Skip to content

Go: improve accuracy of overlay annotations#21740

Open
owen-mc wants to merge 1 commit intogithub:mainfrom
owen-mc:go/overlay-correctness
Open

Go: improve accuracy of overlay annotations#21740
owen-mc wants to merge 1 commit intogithub:mainfrom
owen-mc:go/overlay-correctness

Conversation

@owen-mc
Copy link
Copy Markdown
Contributor

@owen-mc owen-mc commented Apr 21, 2026

FuncDef.getACall() should be overlay[global]. This reduces the number of alerts that we miss in overlay mode.

I did 4 DCA runs, but only runs 3 and 4 need to be considered.

  1. Run 1 failed because of a latent performance issue, fixed in Go: refactor EncryptionOperation #21745.
  2. Run 2 was on a subset of one of the standard source suites, and therefore is not directly comparable with previous runs.
  3. Run 3 was on the source suite aimed at checking that we do not lose two many results. It shows that we now only have 2 missing results, which is an improvement on the 9 missing results previously. (Side note: the 2 results are not a subset of the previous 9, which I do not understand.)
  4. Run 4 was on the source suite aimed at testing performance. This showed a 31% reduction in analysis time. However, this is source suite is full of sources that take a very long time. The reduction in analysis time in run 3 was 14%. This source suite has many more repositories that don't take that long to analyse, which are probably more representative of the average repository.

@github-actions github-actions Bot added the Go label Apr 21, 2026
@owen-mc owen-mc force-pushed the go/overlay-correctness branch 2 times, most recently from 832ab71 to e37e103 Compare April 22, 2026 12:38
@owen-mc owen-mc marked this pull request as ready for review April 24, 2026 11:30
@owen-mc owen-mc requested a review from a team as a code owner April 24, 2026 11:30
@owen-mc owen-mc requested review from a team and Copilot April 24, 2026 11:30
@owen-mc owen-mc added the no-change-note-required This PR does not need a change note label Apr 24, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Go QL library overlays and crypto modeling to improve annotation accuracy and make encryption-operation modeling use explicit flow-target accessors.

Changes:

  • Refactors Cryptography::EncryptionOperation to require getEncryptionFlowTarget() and updates subclasses accordingly.
  • Adjusts overlay annotations (for example overlay[local?] and overlay[global]) on selected Go library modules/members to improve overlay behavior.
  • Updates crypto/cipher StreamReader/StreamWriter models to provide explicit encryption-target and input nodes via overrides.
Show a summary per file
File Description
go/ql/lib/semmle/go/frameworks/CryptoLibraries.qll Updates crypto/cipher stream operation models to override the new encryption flow target accessor and provide inputs explicitly.
go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll Tweaks overlay annotations and marks selected call-target resolution helpers as overlay[global].
go/ql/lib/semmle/go/Scopes.qll Updates module overlay annotation and marks Function.getACall() as overlay[global].
go/ql/lib/semmle/go/Decls.qll Updates module overlay annotation and marks FuncDef.getACall() as overlay[global].
go/ql/lib/semmle/go/Concepts.qll Refactors EncryptionOperation to use an abstract getEncryptionFlowTarget() and updates EncryptionMethodCall accordingly.

Copilot's findings

  • Files reviewed: 5/5 changed files
  • Comments generated: 0

Co-authored-by: Copilot <copilot@github.com>
@owen-mc owen-mc force-pushed the go/overlay-correctness branch from e37e103 to 710c1ba Compare April 24, 2026 11:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Go no-change-note-required This PR does not need a change note

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants