Convert barrier for cleartext logging to MaD

Author: owen-mc

go/ql/lib/ext/builtin.model.yml

@@ -1,4 +1,9 @@
 extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: barrierModel
+    data:
+      - ["", "error", False, "Error", "", "", "ReturnValue", "go/clear-text-logging", "manual"]
   - addsTo:
       pack: codeql/go-all
       extensible: summaryModel

go/ql/lib/ext/fmt.model.yml

@@ -6,6 +6,11 @@ extensions:
       - ["fmt", "", False, "Print", "", "", "Argument[0]", "log-injection", "manual"]
       - ["fmt", "", False, "Printf",  "", "", "Argument[0..1]", "log-injection", "manual"]
       - ["fmt", "", False, "Println", "", "", "Argument[0]", "log-injection", "manual"]
+  - addsTo:
+      pack: codeql/go-all
+      extensible: barrierModel
+    data:
+      - ["fmt", "Stringer", False, "String", "", "", "ReturnValue", "go/clear-text-logging", "manual"]
   - addsTo:
       pack: codeql/go-all
       extensible: summaryModel

go/ql/lib/semmle/go/security/CleartextLogging.qll

@@ -21,15 +21,7 @@ module CleartextLogging {
 
     predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
-    predicate isBarrier(DataFlow::Node node) {
-      node instanceof Barrier
-      or
-      exists(DataFlow::CallNode call | node = call.getResult() |
-        call.getTarget() = Builtin::error().getType().getMethod("Error")
-        or
-        call.getTarget().(Method).hasQualifiedName("fmt", "Stringer", "String")
-      )
-    }
+    predicate isBarrier(DataFlow::Node node) { node instanceof Barrier }
 
     predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
 

go/ql/lib/semmle/go/security/CleartextLoggingCustomizations.qll

@@ -5,6 +5,7 @@
  */
 
 import go
+private import semmle.go.dataflow.ExternalFlow
 private import semmle.go.security.SensitiveActions::HeuristicNames
 private import semmle.go.security.SensitiveActions::PasswordHeuristics
 
@@ -36,6 +37,10 @@ module CleartextLogging {
    */
   abstract class Barrier extends DataFlow::Node { }
 
+  private class DefaultBarrier extends Barrier {
+    DefaultBarrier() { barrierNode(this, "go/clear-text-logging") }
+  }
+
   /**
    * An argument to a logging mechanism.
    */