Skip to content

Go/Java: fix miscellaneous trivial issues highlighted by ql-for-ql #20931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
owen-mc merged 10 commits into from
Nov 28, 2025
Merged

Go/Java: fix miscellaneous trivial issues highlighted by ql-for-ql #20931

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
2058c4a
Remove redundant char pred
owen-mc Nov 28, 2025
fb0b407
Remove redundant import
owen-mc Nov 28, 2025
303deab
Remove redundant conjunct
owen-mc Nov 28, 2025
0b79087
Make predicate name start with `has` instead of `get`
owen-mc Nov 28, 2025
fe1c4e2
Make class qldoc start with "A".
owen-mc Nov 28, 2025
b8ccaf3
Improve formatting of tags metadata
owen-mc Nov 28, 2025
62238fc
Fix variable name in qldoc
owen-mc Nov 28, 2025
22b614a
Use set literals
owen-mc Nov 28, 2025
220fd08
Improve formatting of tags #2
owen-mc Nov 28, 2025
992bd68
Use set literals #2
owen-mc Nov 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions go/ql/lib/semmle/go/dataflow/GlobalValueNumbering.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,8 +255,6 @@ private predicate globalValueNumbers(DataFlow::CallNode ce, int start, GVN head,
* methods.
*/
class GVN extends GvnBase {
GVN() { this instanceof GvnBase }

/** Gets a data-flow node that has this GVN. */
DataFlow::Node getANode() { this = globalValueNumber(result) }

Expand Down
1 change: 0 additions & 1 deletion go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1347,7 +1347,6 @@ module Public {
}
}

private import Private
private import Public

class SummaryPostUpdateNode extends FlowSummaryNode, PostUpdateNode {
Expand Down
3 changes: 2 additions & 1 deletion go/ql/src/Security/CWE-020/UntrustedDataToExternalAPI.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@
* @precision low
* @problem.severity error
* @security-severity 7.8
* @tags security external/cwe/cwe-020
* @tags security
* external/cwe/cwe-020
*/

import go
Expand Down
3 changes: 2 additions & 1 deletion go/ql/src/Security/CWE-020/UntrustedDataToUnknownExternalAPI.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@
* @precision low
* @problem.severity error
* @security-severity 7.8
* @tags security external/cwe/cwe-020
* @tags security
* external/cwe/cwe-020
*/

import go
Expand Down
4 changes: 2 additions & 2 deletions go/ql/src/experimental/CWE-918/validator.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ class FieldWithTags extends FieldDecl {
* For example: the tag `json:"word" binding:"required,alpha"` yields `key: "json", value: "word"`
* and `key: "binding" values: "required","alpha"`.
*/
predicate getTagByKeyValue(string key, string value) {
predicate hasTagKeyValue(string key, string value) {
exists(string tag, string key_value, string values |
this.getTag().toString() = tag and
// Each key_value is like key:"value1,value2"
Expand All @@ -50,7 +50,7 @@ class AlphanumericStructFieldRead extends DataFlow::Node {
exists(FieldWithTags decl, Field field, string tag |
this = field.getARead() and
field.getDeclaration() = decl.getNameExpr(0) and
decl.getTagByKeyValue(key, tag) and
decl.hasTagKeyValue(key, tag) and
isAlphanumericValidationKind(tag)
)
}
Expand Down
2 changes: 1 addition & 1 deletion go/ql/src/experimental/frameworks/DecompressionBombsCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -511,7 +511,7 @@ module DecompressionBombs {
}

/**
* Provides decompression bomb sinks for packages that use some standard IO interfaces/methods for reading decompressed data
* A standard IO function for reading decompressed data.
*/
class GeneralReadIoSink extends Sink {
GeneralReadIoSink() {
Expand Down
1 change: 0 additions & 1 deletion go/ql/test/library-tests/semmle/go/dataflow/GlobalVariableSideEffects/Flows.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ import go
import utils.test.InlineFlowTest

string getArgString(DataFlow::Node src, DataFlow::Node sink) {
exists(src) and
result =
"\"" + sink.toString() + " (from source " +
src.(DataFlow::CallNode).getArgument(0).getExactValue() + ")\""
Expand Down