Make strings.Replacer.WriteString a sanitizer for log injection

Author: owen-mc

go/ql/lib/semmle/go/security/LogInjectionCustomizations.qll

@@ -69,6 +69,19 @@ module LogInjection {
     }
   }
 
+  /**
+   * A call to `strings.Replacer.WriteString`, considered as a sanitizer for log
+   * injection.
+   */
+  class ReplacerWriteStringSanitizer extends Sanitizer {
+    ReplacerWriteStringSanitizer() {
+      exists(DataFlow::MethodCallNode call |
+        call.getTarget().hasQualifiedName("strings", "Replacer", "WriteString") and
+        this = call.getArgument(1)
+      )
+    }
+  }
+
   /**
    * An argument that is formatted using the `%q` directive, considered as a sanitizer
    * for log injection.

go/ql/test/query-tests/Security/CWE-117/LogInjection.go

@@ -11,6 +11,7 @@ package main
 //go:generate depstubber -vendor go.uber.org/zap Logger,SugaredLogger NewProduction
 
 import (
+	"bytes"
 	"fmt"
 	"log"
 	"net/http"
@@ -384,20 +385,35 @@ func handlerGood3(req *http.Request) {
 	replacer := strings.NewReplacer("\n", "", "\r", "")
 	log.Printf("user %s logged in.\n", replacer.Replace(username))
 	log.Printf("user %s logged in.\n", replacerLocal1(username))
+	log.Printf("user %s logged in.\n", replacerLocal2(username))
 	log.Printf("user %s logged in.\n", replacerGlobal1(username))
+	log.Printf("user %s logged in.\n", replacerGlobal2(username))
 }
 
 func replacerLocal1(s string) string {
 	replacer := strings.NewReplacer("\n", "", "\r", "")
 	return replacer.Replace(s)
 }
 
+func replacerLocal2(s string) string {
+	replacer := strings.NewReplacer("\n", "", "\r", "")
+	buf := new(bytes.Buffer)
+	replacer.WriteString(buf, s)
+	return buf.String()
+}
+
 var globalReplacer = strings.NewReplacer("\n", "", "\r", "")
 
 func replacerGlobal1(s string) string {
 	return globalReplacer.Replace(s)
 }
 
+func replacerGlobal2(s string) string {
+	buf := new(bytes.Buffer)
+	globalReplacer.WriteString(buf, s)
+	return buf.String()
+}
+
 // GOOD: User-provided values formatted using a %q directive, which escapes newlines
 func handlerGood4(req *http.Request, ctx *goproxy.ProxyCtx) {
 	username := req.URL.Query()["username"][0]