Skip to content

Go: improve accuracy of overlay annotations#21740

Merged
owen-mc merged 1 commit intogithub:mainfrom
owen-mc:go/overlay-correctness
Apr 28, 2026
Merged

Go: improve accuracy of overlay annotations#21740
owen-mc merged 1 commit intogithub:mainfrom
owen-mc:go/overlay-correctness

Conversation

@owen-mc
Copy link
Copy Markdown
Contributor

@owen-mc owen-mc commented Apr 21, 2026

FuncDef.getACall() should be overlay[global]. This reduces the number of alerts that we miss in overlay mode.

I did 4 DCA runs, but only runs 3 and 4 need to be considered.

  1. Run 1 failed because of a latent performance issue, fixed in Go: refactor EncryptionOperation #21745.
  2. Run 2 was on a subset of one of the standard source suites, and therefore is not directly comparable with previous runs.
  3. Run 3 was on the source suite aimed at checking that we do not lose two many results. It shows that we now only have 2 missing results, which is an improvement on the 9 missing results previously. (Side note: the 2 results are not a subset of the previous 9, which I do not understand.)
  4. Run 4 was on the source suite aimed at testing performance. This showed a 31% reduction in analysis time. However, this is source suite is full of sources that take a very long time. The source suite used for run 3 contains mostly small repos, which are more representative. The reduction in analysis time in run 3 was 14%.

@github-actions github-actions Bot added the Go label Apr 21, 2026
@owen-mc owen-mc force-pushed the go/overlay-correctness branch 2 times, most recently from 832ab71 to e37e103 Compare April 22, 2026 12:38
@owen-mc owen-mc marked this pull request as ready for review April 24, 2026 11:30
@owen-mc owen-mc requested a review from a team as a code owner April 24, 2026 11:30
@owen-mc owen-mc requested review from a team and Copilot April 24, 2026 11:30
@owen-mc owen-mc added the no-change-note-required This PR does not need a change note label Apr 24, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Go QL library overlays and crypto modeling to improve annotation accuracy and make encryption-operation modeling use explicit flow-target accessors.

Changes:

  • Refactors Cryptography::EncryptionOperation to require getEncryptionFlowTarget() and updates subclasses accordingly.
  • Adjusts overlay annotations (for example overlay[local?] and overlay[global]) on selected Go library modules/members to improve overlay behavior.
  • Updates crypto/cipher StreamReader/StreamWriter models to provide explicit encryption-target and input nodes via overrides.
Show a summary per file
File Description
go/ql/lib/semmle/go/frameworks/CryptoLibraries.qll Updates crypto/cipher stream operation models to override the new encryption flow target accessor and provide inputs explicitly.
go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll Tweaks overlay annotations and marks selected call-target resolution helpers as overlay[global].
go/ql/lib/semmle/go/Scopes.qll Updates module overlay annotation and marks Function.getACall() as overlay[global].
go/ql/lib/semmle/go/Decls.qll Updates module overlay annotation and marks FuncDef.getACall() as overlay[global].
go/ql/lib/semmle/go/Concepts.qll Refactors EncryptionOperation to use an abstract getEncryptionFlowTarget() and updates EncryptionMethodCall accordingly.

Copilot's findings

  • Files reviewed: 5/5 changed files
  • Comments generated: 0

Co-authored-by: Copilot <copilot@github.com>
@owen-mc owen-mc force-pushed the go/overlay-correctness branch from e37e103 to 710c1ba Compare April 24, 2026 11:35
Copy link
Copy Markdown
Contributor

@aschackmull aschackmull left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@owen-mc owen-mc merged commit b07d2fb into github:main Apr 28, 2026
18 checks passed
@owen-mc owen-mc deleted the go/overlay-correctness branch April 28, 2026 10:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Go no-change-note-required This PR does not need a change note

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants