Skip to content

Commit dd50fe3

Browse files
erik-krogherik-krogh
authored
Merge pull request #10726 from erik-krogh/go-last-msg
Go: fix some more style-guide violations in the alert-messages
2 parents 4d75d88 + 99b7c77 commit dd50fe3

File tree

16 files changed

+62
-59
lines changed

16 files changed

+62
-59
lines changed

‎go/ql/lib/semmle/go/security/InsecureRandomnessCustomizations.qll

+2-2
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ module InsecureRandomness {
6464
)
6565
}
6666

67-
override string getKind() { result = "this cryptographic algorithm" }
67+
override string getKind() { result = "This cryptographic algorithm" }
6868
}
6969

7070
/**
@@ -75,7 +75,7 @@ module InsecureRandomness {
7575
this.getRoot().(FuncDef).getName().regexpMatch("(?i).*(gen(erate)?|salt|make|mk)Password.*")
7676
}
7777

78-
override string getKind() { result = "a password-related function" }
78+
override string getKind() { result = "A password-related function" }
7979
}
8080

8181
/** Gets a package that implements hash algorithms. */

‎go/ql/src/InconsistentCode/WrappedErrorAlwaysNil.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -61,4 +61,4 @@ where
6161
// }
6262
n = DataFlow::BarrierGuard<nilTestGuard/3>::getABarrierNode()
6363
)
64-
select n, "The first argument to 'errors.Wrap' is always nil"
64+
select n, "The first argument to 'errors.Wrap' is always nil."

‎go/ql/src/Security/CWE-020/SuspiciousCharacterInRegexp.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -48,5 +48,5 @@ class Config extends DataFlow::Configuration {
4848

4949
from Config c, DataFlow::PathNode source, DataFlow::PathNode sink, string report
5050
where c.hasFlowPath(source, sink) and c.isSource(source.getNode(), report)
51-
select source, source, sink, "$@ that is $@ contains " + report, source, "A string literal", sink,
51+
select source, source, sink, "This string literal that is $@ contains " + report, sink,
5252
"used as a regular expression"

‎go/ql/src/Security/CWE-117/LogInjection.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
1717

1818
from LogInjection::Configuration c, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where c.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "Log entry depends on a $@.", source.getNode(),
20+
select sink.getNode(), source, sink, "This log entry depends on a $@.", source.getNode(),
2121
"user-provided value"

‎go/ql/src/Security/CWE-338/InsecureRandomness.ql

+3-3
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ where
1919
cfg.hasFlowPath(source, sink) and
2020
cfg.isSink(sink.getNode(), kind) and
2121
(
22-
kind != "a password-related function"
22+
kind != "A password-related function"
2323
or
2424
sink =
2525
min(DataFlow::PathNode sink2, int line |
@@ -31,5 +31,5 @@ where
3131
)
3232
)
3333
select sink.getNode(), source, sink,
34-
"$@ generated with a cryptographically weak RNG is used in $@.", source.getNode(),
35-
"A random number", sink.getNode(), kind
34+
kind + " depends on a $@ generated with a cryptographically weak RNG.", source.getNode(),
35+
"random number"

‎go/ql/src/change-notes/2022-10-07-alert-messages.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.

‎go/ql/src/experimental/CWE-369/DivideByZero.ql

+1-2
Original file line numberDiff line numberDiff line change
@@ -54,5 +54,4 @@ class DivideByZeroCheckConfig extends TaintTracking::Configuration {
5454

5555
from DataFlow::PathNode source, DataFlow::PathNode sink, DivideByZeroCheckConfig cfg
5656
where cfg.hasFlowPath(source, sink)
57-
select sink, source, sink, "Variable $@ might be zero leading to a division-by-zero panic.", sink,
58-
sink.getNode().toString()
57+
select sink, source, sink, "This variable might be zero leading to a division-by-zero panic."

