Merge branch 'main' into add-cwe-208

Author: boveus

config/identical-files.json

@@ -22,7 +22,6 @@
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll",
     "go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll",
     "go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll",
-    "go/ql/lib/semmle/go/dataflow/internal/DataFlowImplForStringsNewReplacer.qll",
     "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll",
     "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll",
     "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",
@@ -572,4 +571,4 @@
     "python/ql/lib/semmle/python/security/internal/EncryptionKeySizes.qll",
     "java/ql/lib/semmle/code/java/security/internal/EncryptionKeySizes.qll"
   ]
-}
+}

go/ql/lib/semmle/go/StringOps.qll

@@ -3,7 +3,6 @@
  */
 
 import go
-private import semmle.go.dataflow.DataFlowForStringsNewReplacer
 
 /** Provides predicates and classes for working with string operations. */
 module StringOps {
@@ -223,39 +222,32 @@ module StringOps {
       }
     }
 
-    /**
-     * A configuration for tracking flow from a call to `strings.NewReplacer` to
-     * the receiver of a call to `strings.Replacer.Replace` or
-     * `strings.Replacer.WriteString`.
-     */
-    private class StringsNewReplacerConfiguration extends DataFlowForStringsNewReplacer::Configuration
-    {
-      StringsNewReplacerConfiguration() { this = "StringsNewReplacerConfiguration" }
-
-      override predicate isSource(DataFlow::Node source) {
-        source instanceof StringsNewReplacerCall
-      }
+    private module StringsNewReplacerConfig implements DataFlow::ConfigSig {
+      predicate isSource(DataFlow::Node source) { source instanceof StringsNewReplacerCall }
 
-      override predicate isSink(DataFlow::Node sink) {
+      predicate isSink(DataFlow::Node sink) {
         exists(DataFlow::MethodCallNode call |
           sink = call.getReceiver() and
           call.getTarget().hasQualifiedName("strings", "Replacer", ["Replace", "WriteString"])
         )
       }
     }
 
+    /**
+     * Tracks data flow from a call to `strings.NewReplacer` to the receiver of
+     * a call to `strings.Replacer.Replace` or `strings.Replacer.WriteString`.
+     */
+    private module StringsNewReplacerFlow = DataFlow::Global<StringsNewReplacerConfig>;
+
     /**
      * A call to `strings.Replacer.Replace` or `strings.Replacer.WriteString`.
      */
     private class StringsReplacerReplaceOrWriteString extends Range {
       string replacedString;
 
       StringsReplacerReplaceOrWriteString() {
-        exists(
-          StringsNewReplacerConfiguration config, StringsNewReplacerCall source,
-          DataFlow::Node sink, DataFlow::MethodCallNode call
-        |
-          config.hasFlow(source, sink) and
+        exists(StringsNewReplacerCall source, DataFlow::Node sink, DataFlow::MethodCallNode call |
+          StringsNewReplacerFlow::flow(source, sink) and
           sink = call.getReceiver() and
           replacedString = source.getAReplacedArgument().getStringValue() and
           (