Put QLDoc on data flow and taint tracking modules

We preserve all old QLDocs, but move them from the
config to the Flow module. This makes more sense than
the Config module, which is often private, and is generally
not directly accessed.

Author: owen-mc

go/ql/lib/semmle/go/StringOps.qll

@@ -222,11 +222,6 @@ module StringOps {
       }
     }
 
-    /**
-     * A configuration for tracking flow from a call to `strings.NewReplacer` to
-     * the receiver of a call to `strings.Replacer.Replace` or
-     * `strings.Replacer.WriteString`.
-     */
     private module StringsNewReplacerConfig implements DataFlow::ConfigSig {
       predicate isSource(DataFlow::Node source) { source instanceof StringsNewReplacerCall }
 
@@ -238,6 +233,10 @@ module StringOps {
       }
     }
 
+    /**
+     * Tracks data flow from a call to `strings.NewReplacer` to the receiver of
+     * a call to `strings.Replacer.Replace` or `strings.Replacer.WriteString`.
+     */
     private module StringsNewReplacerFlow = DataFlow::Global<StringsNewReplacerConfig>;
 
     /**

go/ql/lib/semmle/go/security/AllocationSizeOverflow.qll

@@ -14,7 +14,7 @@ module AllocationSizeOverflow {
   import AllocationSizeOverflowCustomizations::AllocationSizeOverflow
 
   /**
-   * DEPRECATED: Use a copy of `FindLargeLensConfig` and `FindLargeLensFlow` instead.
+   * DEPRECATED: Use copies of `FindLargeLensConfig` and `FindLargeLensFlow` instead.
    *
    * A taint-tracking configuration for identifying `len(...)` calls whose argument may be large.
    */
@@ -40,6 +40,9 @@ module AllocationSizeOverflow {
     predicate isBarrier(DataFlow::Node nd) { nd instanceof Sanitizer }
   }
 
+  /**
+   * Tracks taint flow to find `len(...)` calls whose argument may be large.
+   */
   private module FindLargeLensFlow = TaintTracking::Global<FindLargeLensConfig>;
 
   private DataFlow::CallNode getALargeLenCall() {
@@ -111,5 +114,6 @@ module AllocationSizeOverflow {
     }
   }
 
+  /** Tracks taint flow to find allocation-size overflows. */
   module Flow = TaintTracking::Global<Config>;
 }

go/ql/lib/semmle/go/security/CleartextLogging.qll

@@ -89,5 +89,12 @@ module CleartextLogging {
     }
   }
 
+  /**
+   * Tracks data flow for reasoning about clear-text logging of sensitive
+   * information, from `Source`s, which are sources of sensitive data, to
+   * `Sink`s, which is an abstract class representing all the places sensitive
+   * data may be stored in cleartext. Additional sources or sinks can be added
+   * by extending the relevant class.
+   */
   module Flow = DataFlow::Global<Config>;
 }

go/ql/lib/semmle/go/security/CommandInjection.qll

@@ -51,6 +51,10 @@ module CommandInjection {
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
   }
 
+  /**
+   * Tracks taint flow for reasoning about command-injection vulnerabilities
+   * with sinks which are not sanitized by `--`.
+   */
   module Flow = TaintTracking::Global<Config>;
 
   private class ArgumentArrayWithDoubleDash extends DataFlow::Node {
@@ -129,5 +133,9 @@ module CommandInjection {
     }
   }
 
+  /**
+   * Tracks taint flow for reasoning about command-injection vulnerabilities
+   * with sinks which are sanitized by `--`.
+   */
   module DoubleDashSanitizingFlow = TaintTracking::Global<DoubleDashSanitizingConfig>;
 }

go/ql/lib/semmle/go/security/ExternalAPIs.qll

@@ -207,6 +207,9 @@ private module UntrustedDataConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
 }
 
+/**
+ * Tracks data flow from `RemoteFlowSource`s to `ExternalApiDataNode`s.
+ */
 module UntrustedDataToExternalApiFlow = DataFlow::Global<UntrustedDataConfig>;
 
 /** DEPRECATED: Alias for UntrustedDataToExternalApiConfig */
@@ -234,6 +237,9 @@ private module UntrustedDataToUnknownExternalApiConfig implements DataFlow::Conf
   predicate isSink(DataFlow::Node sink) { sink instanceof UnknownExternalApiDataNode }
 }
 
+/**
+ * Tracks data flow from `RemoteFlowSource`s to `UnknownExternalApiDataNode`s.
+ */
 module UntrustedDataToUnknownExternalApiFlow =
   DataFlow::Global<UntrustedDataToUnknownExternalApiConfig>;
 

go/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll

@@ -257,6 +257,11 @@ private module ConversionWithoutBoundsCheckConfig implements DataFlow::StateConf
   }
 }
 
+/**
+ * Tracks taint flow from an integer obtained from parsing a string flows to a
+ * type conversion to a smaller integer type, which could cause unexpected
+ * values.
+ */
 module Flow = TaintTracking::GlobalWithState<ConversionWithoutBoundsCheckConfig>;
 
 private predicate upperBoundCheckGuard(DataFlow::Node g, Expr e, boolean branch) {

go/ql/lib/semmle/go/security/InsecureRandomness.qll

@@ -46,5 +46,9 @@ module InsecureRandomness {
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
   }
 
+  /**
+   * Tracks taint flow for reasoning about random values that are not
+   * cryptographically secure.
+   */
   module Flow = TaintTracking::Global<Config>;
 }

go/ql/lib/semmle/go/security/LogInjection.qll

@@ -33,9 +33,7 @@ module LogInjection {
     }
   }
 
-  /**
-   * A taint-tracking configuration for reasoning about log injection vulnerabilities.
-   */
+  /** Config for reasoning about log injection vulnerabilities. */
   module Config implements DataFlow::ConfigSig {
     predicate isSource(DataFlow::Node source) { source instanceof Source }
 
@@ -44,5 +42,6 @@ module LogInjection {
     predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof Sanitizer }
   }
 
+  /** Tracks taint flow for reasoning about log injection vulnerabilities. */
   module Flow = TaintTracking::Global<Config>;
 }

go/ql/lib/semmle/go/security/OpenUrlRedirect.qll

@@ -104,5 +104,6 @@ module OpenUrlRedirect {
     }
   }
 
+  /** Tracks taint flow for reasoning about unvalidated URL redirections. */
   module Flow = DataFlow::Global<Config>;
 }

go/ql/lib/semmle/go/security/ReflectedXss.qll

@@ -46,5 +46,6 @@ module ReflectedXss {
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
   }
 
+  /** Tracks taint flow for reasoning about XSS. */
   module Flow = TaintTracking::Global<Config>;
 }