diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll index 256b8c575d36..2b36d42702ab 100644 --- a/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll +++ b/go/ql/lib/semmle/go/dataflow/internal/DataFlowPrivate.qll @@ -470,9 +470,11 @@ ContentApprox getContentApprox(Content c) { any() } /** * Holds if the the content `c` is a container. */ -predicate containerContent(ContentSet c) { - c instanceof ArrayContent or - c instanceof CollectionContent or - c instanceof MapKeyContent or - c instanceof MapValueContent +predicate containerContentSet(ContentSet cs) { + exists(Content c | cs.asOneContent() = c | + c instanceof ArrayContent or + c instanceof CollectionContent or + c instanceof MapKeyContent or + c instanceof MapValueContent + ) } diff --git a/go/ql/lib/semmle/go/dataflow/internal/TaintTrackingUtil.qll b/go/ql/lib/semmle/go/dataflow/internal/TaintTrackingUtil.qll index 843bcbd80514..f5525f90e0db 100644 --- a/go/ql/lib/semmle/go/dataflow/internal/TaintTrackingUtil.qll +++ b/go/ql/lib/semmle/go/dataflow/internal/TaintTrackingUtil.qll @@ -36,11 +36,11 @@ predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) { FlowSummaryImpl::Private::Steps::summaryThroughStepTaint(src, sink, _) or // Treat container flow as taint for the local taint flow relation - exists(DataFlow::Content c | DataFlowPrivate::containerContent(c) | - DataFlowPrivate::readStep(src, c, sink) or - DataFlowPrivate::storeStep(src, c, sink) or - FlowSummaryImpl::Private::Steps::summaryGetterStep(src, c, sink, _) or - FlowSummaryImpl::Private::Steps::summarySetterStep(src, c, sink, _) + exists(DataFlow::ContentSet cs | DataFlowPrivate::containerContentSet(cs) | + DataFlowPrivate::readStep(src, cs, sink) or + DataFlowPrivate::storeStep(src, cs, sink) or + FlowSummaryImpl::Private::Steps::summaryGetterStep(src, cs, sink, _) or + FlowSummaryImpl::Private::Steps::summarySetterStep(src, cs, sink, _) ) } diff --git a/go/ql/test/library-tests/semmle/go/frameworks/serialization/test.ql b/go/ql/test/library-tests/semmle/go/frameworks/serialization/test.ql index 171f2a1181b7..94c1b8f30b54 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/serialization/test.ql +++ b/go/ql/test/library-tests/semmle/go/frameworks/serialization/test.ql @@ -1,5 +1,5 @@ import go -import TestUtilities.InlineFlowTest +import utils.test.InlineFlowTest string getArgString(DataFlow::Node src, DataFlow::Node sink) { exists(sink) and