golang package import not binding metavariable

[ievans]

The snippet below works if you use a generic metavariable (eg $X) for the line inside $F, but not if you try to re-reference the $P metavar from the import.

import $P "github.com/sirupsen/logrus"

func $F() {
  ...
  $P.WithError(...).Info(...)
  ...
}

https://semgrep.dev/s/3e7K

[nbrahms]

Possibly related to #1771

[nbrahms]

Also see #2029

[mschwager]

Looks like we have the same thing in Python: https://semgrep.dev/s/5W70/

However, our Python equivalences mitigate this concern, so we can't really compare the two: https://semgrep.dev/s/GRqq/

I'll have to defer to @aryx on this one. Is it possible to do a similar equivalence as Python and have users specify the fully qualified name, e.g. logrus.WithError(...).Info(...), which automatically works with import aliasing?

[glb]

$P.WithError(...).Info(...), interestingly, matches both of the following:

  log.WithFields(nil).WithError(nil).Info("something")
  logctx.Foo().WithError(nil).Info("something")

which is ... good? ... but not especially expected.

[aryx]

log.WithFields(nil).WithError(nil).Info("something") is parsed as
( ( ( log.WithFields(nil) ) .WithError(nil) ).Info("something"))
so yes $P can match the log.WithFields(nil) expression

[aryx]

Note that fully qualifying with logrus.WithError(...).Info(...) currently works for Go too.
However, it feels like again, just like for attributes, forcing users to fully qualify is confusing.
I will allow to not fully qualify if the aliased name match the actual code.
We do that already for attributes/annotations.