Go: (Refactor) Use makeSsa for SSA classes by owen-mc · Pull Request #22857 · github/codeql

owen-mc · 2026-10-20T17:23:04Z

No description provided.

Co-authored-by: Copilot <[email protected]>

These tests fail until type-switch implicit variable assignments are modeled as write instructions in the next commit. Co-authored-by: Copilot <[email protected]>

Co-authored-by: Copilot <[email protected]>

Copilot

🔵 Needs a closer look

The foundational SSA/IR migration has unresolved behavior and compatibility regressions that need human validation.

3 open issues

What changed in this PR

Refactors Go’s static single-assignment (SSA) analysis to use shared CodeQL classes.

Changes:

Migrates data-flow, control-flow, framework models, and queries to definition-based APIs.
Adds deprecated compatibility classes and explicit type-switch write targets.
Updates test expectations, annotation comments, and migration notes.

File	Description
go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/BadRedirectCheck.expected	Updates parameter labels.
go/ql/test/query-tests/Security/CWE-347/MissingJwtSignatureCheck.expected	Updates parameter labels.
go/ql/test/query-tests/Security/CWE-326/InsufficientKeySize.expected	Updates labels and section ordering.
go/ql/test/query-tests/Security/CWE-322/InsecureHostKeyCallback.expected	Updates parameter labels.
go/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected	Updates parameter labels.
go/ql/test/query-tests/Security/CWE-079/StoredXss.expected	Updates parameter labels.
go/ql/test/query-tests/Security/CWE-022/ZipSlip.expected	Updates parameter labels.
go/ql/test/query-tests/Security/CWE-022/UnsafeUnzipSymlink.expected	Updates parameter labels.
go/ql/test/query-tests/InconsistentCode/UnhandledCloseWritableHandle/UnhandledCloseWritableHandle.expected	Updates parameter and capture labels.
go/ql/test/library-tests/semmle/go/frameworks/Twirp/RequestForgery.expected	Updates parameter and capture labels.
go/ql/test/library-tests/semmle/go/frameworks/gqlgen/graph/schema.resolvers.go	Updates an expectation comment only.
go/ql/test/library-tests/semmle/go/frameworks/GoMicro/main.go	Updates an expectation comment only.
go/ql/test/library-tests/semmle/go/frameworks/GoMicro/LogInjection.expected	Updates request-parameter labels.
go/ql/test/library-tests/semmle/go/frameworks/GoKit/main.go	Updates expectation comments only.
go/ql/test/library-tests/semmle/go/frameworks/Beego/CleartextLogging.expected	Updates parameter labels.
go/ql/test/library-tests/semmle/go/dataflow/SSA/SsaWithFields.expected	Updates definition labels.
go/ql/test/library-tests/semmle/go/dataflow/SSA/SsaDefinition.expected	Updates definition labels.
go/ql/test/library-tests/semmle/go/dataflow/SSA/DefUse.ql	Queries definition-based expression reads.
go/ql/test/library-tests/semmle/go/dataflow/SSA/DefUse.expected	Reflects expression-read results.
go/ql/test/library-tests/semmle/go/dataflow/FunctionInputsAndOutputs/FunctionInput_getExitNode.expected	Updates parameter labels.
go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalFlowStep.expected	Updates parameter and capture labels.
go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/srcs.expected	Updates source-parameter labels.
go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/srcs.expected	Updates source-parameter labels.
go/ql/test/experimental/Unsafe/WrongUsageOfUnsafe.expected	Updates parameter labels.
go/ql/test/experimental/CWE-522-DecompressionBombs/DecompressionBombs.expected	Updates parameter labels.
go/ql/test/example-tests/snippets/typeinfo.expected	Updates a parameter label.
go/ql/src/RedundantCode/DeadStoreOfLocal.ql	Uses explicit-write definitions.
go/ql/src/RedundantCode/DeadStoreOfField.ql	Uses the renamed definition predicate.
go/ql/src/InconsistentCode/WrappedErrorAlwaysNil.ql	Uses definition-based reads.
go/ql/src/InconsistentCode/MissingErrorCheck.ql	Migrates phi-input lookup.
go/ql/src/experimental/IntegerOverflow/RangeAnalysis.qll	Migrates range analysis to shared definitions.
go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll	Uses base definitions.
go/ql/lib/semmle/go/frameworks/RsCors.qll	Migrates configuration-definition lookup.
go/ql/lib/semmle/go/frameworks/Macaron.qll	Uses base definitions.
go/ql/lib/semmle/go/frameworks/GinCors.qll	Migrates configuration-definition lookup.
go/ql/lib/semmle/go/frameworks/Fasthttp.qll	Uses base definitions.
go/ql/lib/semmle/go/frameworks/Beego.qll	Uses base definitions.
go/ql/lib/semmle/go/dataflow/SsaImpl.qll	Instantiates shared SSA classes.
go/ql/lib/semmle/go/dataflow/SSA.qll	Exports shared classes and compatibility wrappers.
go/ql/lib/semmle/go/dataflow/internal/DataFlowUtil.qll	Accepts definitions in the SSA-node helper.
go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll	Migrates local flow and capture handling.
go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll	Integrates shared definitions into flow nodes.
go/ql/lib/semmle/go/dataflow/GlobalValueNumbering.qll	Uses shared explicit-write definitions.
go/ql/lib/semmle/go/controlflow/IR.qll	Models type-switch write targets.
go/ql/lib/semmle/go/controlflow/Guards.qll	Reuses shared SSA classes.
go/ql/lib/semmle/go/controlflow/ControlFlowGraph.qll	Renames the definition predicate.
go/ql/lib/change-notes/2026-10-20-shared-ssa.md	Documents the breaking API migration.

