Skip to content

Commit 1e1bbe9

Browse files
egregius313owen-mc
andauthored
Wording and typo
Co-authored-by: Owen Mansel-Chan <[email protected]>
1 parent 8b73d4a commit 1e1bbe9

File tree

1 file changed

+13
-13
lines changed

1 file changed

+13
-13
lines changed

docs/codeql/codeql-language-guides/customizing-library-models-for-go.rst

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Customizing library models for Go
44
=================================
55

6-
You can model the methods and callables that control data flow in any framework or library. This is especially useful for custom frameworks or niche libraries, that are not supported by the standard CodeQL libraries.
6+
You can model the methods and functions that control data flow in any framework or library. This is especially useful for custom frameworks or niche libraries, that are not supported by the standard CodeQL libraries.
77

88
.. include:: ../reusables/beta-note-customizing-library-models.rst
99

@@ -15,7 +15,7 @@ This article contains reference material about how to define custom models for s
1515
About data extensions
1616
---------------------
1717

18-
You can customize analysis by defining models (summaries, sinks, and sources) of your code's Go dependencies in data extension files. Each model defines the behavior of one or more elements of your library or framework, such as methods, properties, and callables. When you run dataflow analysis, these models expand the potential sources and sinks tracked by dataflow analysis and improve the precision of results.
18+
You can customize analysis by defining models (summaries, sinks, and sources) of your code's Go dependencies in data extension files. Each model defines the behavior of one or more elements of your library or framework, such as functions, methods, and fields. When you run dataflow analysis, these models expand the potential sources and sinks tracked by dataflow analysis and improve the precision of results.
1919

2020
Most of the security queries search for paths from a source of untrusted input to a sink that represents a vulnerability. This is known as taint tracking. Each source is a starting point for dataflow analysis to track tainted data and each sink is an end point.
2121

@@ -80,7 +80,7 @@ This is the ``Prepare`` method of the ``DB`` type in the ``database/sql`` packag
8080
...
8181
}
8282
83-
We need to add a tuple to the ``sinkModel``\(namespace, type, subtypes, name, signature, ext, input, kind, provenance) extensible predicate by updating a data extension file.
83+
We need to add a tuple to the ``sinkModel``\(package, type, subtypes, name, signature, ext, input, kind, provenance) extensible predicate by updating a data extension file.
8484

8585
.. code-block:: yaml
8686
@@ -92,7 +92,7 @@ We need to add a tuple to the ``sinkModel``\(namespace, type, subtypes, name, si
9292
- ["database/sql", "DB", False, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
9393
9494
Since we want to add a new sink, we need to add a tuple to the ``sinkModel`` extensible predicate.
95-
The first five values identify the callable (in this case a method) to be modeled as a sink.
95+
The first five values identify the function (in this case a method) to be modeled as a sink.
9696

9797
- The first value ``database/sql`` is the package name.
9898
- The second value ``DB`` is the name of the type that the method is associated with.
@@ -120,7 +120,7 @@ This is the ``Listen`` function which is located in the ``net`` package.
120120
}
121121
122122
123-
We need to add a tuple to the ``sourceModel``\(namespace, type, subtypes, name, signature, ext, output, kind, provenance) extensible predicate by updating a data extension file.
123+
We need to add a tuple to the ``sourceModel``\(package, type, subtypes, name, signature, ext, output, kind, provenance) extensible predicate by updating a data extension file.
124124

125125
.. code-block:: yaml
126126
@@ -133,7 +133,7 @@ We need to add a tuple to the ``sourceModel``\(namespace, type, subtypes, name,
133133
134134
135135
Since we are adding a new source, we need to add a tuple to the ``sourceModel`` extensible predicate.
136-
The first five values identify the callable (in this case a function) to be modeled as a source.
136+
The first five values identify the function to be modeled as a source.
137137

138138
- The first value ``net`` is the package name.
139139
- The second value ``""`` is left blank, since the function is not a method of a type.
@@ -162,7 +162,7 @@ This pattern covers many of the cases where we need to summarize flow through a
162162
...
163163
}
164164
165-
We need to add tuples to the ``summaryModel``\(namespace, type, subtypes, name, signature, ext, input, output, kind, provenance) extensible predicate by updating a data extension file:
165+
We need to add tuples to the ``summaryModel``\(package, type, subtypes, name, signature, ext, input, output, kind, provenance) extensible predicate by updating a data extension file:
166166

167167
.. code-block:: yaml
168168
@@ -178,10 +178,10 @@ Since we are adding flow through a method, we need to add tuples to the ``summar
178178
Each tuple defines flow from one argument to the return value.
179179
The first row defines flow from the first argument (``elems`` in the example) to the return value (``t`` in the example) and the second row defines flow from the second argument (``sep`` in the example) to the return value (``t`` in the example).
180180

181-
The first five values identify the callable (in this case a method) to be modeled as a summary.
181+
The first five values identify the function to be modeled as a summary.
182182
These are the same for both of the rows above as we are adding two summaries for the same method.
183183

184-
- The first value ``strings`` is the pacakge name.
184+
- The first value ``strings`` is the package name.
185185
- The second value ``""`` is left blank, since the function is not a method of a type.
186186
- The third value ``False`` is a flag that indicates whether or not the summary also applies to all overrides of the method.
187187
- The fourth value ``Join`` is the function name.
@@ -219,7 +219,7 @@ This example shows how the Go query pack models flow through a method for a simp
219219
...
220220
}
221221
222-
We need to add a tuple to the ``summaryModel``\(namespace, type, subtypes, name, signature, ext, input, output, kind, provenance) extensible predicate by updating a data extension file:
222+
We need to add a tuple to the ``summaryModel``\(package, type, subtypes, name, signature, ext, input, output, kind, provenance) extensible predicate by updating a data extension file:
223223

224224
.. code-block:: yaml
225225
@@ -234,7 +234,7 @@ Since we are adding flow through a method, we need to add tuples to the ``summar
234234
Each tuple defines flow from one argument to the return value.
235235
The first row defines flow from the qualifier of the method call (``u`` in the example) to the return value (``host`` in the example).
236236

237-
The first five values identify the callable (in this case a method) to be modeled as a summary.
237+
The first five values identify the function (in this case a method) to be modeled as a summary.
238238

239239
- The first value ``net/url`` is the package name.
240240
- The second value ``URL`` is the receiver type.
@@ -261,7 +261,7 @@ This example shows how we can model a field read as a source of tainted data.
261261
...
262262
}
263263
264-
We need to add a tuple to the ``sourceModel``\(namespace, type, subtypes, name, signature, ext, output, kind, provenance) extensible predicate by updating a data extension file.
264+
We need to add a tuple to the ``sourceModel``\(package, type, subtypes, name, signature, ext, output, kind, provenance) extensible predicate by updating a data extension file.
265265

266266
.. code-block:: yaml
267267
@@ -294,7 +294,7 @@ Package grouping
294294
Since Go uses URLs for package identifiers, it is possible for packages to be imported with different paths. For example, the ``glog`` package can be imported using both the ``github.com/golang/glog`` and ``gopkg.in/glog`` paths.
295295

296296
To handle this, the CodeQL Go library uses a mapping from the package path to a group name for the package. This mapping can be specified using the ``packageGrouping`` extensible predicate, and then the models for the APIs in the package
297-
will use the group name in place of the package path. The package field in models will be the prefix ``group:`` followed by the group name.
297+
will use the the prefix ``group:`` followed by the group name in place of the package path.
298298

299299
.. code-block:: yaml
300300

0 commit comments

Comments
 (0)