github.com/coder/websocket v1.8.5
 	github.com/gobwas/ws v1.0.3
 	github.com/gorilla/websocket v1.4.2
 	golang.org/x/net v0.0.0-20200505041828-1ed23360d12c

go/ql/test/query-tests/Security/CWE-079/vendor/modules.txt

@@ -1,3 +1,6 @@
+# github.com/coder/websocket v1.8.5
+## explicit
+github.com/coder/websocket
 # github.com/gobwas/ws v1.0.3
 ## explicit
 github.com/gobwas/ws

go/ql/test/query-tests/Security/CWE-079/websocketXss.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"net/http"
 
+	coder "github.com/coder/websocket"
 	gorilla "github.com/gorilla/websocket"
 	websocket "golang.org/x/net/websocket"
 	nhooyr "nhooyr.io/websocket"
@@ -40,6 +41,11 @@ func xss(w http.ResponseWriter, r *http.Request) {
 		_, nhooyr, _ := n.Read(context.TODO()) // $ Source[go/reflected-xss]
 		fmt.Fprintf(w, "%v", nhooyr)           // $ Alert[go/reflected-xss]
 	}
+	{
+		n, _, _ := coder.Dial(context.TODO(), uri, nil)
+		_, coderMsg, _ := n.Read(context.TODO()) // $ Source[go/reflected-xss]
+		fmt.Fprintf(w, "%v", coderMsg)           // $ Alert[go/reflected-xss]
+	}
 	{
 		dialer := gorilla.Dialer{}
 		conn, _, _ := dialer.Dial(uri, nil)