_{Review effort: Max}

Co-authored-by: Copilot <[email protected]>

…tions

Copilot

🔵 Needs a closer look

The foundational SSA and public API migration needs expert compatibility review backed by full Go regression results.

4 open issues

3 resolved since last review

_{Review effort: Max}

+    /** Holds if this node defines SSA definition `def` to be `rhs`. */
+    predicate definesSsaDefinition(SsaDefinition def, DataFlow::Node rhs) {
+      super.getLhs().asSsaDefinition() = def and
      super.getRhs() = rhs.asInstruction()
    }


+    /** Gets the SSA definition being written to, if any. */
+    SsaDefinition asSsaDefinition() { this.getWrite() = result.(SsaExplicitWrite).getDefinition() }


   * corresponding to `a.b`.
   */
-  SsaVariable getBaseVariable() {
+  SsaDefinition getBaseDefinition() {


+    predicate readsSsaDefinition(SsaDefinition def) {
+      exists(SsaNode ssa | ssa.getDefinition() = def and this = ssa.getAUse())


github-advanced-security Bot found potential problems Oct 20, 2026

View reviewed changes

Comment thread go/ql/lib/semmle/go/dataflow/SSA.qll Fixed

Comment thread go/ql/lib/semmle/go/dataflow/SSA.qll Fixed

Comment thread go/ql/lib/semmle/go/dataflow/SSA.qll Fixed

Comment thread go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll Fixed

github-actions Bot added documentation Go labels Oct 20, 2026

owen-mc force-pushed the go/make-ssa branch from 200eee3 to 024f618 Compare October 20, 2026 21:03

owen-mc and others added 6 commits October 21, 2026 14:22

Add shared Go SSA module

c5593d5

Co-authored-by: Copilot <[email protected]>

Migrate Go to shared SSA classes

56a1bc5

Co-authored-by: Copilot <[email protected]>

Accept test changes due to renamed SSA classes

b059a0a

Add expected failures for type-switch SSA writes

fb0f33d

These tests fail until type-switch implicit variable assignments are modeled as write instructions in the next commit. Co-authored-by: Copilot <[email protected]>

Fix type-switch SSA writes

786995d

Document shared Go SSA migration

7d8b19e

Co-authored-by: Copilot <[email protected]>

owen-mc force-pushed the go/make-ssa branch from 024f618 to 7d8b19e Compare October 21, 2026 13:23

owen-mc marked this pull request as ready for review October 21, 2026 13:25

Copilot AI max review requested due to automatic review settings October 21, 2026 13:25

owen-mc requested a review from a team as a code owner October 21, 2026 13:25

Copilot started reviewing on behalf of owen-mc October 21, 2026 13:26

View session

Copilot AI reviewed Oct 21, 2026

View reviewed changes

Comment thread go/ql/lib/semmle/go/dataflow/SSA.qll

Comment thread go/ql/lib/semmle/go/dataflow/SSA.qll Outdated

Comment thread go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll Outdated

owen-mc and others added 2 commits October 22, 2026 10:03

Restore SsaVariable compatibility accessor

e7027fb

Co-authored-by: Copilot <[email protected]>

Get around SsaDefinition.getARead not including result read instruc…

a4cb199

…tions

owen-mc requested a max review from Copilot October 22, 2026 09:22

Copilot started reviewing on behalf of owen-mc October 22, 2026 09:22

View session

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Navigation Menu

Repository navigation

Go: (Refactor) Use makeSsa for SSA classes - #22857

Go: (Refactor) Use makeSsa for SSA classes#22857
owen-mc wants to merge 8 commits into
github:mainfrom
owen-mc:go/make-ssa

owen-mc commented Oct 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		/** Gets the SSA definition being written to, if any. */
		SsaDefinition asSsaDefinition() { this.getWrite() = result.(SsaExplicitWrite).getDefinition() }

		predicate readsSsaDefinition(SsaDefinition def) {
		exists(SsaNode ssa \| ssa.getDefinition() = def and this = ssa.getAUse())

Conversation

owen-mc commented Oct 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants