Go: Add models for Go 1.27 and expand models for strings package

[owen-mc]

• Added or improved data flow models for the following Go standard-library APIs introduced or updated in Go 1.27:
  • bytes.CutLast, database/sql.ConvertAssign, database/sql/driver.RowsColumnScanner.ScanColumn, net/url.URL.Clone, net/url.Values.Clone and strings.CutLast.
  • The new encoding/json/jsontext package.
• Added more data flow models for the strings package: strings.Clone, Cut, CutPrefix, CutSuffix, Fields, FieldsFunc, and Join; strings.Builder.String, Builder.WriteByte, and Builder.WriteRune; strings.Reader.ReadByte and Reader.ReadRune; and strings.Replacer.Replace and Replacer.WriteString.

Note that there are some new tests in the strings package that are commented out. They are all functions which return a iter.Seq, which is not supported yet. I intend to do a follow-up PR soon to add support for it.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

go

Generated file changes for go

• Changes to framework-coverage-go.rst:

-    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,625,127
+    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,675,127
-    Totals,,688,1085,1580
+    Totals,,688,1135,1580

• Changes to framework-coverage-go.csv:

- bytes,,,44,,,,,,,,,,,,,,,,,,,,,,,44,
+ bytes,,,45,,,,,,,,,,,,,,,,,,,,,,,45,
- database/sql,30,18,12,,,,,,,,,,,,30,,,,,,18,,,,,12,
+ database/sql,30,18,14,,,,,,,,,,,,30,,,,,,18,,,,,14,
- encoding,,,81,,,,,,,,,,,,,,,,,,,,,,,81,
+ encoding,,,113,,,,,,,,,,,,,,,,,,,,,,,113,
- net,2,16,100,,,,,,1,,,,,,,,1,,,,,,,16,,100,
+ net,2,16,102,,,,,,1,,,,,,,,1,,,,,,,16,,100,2
- strings,,,34,,,,,,,,,,,,,,,,,,,,,,,34,
+ strings,,,47,,,,,,,,,,,,,,,,,,,,,,,46,1

[Copilot]

Copilot review overview

🟡 Changes recommended

The iterator summary is ineffective for yielded values, and several new or refined models lack appropriate flow tests.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 4

New issues introduced by this change (4)

Severity	Finding
	go/​ql/​lib/​ext/​encoding.json.jsontext.model.yml — No test under go/ql/test imports or calls encoding/json/jsontext, so none of the new summary…
	go/​ql/​lib/​ext/​encoding.json.jsontext.model.yml — Pointer.Tokens returns an iter.Seq[string], so this edge taints only the returned iterator…
	go/​ql/​lib/​ext/​strings.model.yml — These summaries now target only the returned slice elements, but the existing tests still pass the…
	go/​ql/​lib/​semmle/​go/​frameworks/​stdlib/​EncodingJson.qll — The new reverse-flow branch has no jsontext.NewEncoder test. The existing encoding/json branch…

What changed in this PR

Adds Go 1.27 standard-library data-flow models and improves strings model precision.

Changes:

• Models new Go 1.27 APIs and encoding/json/jsontext.
• Expands and refines strings summaries.
• Adds taint-flow fixtures and release notes.

File	Description
Strings.go	Adds and updates strings flow fixtures.
NetHttp.go	Tests URL clone models.
go.mod	Targets Go 1.27.
DatabaseSqlDriver.go	Tests ScanColumn.
DatabaseSql.go	Tests ConvertAssign.
Bytes.go	Tests bytes.CutLast.
EncodingJson.qll	Models jsontext encoder reverse flow.
strings.model.yml	Expands strings summaries.
net.url.model.yml	Adds URL clone summaries.
encoding.json.jsontext.model.yml	Adds jsontext summaries.
database.sql.model.yml	Models ConvertAssign.
database.sql.driver.model.yml	Models ScanColumn.
bytes.model.yml	Models bytes.CutLast.
2026-09-09-go-1.27-models.md	Documents analysis improvements.

Files not reviewed (5)

• go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go: Generated file
• go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go: Generated file
• go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go: Generated file
• go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttp.go: Generated file
• go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.