Go: mass-enable diff-informed queries phase 2 - getASelected{Source,Sink}Location() { none() }

[d10c]

Stacks on top of earlier PR: #19659
Uses patch from: https://github.com/github/codeql-patch/pull/88/commits/ec5681e740c18c792443099fb3e413446616a0ee

Adds getASelected{Source,Sink}Location() { none() } override to queries that select a dataflow source or sink as a location, but not both.

[Copilot]

Pull Request Overview

This PR mass-enables diff-informed queries in Go CodeQL packs by adding a no-op observeDiffInformedIncrementalMode predicate and default getASelected{Source,Sink}Location() overrides where only one side is selected.

• Introduces predicate observeDiffInformedIncrementalMode() { any() } in numerous Config modules.
• Adds getASelectedSourceLocation(...) { none() } and/or getASelectedSinkLocation(...) { none() } overrides in cases where only one of source or sink is selected.
• Builds on phase 1 to ensure diff-informed incremental mode compatibility.

Reviewed Changes

Copilot reviewed 32 out of 31 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
go/ql/src/experimental/frameworks/DecompressionBombs.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/src/experimental/CWE-74/DsnInjectionCustomizations.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/src/experimental/CWE-369/DivideByZero.ql	Added observeDiffInformedIncrementalMode predicate and getASelectedSourceLocation override
go/ql/src/experimental/CWE-327/WeakCryptoAlgorithmCustomizations.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/src/experimental/CWE-321-V2/HardCodedKeys.ql	Added observeDiffInformedIncrementalMode predicate
go/ql/src/experimental/CWE-287/ImproperLdapAuthCustomizations.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/src/experimental/CWE-285/PamAuthBypass.ql	Added observeDiffInformedIncrementalMode predicate and getASelectedSinkLocation override
go/ql/src/experimental/CWE-203/Timing.ql	Added observeDiffInformedIncrementalMode predicate
go/ql/src/experimental/CWE-090/LDAPInjection.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/src/Security/CWE-640/EmailInjection.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/src/Security/CWE-352/ConstantOauth2State.ql	Added observeDiffInformedIncrementalMode predicate
go/ql/src/Security/CWE-326/InsufficientKeySize.ql	Added observeDiffInformedIncrementalMode predicate and getASelectedSourceLocation override
go/ql/src/Security/CWE-209/StackTraceExposure.ql	Added observeDiffInformedIncrementalMode predicate
go/ql/src/Security/CWE-079/HtmlTemplateEscapingBypassXss.ql	Added observeDiffInformedIncrementalMode predicate
go/ql/src/Security/CWE-020/SuspiciousCharacterInRegexp.ql	Added observeDiffInformedIncrementalMode predicate
go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql	Added observeDiffInformedIncrementalMode predicate and getASelectedSinkLocation override
go/ql/src/Security/CWE-020/IncompleteHostnameRegexp.ql	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/ZipSlip.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/XPathInjection.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/UnsafeUnzipSymlink.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/TaintedPath.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/StringBreak.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/StoredXss.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/StoredCommand.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/SqlInjection.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/OpenUrlRedirect.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/MissingJwtSignatureCheck.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/LogInjection.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/ExternalAPIs.qll	Added observeDiffInformedIncrementalMode predicate
go/ql/lib/semmle/go/security/CleartextLogging.qll	Added observeDiffInformedIncrementalMode predicate

Comments suppressed due to low confidence (2)

go/ql/src/experimental/CWE-369/DivideByZero.ql:51

• No tests currently cover the new getASelectedSourceLocation override; consider adding test cases to validate that diff-informed incremental mode correctly handles source-only location configurations.

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }

go/ql/src/experimental/frameworks/DecompressionBombs.qll:60

• [nitpick] Add a brief comment above observeDiffInformedIncrementalMode explaining its purpose and how it interacts with diff-informed incremental runs, so future maintainers understand why this no-op override is needed.

predicate observeDiffInformedIncrementalMode() { any() }

[Copilot]

The observeDiffInformedIncrementalMode predicate is duplicated across many configs; consider extracting it into a shared mixin or base module to reduce boilerplate and improve maintainability.

[michaelnebel]

LGTM!