Merge pull request #18920 from owen-mc/go/mad/improve-sync-models

Go: Do not track taint into a `sync.Map` via the key of a key-value pair

Author: owen-mc

go/ql/lib/change-notes/2025-03-04-improve-models-for-sync-map.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* We no longer track taint into a `sync.Map` via the key of a key-value pair, since we do not model any way in which keys can be read from a `sync.Map`.

go/ql/lib/ext/sync.model.yml

@@ -6,10 +6,10 @@ extensions:
       - ["sync", "Map", True, "CompareAndSwap", "", "", "Argument[2]", "Argument[receiver]", "taint", "manual"]
       - ["sync", "Map", True, "Load", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
       - ["sync", "Map", True, "LoadOrStore", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
-      - ["sync", "Map", True, "LoadOrStore", "", "", "Argument[0..1]", "Argument[receiver]", "taint", "manual"]
-      - ["sync", "Map", True, "LoadOrStore", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"]
-      - ["sync", "Map", True, "Store", "", "", "Argument[0..1]", "Argument[receiver]", "taint", "manual"]
+      - ["sync", "Map", True, "LoadOrStore", "", "", "Argument[1]", "Argument[receiver]", "taint", "manual"]
+      - ["sync", "Map", True, "LoadOrStore", "", "", "Argument[1]", "ReturnValue[0]", "taint", "manual"]
+      - ["sync", "Map", True, "Store", "", "", "Argument[1]", "Argument[receiver]", "taint", "manual"]
       - ["sync", "Map", True, "Swap", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
-      - ["sync", "Map", True, "Swap", "", "", "Argument[0..1]", "Argument[receiver]", "taint", "manual"]
+      - ["sync", "Map", True, "Swap", "", "", "Argument[1]", "Argument[receiver]", "taint", "manual"]
       - ["sync", "Pool", True, "Get", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
       - ["sync", "Pool", True, "Put", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]