Merge pull request #10413 from erik-krogh/go-followMsg

GO: make the alert messages of taint-tracking queries more consistent

Author: erik-krogh

go/ql/src/InconsistentCode/ConstantLengthComparison.ql

@@ -30,5 +30,5 @@ where
   cond.dominates(idx.getBasicBlock()) and
   // and that check happens inside the loop body
   cond.getCondition().getParent+() = fs
-select cond.getCondition(),
-  "This checks the length against a constant, but it is indexed using a variable $@.", idx, "here"
+select cond.getCondition(), "This checks the length against a constant, but it $@.", idx,
+  "is indexed using a variable"

go/ql/src/InconsistentCode/MissingErrorCheck.ql

@@ -116,5 +116,5 @@ where
   // `deref` dereferences `ptr`
   deref.getOperand() = ptr.getAUse()
 select deref.getOperand(),
-  ptr.getSourceVariable() + " may be nil here, because $@ may not have been checked.", err,
-  err.getSourceVariable().toString()
+  "$@ may be nil at this dereference because $@ may not have been checked.", ptr,
+  ptr.getSourceVariable().toString(), err, err.getSourceVariable().toString()

go/ql/src/RedundantCode/CompareIdenticalValues.ql

@@ -24,4 +24,4 @@ where
     cmp.getAnOperand() = decl.getAReference() and
     cmp.getAnOperand() instanceof BasicLit
   )
-select cmp, "This expression compares $@ to itself.", cmp.getLeftOperand(), "an expression"
+select cmp, "This expression compares an $@ to itself.", cmp.getLeftOperand(), "expression"

go/ql/src/RedundantCode/DuplicateCondition.ql

@@ -30,4 +30,4 @@ GVN conditionGvn(IfStmt is, int i, Expr e) {
 
 from IfStmt is, Expr e, Expr f, int i, int j
 where conditionGvn(is, i, e) = conditionGvn(is, j, f) and i < j
-select f, "This condition is a duplicate of $@.", e, "an earlier condition"
+select f, "This condition is a duplicate of an $@.", e, "earlier condition"

go/ql/src/RedundantCode/DuplicateSwitchCase.ql

@@ -20,4 +20,4 @@ GVN switchCaseGvn(SwitchStmt switch, int i, Expr e) {
 
 from SwitchStmt switch, int i, Expr e, int j, Expr f
 where switchCaseGvn(switch, i, e) = switchCaseGvn(switch, j, f) and i < j
-select f, "This case is a duplicate of $@.", e, "an earlier case"
+select f, "This case is a duplicate of an $@.", e, "earlier case"

go/ql/src/RedundantCode/SelfAssignment.ql

@@ -23,4 +23,4 @@ from PotentialSelfAssignment assgn, HashableNode rhs
 where
   rhs = assgn.getRhs() and
   rhs.hash() = assgn.getLhs().(HashableNode).hash()
-select assgn, "This statement assigns $@ to itself.", rhs, "an expression"
+select assgn, "This statement assigns an $@ to itself.", rhs, "expression"

go/ql/src/Security/CWE-020/IncompleteHostnameRegexp.ql

@@ -110,4 +110,4 @@ from Config c, DataFlow::PathNode source, DataFlow::PathNode sink, string hostPa
 where c.hasFlowPath(source, sink) and c.isSource(source.getNode(), hostPart)
 select source, source, sink,
   "This regular expression has an unescaped dot before '" + hostPart + "', " +
-    "so it might match more hosts than expected when used $@.", sink, "here"
+    "so it might match more hosts than expected when $@.", sink, "the regular expression is used"

go/ql/src/Security/CWE-020/SuspiciousCharacterInRegexp.ql

@@ -48,5 +48,5 @@ class Config extends DataFlow::Configuration {
 
 from Config c, DataFlow::PathNode source, DataFlow::PathNode sink, string report
 where c.hasFlowPath(source, sink) and c.isSource(source.getNode(), report)
-select source, source, sink, "$@ used $@ contains " + report, source, "A regular expression", sink,
-  "here"
+select source, source, sink, "$@ that is $@ contains " + report, source, "A string literal", sink,
+  "used as a regular expression"

go/ql/src/Security/CWE-022/TaintedPath.ql

@@ -21,5 +21,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows to here and is used in a path.", source.getNode(),
-  "User-provided value"
+select sink.getNode(), source, sink, "This path depends on a $@.", source.getNode(),
+  "user-provided value"

go/ql/src/Security/CWE-078/CommandInjection.ql

@@ -19,5 +19,5 @@ from
   CommandInjection::Configuration cfg, CommandInjection::DoubleDashSanitizingConfiguration cfg2,
   DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink) or cfg2.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "This command depends on $@.", source.getNode(),
-  "a user-provided value"
+select sink.getNode(), source, sink, "This command depends on a $@.", source.getNode(),
+  "user-provided value"