Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit c19c16c

Browse files
max-schaefermax-schaefer
authored
Merge pull request #106 from github/1.24/SD-61-Go-finalize-notes
1.24 release: finalize change notes for Go
2 parents 0054680 + 70525d0 commit c19c16c

2 files changed

Lines changed: 21 additions & 18 deletions

File tree

‎change-notes/1.24/analysis-go.md‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
## General improvements
44

5-
* Alert suppression can now be done with single-line block comments (`/* ... */`) as well as line comments (`// ...`).
5+
* You can now suppress alerts using either single-line block comments (`/* ... */`) or line comments (`// ...`).
66
* Analysis of flow through fields and elements of arrays and slices has been improved, which may lead to more results from the security queries.
77
* Detection of test code has been improved. LGTM will not show alerts in test code by default.
88
* Go 1.14 library changes have been modeled.
9-
* More sources of untrusted input as well as vulnerable sinks are modelled, which may lead to more results from the security queries.
9+
* More sources of untrusted input as well as vulnerable sinks are modeled, which may lead to more results from the security queries.
1010

1111
## New queries
1212

@@ -26,14 +26,14 @@ The CodeQL library for Go now contains a folder of simple "cookbook" queries tha
2626

2727
## Changes to existing queries
2828

29-
| **Query** | **Expected impact** | **Change** |
30-
|-------------------------------------------------------------------------------|-----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
31-
| Arbitrary file write during zip extraction ("zip slip") (`go/zipslip`) | Fewer false positives | The query now recognizes more cases where it is safe to use a path extractor from an archive. |
32-
| Bitwise exclusive-or used like exponentiation (`go/mistyped-exponentiation`) | Fewer false positives | The query now identifies when the value of an xor is assigned to a mask object, and excludes such results. |
33-
| Command built from user-controlled sources (`go/command-injection`) | More results | The library models used by the query have been improved, allowing it to flag more potentially problematic cases, including sources that flow into shells, sudo, or programming-language interpreters as arguments. |
34-
| Database query built from user-controlled sources (`go/sql-injection`) | More results | The library models used by the query have been improved, allowing it to flag more potentially problematic cases. |
35-
| Identical operands (`go/redundant-operation`) | Fewer false positives | The query no longer flags cases where the operands have the same value but are syntactically distinct, since this is usually intentional. |
36-
| Incomplete regular expression for hostnames (`go/incomplete-hostname-regexp`) | More results | The query now flags unescaped dots before the TLD in a hostname regex. |
37-
| Open URL redirect (`go/unvalidated-url-redirection`) | Fewer false positives | The query now identifies some sources that are not attacker-controlled, and excludes results with such sources. |
38-
| Reflected cross-site scripting (`go/reflected-xss`) | Fewer results | Untrusted input flowing into an HTTP header definition or into an `fmt.Fprintf` call with a constant prefix is no longer flagged, since it is in both cases often harmless. |
39-
| Useless assignment to field (`go/useless-assignment-to-field`) | Fewer false positives | The query now conservatively handles fields promoted through embedded pointer types. |
29+
| **Query** | **Expected impact** | **Change** |
30+
|-------------------------------------------------------------------------------|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
31+
| Arbitrary file write during zip extraction ("zip slip") (`go/zipslip`) | Fewer false positive results | The query now excludes more cases where it is safe to use a path extractor from an archive. |
32+
| Bitwise exclusive-or used like exponentiation (`go/mistyped-exponentiation`) | Fewer false positive results | The query now identifies when the value of an xor is assigned to a mask object, and excludes such results. |
33+
| Command built from user-controlled sources (`go/command-injection`) | More results | The library models used by the query have been improved, allowing it to flag more potentially problematic cases, including sources that flow into shells, sudo, or programming-language interpreters as arguments. |
34+
| Database query built from user-controlled sources (`go/sql-injection`) | More results | The library models used by the query have been improved, allowing it to flag more potentially problematic cases. |
35+
| Identical operands (`go/redundant-operation`) | Fewer false positive results | The query no longer flags cases where the operands have the same value but are syntactically distinct, since this is usually intentional. |
36+
| Incomplete regular expression for hostnames (`go/incomplete-hostname-regexp`) | More results | The query now flags unescaped dots before the TLD in a hostname regex. |
37+
| Open URL redirect (`go/unvalidated-url-redirection`) | Fewer false positive results | The query now identifies some sources that are not attacker-controlled, and excludes results with such sources. |
38+
| Reflected cross-site scripting (`go/reflected-xss`) | Fewer results | Untrusted input flowing into an HTTP header definition or into an `fmt.Fprintf` call with a constant prefix is no longer flagged, since it is in both cases often harmless. |
39+
| Useless assignment to field (`go/useless-assignment-to-field`) | Fewer false positive results | The query now conservatively handles fields promoted through embedded pointer types. |

‎change-notes/1.24/extractor-go.md‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,18 @@
22

33
# Improvements to Go analysis
44

5+
## Improvements to the autobuilder
6+
7+
* When Makefiles or custom build scripts are present in the codebase, the autobuilder uses them to install dependencies. The build command
8+
to invoke can be configured via `lgtm.yml`, or by setting the environment variable `CODEQL_EXTRACTOR_GO_BUILD_COMMAND`.
9+
* The autobuilder now attempts to automatically detect when dependencies have been vendored and use `-mod=vendor` appropriately.
10+
511
## Changes to code extraction
612

13+
* The extractor now supports Go 1.14.
714
* In resource-constrained environments, the environment variable `CODEQL_EXTRACTOR_GO_MAX_GOROUTINES` can be used to limit the
815
number of parallel goroutines started by the extractor, which reduces CPU and memory requirements. The default value for this
916
variable is 32.
10-
* The autobuilder now runs Makefiles or custom build scripts present in the codebase to install dependencies. The build command
11-
to invoke can be configured via `lgtm.yml`, or by setting the environment variable `CODEQL_EXTRACTOR_GO_BUILD_COMMAND`.
12-
* The autobuilder now attempts to automatically detect when dependencies have been vendored and use `-mod=vendor` appropriately.
1317
* The extractor now uses buffered i/o for writing database files, which reduces the amount of time taken for extraction.
1418
* The extractor now compresses intermediate files used for constructing databases, which reduces the amount of disk space it requires.
15-
* The extractor now supports extracting go.mod files, enabling queries on dependencies and their versions.
16-
* The extractor now supports Go 1.14.
19+
* The extractor now supports extracting `go.mod` files, enabling queries on dependencies and their versions.

0 commit comments

Comments
 (0)