Skip to content

Commit a1c9dee

Browse files
mbgmbg
authored
Merge pull request github#13867 from github/mbg/go/1.21-support
Go: Basic Go 1.21 support
2 parents 1643a83 + 9082fd2 commit a1c9dee

File tree

17 files changed

+1286
-955
lines changed

17 files changed

+1286
-955
lines changed

‎.github/workflows/go-tests-other-os.yml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,17 @@ on:
77
- .github/workflows/go-tests-other-os.yml
88
- .github/actions/**
99
- codeql-workspace.yml
10+
env:
11+
GO_VERSION: '~1.21.0'
1012
jobs:
1113
test-mac:
1214
name: Test MacOS
1315
runs-on: macos-latest
1416
steps:
15-
- name: Set up Go 1.20
17+
- name: Set up Go ${{ env.GO_VERSION }}
1618
uses: actions/setup-go@v4
1719
with:
18-
go-version: '1.20'
20+
go-version: ${{ env.GO_VERSION }}
1921
id: go
2022

2123
- name: Check out code
@@ -47,10 +49,10 @@ jobs:
4749
name: Test Windows
4850
runs-on: windows-latest-xl
4951
steps:
50-
- name: Set up Go 1.20
52+
- name: Set up Go ${{ env.GO_VERSION }}
5153
uses: actions/setup-go@v4
5254
with:
53-
go-version: '1.20'
55+
go-version: ${{ env.GO_VERSION }}
5456
id: go
5557

5658
- name: Check out code

‎.github/workflows/go-tests.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,17 @@ on:
1515
- .github/workflows/go-tests.yml
1616
- .github/actions/**
1717
- codeql-workspace.yml
18+
env:
19+
GO_VERSION: '~1.21.0'
1820
jobs:
1921
test-linux:
2022
name: Test Linux (Ubuntu)
2123
runs-on: ubuntu-latest-xl
2224
steps:
23-
- name: Set up Go 1.20
25+
- name: Set up Go ${{ env.GO_VERSION }}
2426
uses: actions/setup-go@v4
2527
with:
26-
go-version: '1.20'
28+
go-version: ${{ env.GO_VERSION }}
2729
id: go
2830

2931
- name: Check out code

‎go/extractor/cli/go-autobuilder/go-autobuilder.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -830,7 +830,7 @@ func installDependenciesAndBuild() {
830830
}
831831

832832
const minGoVersion = "1.11"
833-
const maxGoVersion = "1.20"
833+
const maxGoVersion = "1.21"
834834

835835
// Check if `version` is lower than `minGoVersion`. Note that for this comparison we ignore the
836836
// patch part of the version, so 1.20.1 and 1.20 are considered equal.

‎go/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/github/codeql-go
22

3-
go 1.20
3+
go 1.21
44

55
require (
66
golang.org/x/mod v0.12.0

‎go/ql/lib/semmle/go/Scopes.qll

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -678,6 +678,8 @@ private predicate builtinFunction(
678678
or
679679
name = "cap" and pure = true and mayPanic = false and mustPanic = false and variadic = false
680680
or
681+
name = "clear" and pure = false and mayPanic = false and mustPanic = false and variadic = false
682+
or
681683
name = "close" and pure = false and mayPanic = true and mustPanic = false and variadic = false
682684
or
683685
name = "complex" and pure = true and mayPanic = true and mustPanic = false and variadic = false
@@ -692,6 +694,10 @@ private predicate builtinFunction(
692694
or
693695
name = "make" and pure = true and mayPanic = true and mustPanic = false and variadic = true
694696
or
697+
name = "max" and pure = true and mayPanic = false and mustPanic = false and variadic = true
698+
or
699+
name = "min" and pure = true and mayPanic = false and mustPanic = false and variadic = true
700+
or
695701
name = "new" and pure = true and mayPanic = false and mustPanic = false and variadic = false
696702
or
697703
name = "panic" and pure = false and mayPanic = true and mustPanic = true and variadic = false
@@ -795,6 +801,9 @@ module Builtin {
795801
/** Gets the built-in function `cap`. */
796802
BuiltinFunction cap() { result.getName() = "cap" }
797803

804+
/** Gets the built-in function `clear`. */
805+
BuiltinFunction clear() { result.getName() = "clear" }
806+
798807
/** Gets the built-in function `close`. */
799808
BuiltinFunction close() { result.getName() = "close" }
800809

@@ -816,6 +825,12 @@ module Builtin {
816825
/** Gets the built-in function `make`. */
817826
BuiltinFunction make() { result.getName() = "make" }
818827

828+
/** Gets the built-in function `max`. */
829+
BuiltinFunction max_() { result.getName() = "max" }
830+
831+
/** Gets the built-in function `min`. */
832+
BuiltinFunction min_() { result.getName() = "min" }
833+
819834
/** Gets the built-in function `new`. */
820835
BuiltinFunction new() { result.getName() = "new" }
821836

