Merge pull request #10726 from erik-krogh/go-last-msg

Go: fix some more style-guide violations in the alert-messages

Author: erik-krogh

go/ql/lib/semmle/go/security/InsecureRandomnessCustomizations.qll

@@ -64,7 +64,7 @@ module InsecureRandomness {
       )
     }
 
-    override string getKind() { result = "this cryptographic algorithm" }
+    override string getKind() { result = "This cryptographic algorithm" }
   }
 
   /**
@@ -75,7 +75,7 @@ module InsecureRandomness {
       this.getRoot().(FuncDef).getName().regexpMatch("(?i).*(gen(erate)?|salt|make|mk)Password.*")
     }
 
-    override string getKind() { result = "a password-related function" }
+    override string getKind() { result = "A password-related function" }
   }
 
   /** Gets a package that implements hash algorithms. */

go/ql/src/InconsistentCode/WrappedErrorAlwaysNil.ql

@@ -61,4 +61,4 @@ where
     // }
     n = DataFlow::BarrierGuard<nilTestGuard/3>::getABarrierNode()
   )
-select n, "The first argument to 'errors.Wrap' is always nil"
+select n, "The first argument to 'errors.Wrap' is always nil."

go/ql/src/Security/CWE-020/SuspiciousCharacterInRegexp.ql

@@ -48,5 +48,5 @@ class Config extends DataFlow::Configuration {
 
 from Config c, DataFlow::PathNode source, DataFlow::PathNode sink, string report
 where c.hasFlowPath(source, sink) and c.isSource(source.getNode(), report)
-select source, source, sink, "$@ that is $@ contains " + report, source, "A string literal", sink,
+select source, source, sink, "This string literal that is $@ contains " + report, sink,
   "used as a regular expression"

go/ql/src/Security/CWE-117/LogInjection.ql

@@ -17,5 +17,5 @@ import DataFlow::PathGraph
 
 from LogInjection::Configuration c, DataFlow::PathNode source, DataFlow::PathNode sink
 where c.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Log entry depends on a $@.", source.getNode(),
+select sink.getNode(), source, sink, "This log entry depends on a $@.", source.getNode(),
   "user-provided value"

go/ql/src/Security/CWE-338/InsecureRandomness.ql

@@ -19,7 +19,7 @@ where
   cfg.hasFlowPath(source, sink) and
   cfg.isSink(sink.getNode(), kind) and
   (
-    kind != "a password-related function"
+    kind != "A password-related function"
     or
     sink =
       min(DataFlow::PathNode sink2, int line |
@@ -31,5 +31,5 @@ where
       )
   )
 select sink.getNode(), source, sink,
-  "$@ generated with a cryptographically weak RNG is used in $@.", source.getNode(),
-  "A random number", sink.getNode(), kind
+  kind + " depends on a $@ generated with a cryptographically weak RNG.", source.getNode(),
+  "random number"

go/ql/src/change-notes/2022-10-07-alert-messages.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.

go/ql/src/experimental/CWE-369/DivideByZero.ql

@@ -54,5 +54,4 @@ class DivideByZeroCheckConfig extends TaintTracking::Configuration {
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, DivideByZeroCheckConfig cfg
 where cfg.hasFlowPath(source, sink)
-select sink, source, sink, "Variable $@ might be zero leading to a division-by-zero panic.", sink,
-  sink.getNode().toString()
+select sink, source, sink, "This variable might be zero leading to a division-by-zero panic."

go/ql/src/experimental/CWE-400/DatabaseCallInLoop.ql

@@ -66,4 +66,4 @@ query predicate edges(CallGraphNode pred, CallGraphNode succ) {
 
 from LoopStmt loop, DatabaseAccess dbAccess
 where edges*(loop, dbAccess.asExpr())
-select dbAccess, loop, dbAccess, "$@ is called in $@", dbAccess, dbAccess.toString(), loop, "a loop"
+select dbAccess, loop, dbAccess, "This calls " + dbAccess.toString() + " in a $@.", loop, "loop"

go/ql/src/experimental/CWE-918/SSRF.ql

@@ -19,4 +19,4 @@ from
 where
   cfg.hasFlowPath(source, sink) and
   request = sink.getNode().(ServerSideRequestForgery::Sink).getARequest()
-select request, source, sink, "The URL of this request depends on a user-provided value"
+select request, source, sink, "The URL of this request depends on a user-provided value."

go/ql/src/experimental/IntegerOverflow/IntegerOverflow.ql

@@ -11,4 +11,4 @@ import RangeAnalysis
 
 from Expr expr
 where exprMayOverflow(expr) or exprMayUnderflow(expr)
-select expr, "this expression may cause an integer overflow"
+select expr, "This expression may cause an integer overflow."