Go: New File System Access Sinks

[am0o0]

I added new important System File Access Sinks.
I didn't know how to complete the Library Tests.
Also I put all the things in one query file, I knew that there was frameworks for some of these new sinks but I wanted to keep this pull request simple for review, I think It'll be better if I wait for your suggestion about move each new sink to a proper location.
Please to Skip writing your own local tests refer to following: https://github.com/amammad/afero_And_WebServers

[am0o0]

Hi, I just added some comments so there aren't new updates. for better review quality.
Besides The fasthttp already is modeled in its library now, should I remove the fasthttp class from this pull request now?

[owen-mc]

Thank you very much for this contribution. I've suggested some changes to make it more consistent with the way the rest of our code is written.

[owen-mc]

You also need to add a change note (details here). And the tests are failing because they aren't building correctly - for some reason it can't find the vendored dependencies. I'll look into it more next week.

[am0o0]

@owen-mc thanks for helping me to improve the quality of my pull request. how much time do usually I have to fix and submit the suggestion generally in the codeql repository?

[owen-mc]

@amammad There is no great hurry. If you take more than a month I might ask if you plan to do it at some point or not. I do recommend not leaving them too long, when possible, because sometimes other changes get merged in which cause merge conflicts or require some changes to the PR.

[owen-mc]

I've looked into why the test is failing. You need to make stubs for New, Compression, Context, in github.com/kataras/iris/v12. And similarly you need to stub more things for some of the other libraries too. If you run go build . in the test directory then you will get error messages which tell you what's missing.

[am0o0]

@owen-mc Hi, I've created an Afero module that supports sanitizer now!
Also, I need to put the additional taint step in the related query file( like the path traversal query).

[owen-mc]

Thank you for addressing all my review comments. The tests would be much better if they were rewritten using InlineExpectationsTest. See here and here for an example. This makes it much easier to read tests because the expected output is contained in comments in the test file itself.

[owen-mc]

This is looking really good. Just a few small comments. Also, I'm afraid to say that these models should be moved into different files, one for each library. There are already files for Beego, Gin and Echo. You can make ones for the others. (There is one for Fiber in the experimental folder, which you can ignore.) The tests will have to be split and moved as well.

[owen-mc]

You can put JWT.qll in go/ql/src/experimental/frameworks/JWT.qll and import it as import experimental.frameworks.JWT.

Can I just double check that the additional flow steps are valid for any query, not just this one? The way you’ve done it is fine. When this query is promoted they will probably be changed to yml models, but those can’t be used for experimental queries.

I haven't reviewed the tests yet. I will do that when I can find time.

[owen-mc]

The following files need to be reformatted:

./ql/test/library-tests/semmle/go/frameworks/Beego/test.go ./ql/test/library-tests/semmle/go/frameworks/Echo/test.go ./ql/test/library-tests/semmle/go/frameworks/Afero/main.go ./ql/test/library-tests/semmle/go/frameworks/Fiber/test.go ./ql/test/library-tests/semmle/go/frameworks/Iris/test.go

I'm not sure if you can see the output of CI, but the formatting check wasn't printing which files need to be reformatted, so I have made a PR to fix that.

[am0o0]

@owen-mc I'm so sorry for many mistakes!
it seems that there were some mistakes that I don't know why I couldn't notice, I think the go build command error was my problem which I didn't notice after running the codeql test too.

[owen-mc]

No problem. There is one compile error left for Beego:

| test.go:46:23:46:23 | undefined: beego.BeegoOutput |

[owen-mc]

It's beginning to look really good. Just a few more comments.

[owen-mc]

Thank you for your contribution!