‎go/ql/src/experimental/CWE-400/DatabaseCallInLoop.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,4 +66,4 @@ query predicate edges(CallGraphNode pred, CallGraphNode succ) {
6666

6767
from LoopStmt loop, DatabaseAccess dbAccess
6868
where edges*(loop, dbAccess.asExpr())
69-
select dbAccess, loop, dbAccess, "$@ is called in $@", dbAccess, dbAccess.toString(), loop, "a loop"
69+
select dbAccess, loop, dbAccess, "This calls " + dbAccess.toString() + " in a $@.", loop, "loop"

‎go/ql/src/experimental/CWE-918/SSRF.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,4 @@ from
1919
where
2020
cfg.hasFlowPath(source, sink) and
2121
request = sink.getNode().(ServerSideRequestForgery::Sink).getARequest()
22-
select request, source, sink, "The URL of this request depends on a user-provided value"
22+
select request, source, sink, "The URL of this request depends on a user-provided value."

‎go/ql/src/experimental/IntegerOverflow/IntegerOverflow.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ import RangeAnalysis
1111

1212
from Expr expr
1313
where exprMayOverflow(expr) or exprMayUnderflow(expr)
14-
select expr, "this expression may cause an integer overflow"
14+
select expr, "This expression may cause an integer overflow."

‎go/ql/test/experimental/CWE-369/DivideByZero.expected

+6-6
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ nodes
2424
| DivideByZero.go:57:17:57:21 | value | semmle.label | value |
2525
subpaths
2626
#select
27-
| DivideByZero.go:12:16:12:20 | value | DivideByZero.go:10:12:10:16 | selection of URL : pointer type | DivideByZero.go:12:16:12:20 | value | Variable $@ might be zero leading to a division-by-zero panic. | DivideByZero.go:12:16:12:20 | value | value |
28-
| DivideByZero.go:19:16:19:20 | value | DivideByZero.go:17:12:17:16 | selection of URL : pointer type | DivideByZero.go:19:16:19:20 | value | Variable $@ might be zero leading to a division-by-zero panic. | DivideByZero.go:19:16:19:20 | value | value |
29-
| DivideByZero.go:26:16:26:20 | value | DivideByZero.go:24:12:24:16 | selection of URL : pointer type | DivideByZero.go:26:16:26:20 | value | Variable $@ might be zero leading to a division-by-zero panic. | DivideByZero.go:26:16:26:20 | value | value |
30-
| DivideByZero.go:33:16:33:20 | value | DivideByZero.go:31:12:31:16 | selection of URL : pointer type | DivideByZero.go:33:16:33:20 | value | Variable $@ might be zero leading to a division-by-zero panic. | DivideByZero.go:33:16:33:20 | value | value |
31-
| DivideByZero.go:40:16:40:20 | value | DivideByZero.go:38:12:38:16 | selection of URL : pointer type | DivideByZero.go:40:16:40:20 | value | Variable $@ might be zero leading to a division-by-zero panic. | DivideByZero.go:40:16:40:20 | value | value |
32-
| DivideByZero.go:57:17:57:21 | value | DivideByZero.go:54:12:54:16 | selection of URL : pointer type | DivideByZero.go:57:17:57:21 | value | Variable $@ might be zero leading to a division-by-zero panic. | DivideByZero.go:57:17:57:21 | value | value |
27+
| DivideByZero.go:12:16:12:20 | value | DivideByZero.go:10:12:10:16 | selection of URL : pointer type | DivideByZero.go:12:16:12:20 | value | This variable might be zero leading to a division-by-zero panic. |
28+
| DivideByZero.go:19:16:19:20 | value | DivideByZero.go:17:12:17:16 | selection of URL : pointer type | DivideByZero.go:19:16:19:20 | value | This variable might be zero leading to a division-by-zero panic. |
29+
| DivideByZero.go:26:16:26:20 | value | DivideByZero.go:24:12:24:16 | selection of URL : pointer type | DivideByZero.go:26:16:26:20 | value | This variable might be zero leading to a division-by-zero panic. |
30+
| DivideByZero.go:33:16:33:20 | value | DivideByZero.go:31:12:31:16 | selection of URL : pointer type | DivideByZero.go:33:16:33:20 | value | This variable might be zero leading to a division-by-zero panic. |
31+
| DivideByZero.go:40:16:40:20 | value | DivideByZero.go:38:12:38:16 | selection of URL : pointer type | DivideByZero.go:40:16:40:20 | value | This variable might be zero leading to a division-by-zero panic. |
32+
| DivideByZero.go:57:17:57:21 | value | DivideByZero.go:54:12:54:16 | selection of URL : pointer type | DivideByZero.go:57:17:57:21 | value | This variable might be zero leading to a division-by-zero panic. |

‎go/ql/test/experimental/CWE-400/DatabaseCallInLoop.expected

+3-3
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,6 @@ edges
88
| test.go:24:2:26:2 | for statement | test.go:25:3:25:17 | call to runRunQuery |
99
| test.go:25:3:25:17 | call to runRunQuery | test.go:14:1:16:1 | function declaration |
1010
#select
11-
| DatabaseCallInLoop.go:9:3:9:41 | call to First | DatabaseCallInLoop.go:7:2:11:2 | range statement | DatabaseCallInLoop.go:9:3:9:41 | call to First | $@ is called in $@ | DatabaseCallInLoop.go:9:3:9:41 | call to First | call to First | DatabaseCallInLoop.go:7:2:11:2 | range statement | a loop |
12-
| test.go:11:2:11:13 | call to Take | test.go:20:2:22:2 | for statement | test.go:11:2:11:13 | call to Take | $@ is called in $@ | test.go:11:2:11:13 | call to Take | call to Take | test.go:20:2:22:2 | for statement | a loop |
13-
| test.go:11:2:11:13 | call to Take | test.go:24:2:26:2 | for statement | test.go:11:2:11:13 | call to Take | $@ is called in $@ | test.go:11:2:11:13 | call to Take | call to Take | test.go:24:2:26:2 | for statement | a loop |
11+
| DatabaseCallInLoop.go:9:3:9:41 | call to First | DatabaseCallInLoop.go:7:2:11:2 | range statement | DatabaseCallInLoop.go:9:3:9:41 | call to First | This calls call to First in a $@. | DatabaseCallInLoop.go:7:2:11:2 | range statement | loop |
12+
| test.go:11:2:11:13 | call to Take | test.go:20:2:22:2 | for statement | test.go:11:2:11:13 | call to Take | This calls call to Take in a $@. | test.go:20:2:22:2 | for statement | loop |
13+
| test.go:11:2:11:13 | call to Take | test.go:24:2:26:2 | for statement | test.go:11:2:11:13 | call to Take | This calls call to Take in a $@. | test.go:24:2:26:2 | for statement | loop |

‎go/ql/test/experimental/CWE-918/SSRF.expected

+17-17
Original file line numberDiff line numberDiff line change
@@ -55,20 +55,20 @@ nodes
5555
| new-tests.go:96:11:96:46 | ...+... | semmle.label | ...+... |
5656
subpaths
5757
#select
58-
| builtin.go:22:12:22:63 | call to Get | builtin.go:19:12:19:34 | call to FormValue : string | builtin.go:22:21:22:62 | ...+... | The URL of this request depends on a user-provided value |
59-
| builtin.go:88:12:88:53 | call to Dial | builtin.go:83:21:83:31 | call to Referer : string | builtin.go:88:27:88:40 | untrustedInput | The URL of this request depends on a user-provided value |
60-
| builtin.go:102:13:102:40 | call to DialConfig | builtin.go:97:21:97:31 | call to Referer : string | builtin.go:101:36:101:49 | untrustedInput | The URL of this request depends on a user-provided value |
61-
| builtin.go:114:3:114:39 | call to Dial | builtin.go:111:21:111:31 | call to Referer : string | builtin.go:114:15:114:28 | untrustedInput | The URL of this request depends on a user-provided value |
62-
| builtin.go:132:3:132:62 | call to DialContext | builtin.go:129:21:129:31 | call to Referer : string | builtin.go:132:38:132:51 | untrustedInput | The URL of this request depends on a user-provided value |
63-
| new-tests.go:31:2:31:58 | call to Get | new-tests.go:26:26:26:30 | &... : pointer type | new-tests.go:31:11:31:57 | call to Sprintf | The URL of this request depends on a user-provided value |
64-
| new-tests.go:32:2:32:58 | call to Get | new-tests.go:26:26:26:30 | &... : pointer type | new-tests.go:32:11:32:57 | call to Sprintf | The URL of this request depends on a user-provided value |
65-
| new-tests.go:35:3:35:59 | call to Get | new-tests.go:26:26:26:30 | &... : pointer type | new-tests.go:35:12:35:58 | call to Sprintf | The URL of this request depends on a user-provided value |
66-
| new-tests.go:47:2:47:47 | call to Get | new-tests.go:39:18:39:30 | call to Param : string | new-tests.go:47:11:47:46 | ...+... | The URL of this request depends on a user-provided value |
67-
| new-tests.go:50:2:50:47 | call to Get | new-tests.go:49:18:49:30 | call to Query : string | new-tests.go:50:11:50:46 | ...+... | The URL of this request depends on a user-provided value |
68-
| new-tests.go:68:2:68:58 | call to Get | new-tests.go:62:31:62:38 | selection of Body : ReadCloser | new-tests.go:68:11:68:57 | call to Sprintf | The URL of this request depends on a user-provided value |
69-
| new-tests.go:69:2:69:58 | call to Get | new-tests.go:62:31:62:38 | selection of Body : ReadCloser | new-tests.go:69:11:69:57 | call to Sprintf | The URL of this request depends on a user-provided value |
70-
| new-tests.go:74:3:74:59 | call to Get | new-tests.go:62:31:62:38 | selection of Body : ReadCloser | new-tests.go:74:12:74:58 | call to Sprintf | The URL of this request depends on a user-provided value |
71-
| new-tests.go:79:2:79:47 | call to Get | new-tests.go:78:18:78:24 | selection of URL : pointer type | new-tests.go:79:11:79:46 | ...+... | The URL of this request depends on a user-provided value |
72-
| new-tests.go:82:2:82:47 | call to Get | new-tests.go:81:37:81:43 | selection of URL : pointer type | new-tests.go:82:11:82:46 | ...+... | The URL of this request depends on a user-provided value |
73-
| new-tests.go:88:2:88:47 | call to Get | new-tests.go:86:10:86:20 | call to Vars : map type | new-tests.go:88:11:88:46 | ...+... | The URL of this request depends on a user-provided value |
74-
| new-tests.go:96:2:96:47 | call to Get | new-tests.go:95:18:95:45 | call to URLParam : string | new-tests.go:96:11:96:46 | ...+... | The URL of this request depends on a user-provided value |
58+
| builtin.go:22:12:22:63 | call to Get | builtin.go:19:12:19:34 | call to FormValue : string | builtin.go:22:21:22:62 | ...+... | The URL of this request depends on a user-provided value. |
59+
| builtin.go:88:12:88:53 | call to Dial | builtin.go:83:21:83:31 | call to Referer : string | builtin.go:88:27:88:40 | untrustedInput | The URL of this request depends on a user-provided value. |
60+
| builtin.go:102:13:102:40 | call to DialConfig | builtin.go:97:21:97:31 | call to Referer : string | builtin.go:101:36:101:49 | untrustedInput | The URL of this request depends on a user-provided value. |
61+
| builtin.go:114:3:114:39 | call to Dial | builtin.go:111:21:111:31 | call to Referer : string | builtin.go:114:15:114:28 | untrustedInput | The URL of this request depends on a user-provided value. |
62+
| builtin.go:132:3:132:62 | call to DialContext | builtin.go:129:21:129:31 | call to Referer : string | builtin.go:132:38:132:51 | untrustedInput | The URL of this request depends on a user-provided value. |
63+
| new-tests.go:31:2:31:58 | call to Get | new-tests.go:26:26:26:30 | &... : pointer type | new-tests.go:31:11:31:57 | call to Sprintf | The URL of this request depends on a user-provided value. |
64+
| new-tests.go:32:2:32:58 | call to Get | new-tests.go:26:26:26:30 | &... : pointer type | new-tests.go:32:11:32:57 | call to Sprintf | The URL of this request depends on a user-provided value. |
65+
| new-tests.go:35:3:35:59 | call to Get | new-tests.go:26:26:26:30 | &... : pointer type | new-tests.go:35:12:35:58 | call to Sprintf | The URL of this request depends on a user-provided value. |
66+
| new-tests.go:47:2:47:47 | call to Get | new-tests.go:39:18:39:30 | call to Param : string | new-tests.go:47:11:47:46 | ...+... | The URL of this request depends on a user-provided value. |
67+
| new-tests.go:50:2:50:47 | call to Get | new-tests.go:49:18:49:30 | call to Query : string | new-tests.go:50:11:50:46 | ...+... | The URL of this request depends on a user-provided value. |
68+
| new-tests.go:68:2:68:58 | call to Get | new-tests.go:62:31:62:38 | selection of Body : ReadCloser | new-tests.go:68:11:68:57 | call to Sprintf | The URL of this request depends on a user-provided value. |
69+
| new-tests.go:69:2:69:58 | call to Get | new-tests.go:62:31:62:38 | selection of Body : ReadCloser | new-tests.go:69:11:69:57 | call to Sprintf | The URL of this request depends on a user-provided value. |
70+
| new-tests.go:74:3:74:59 | call to Get | new-tests.go:62:31:62:38 | selection of Body : ReadCloser | new-tests.go:74:12:74:58 | call to Sprintf | The URL of this request depends on a user-provided value. |
71+
| new-tests.go:79:2:79:47 | call to Get | new-tests.go:78:18:78:24 | selection of URL : pointer type | new-tests.go:79:11:79:46 | ...+... | The URL of this request depends on a user-provided value. |
72+
| new-tests.go:82:2:82:47 | call to Get | new-tests.go:81:37:81:43 | selection of URL : pointer type | new-tests.go:82:11:82:46 | ...+... | The URL of this request depends on a user-provided value. |
73+
| new-tests.go:88:2:88:47 | call to Get | new-tests.go:86:10:86:20 | call to Vars : map type | new-tests.go:88:11:88:46 | ...+... | The URL of this request depends on a user-provided value. |
74+
| new-tests.go:96:2:96:47 | call to Get | new-tests.go:95:18:95:45 | call to URLParam : string | new-tests.go:96:11:96:46 | ...+... | The URL of this request depends on a user-provided value. |

‎go/ql/test/query-tests/InconsistentCode/WrappedErrorAlwaysNil/WrappedErrorAlwaysNil.expected

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
| WrappedErrorAlwaysNil.go:31:22:31:24 | err | The first argument to 'errors.Wrap' is always nil |
2-
| WrappedErrorAlwaysNil.go:41:14:41:16 | nil | The first argument to 'errors.Wrap' is always nil |
3-
| WrappedErrorAlwaysNil.go:45:14:45:16 | err | The first argument to 'errors.Wrap' is always nil |
4-
| WrappedErrorAlwaysNil.go:49:14:49:21 | localErr | The first argument to 'errors.Wrap' is always nil |
1+
| WrappedErrorAlwaysNil.go:31:22:31:24 | err | The first argument to 'errors.Wrap' is always nil. |
2+
| WrappedErrorAlwaysNil.go:41:14:41:16 | nil | The first argument to 'errors.Wrap' is always nil. |
3+
| WrappedErrorAlwaysNil.go:45:14:45:16 | err | The first argument to 'errors.Wrap' is always nil. |
4+
| WrappedErrorAlwaysNil.go:49:14:49:21 | localErr | The first argument to 'errors.Wrap' is always nil. |

0 commit comments

Comments
 (0)