‎go/ql/lib/semmle/go/dataflow/internal/TaintTrackingUtil.qll

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -408,3 +408,19 @@ class ListOfConstantsComparisonSanitizerGuard extends TaintTracking::DefaultTain
408408
this = DataFlow::BarrierGuard<listOfConstantsComparisonSanitizerGuard/3>::getABarrierNode()
409409
}
410410
}
411+
412+
/**
413+
* The `clear` built-in function deletes or zeroes out all elements of a map or slice
414+
* and therefore acts as a general sanitizer for taint flow to any uses dominated by it.
415+
*/
416+
private class ClearSanitizer extends DefaultTaintSanitizer {
417+
ClearSanitizer() {
418+
exists(SsaWithFields var, DataFlow::CallNode call, DataFlow::Node arg | this = var.getAUse() |
419+
call = Builtin::clear().getACall() and
420+
arg = call.getAnArgument() and
421+
arg = var.getAUse() and
422+
arg != this and
423+
this.getBasicBlock().(ReachableBasicBlock).dominates(this.getBasicBlock())
424+
)
425+
}
426+
}

‎go/ql/lib/semmle/go/frameworks/Stdlib.qll

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,32 @@ private class CopyFunction extends TaintTracking::FunctionModel {
7070
}
7171
}
7272

73+
/**
74+
* A model of the built-in `min` function, which computes the smallest value of a fixed number of
75+
* arguments of ordered types. There is at least one argument and "ordered types" includes e.g.
76+
* strings, so we care about data flow through `min`.
77+
*/
78+
private class MinFunction extends DataFlow::FunctionModel {
79+
MinFunction() { this = Builtin::min_() }
80+
81+
override predicate hasDataFlow(FunctionInput inp, FunctionOutput outp) {
82+
inp.isParameter(_) and outp.isResult()
83+
}
84+
}
85+
86+
/**
87+
* A model of the built-in `max` function, which computes the largest value of a fixed number of
88+
* arguments of ordered types. There is at least one argument and "ordered types" includes e.g.
89+
* strings, so we care about data flow through `max`.
90+
*/
91+
private class MaxFunction extends DataFlow::FunctionModel {
92+
MaxFunction() { this = Builtin::max_() }
93+
94+
override predicate hasDataFlow(FunctionInput inp, FunctionOutput outp) {
95+
inp.isParameter(_) and outp.isResult()
96+
}
97+
}
98+
7399
/** Provides a class for modeling functions which convert strings into integers. */
74100
module IntegerParser {
75101
/**

‎go/ql/test/library-tests/semmle/go/Function/TypeParamType.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
| Edge | EdgeConstraint |
22
| Edge | interface { } |
3+
| F | floaty |
34
| K | comparable |
45
| Node | NodeConstraint |
56
| Node | interface { } |
67
| S | interface { } |
78
| SF2 | interface { } |
89
| SG2 | interface { } |
910
| T | interface { } |
11+
| T1 | interface { } |
12+
| T2 | interface { } |
1013
| TF1 | interface { } |
1114
| TF2 | interface { } |
1215
| TG1 | interface { } |

‎go/ql/test/library-tests/semmle/go/dataflow/DefaultTaintSanitizer/Builtin.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package main
2+
3+
import "net/http"
4+
5+
func clearTestBad(sourceReq *http.Request) string {
6+
b := make([]byte, 8)
7+
sourceReq.Body.Read(b)
8+
return string(b)
9+
}
10+
11+
func clearTestGood(sourceReq *http.Request) string {
12+
b := make([]byte, 8)
13+
sourceReq.Body.Read(b)
14+
clear(b) // should prevent taint flow
15+
return string(b)
16+
}

‎go/ql/test/library-tests/semmle/go/dataflow/DefaultTaintSanitizer/DefaultSanitizer.expected

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
edges
2+
| Builtin.go:6:2:6:2 | definition of b | Builtin.go:8:9:8:17 | type conversion |
3+
| Builtin.go:7:2:7:15 | selection of Body | Builtin.go:6:2:6:2 | definition of b |
4+
nodes
5+
| Builtin.go:6:2:6:2 | definition of b | semmle.label | definition of b |
6+
| Builtin.go:7:2:7:15 | selection of Body | semmle.label | selection of Body |
7+
| Builtin.go:8:9:8:17 | type conversion | semmle.label | type conversion |
8+
subpaths
9+
#select
10+
| Builtin.go:8:9:8:17 | type conversion | Builtin.go:7:2:7:15 | selection of Body | Builtin.go:8:9:8:17 | type conversion | Found taint flow |

0 commit comments

Comments
 (0)