codeql_go_vendor_extractor

README

codeql-go-vendor-extractor

WHY?

The official extractor for golang only support gomod mode.

It's not graceful for pure vendor mode.

For example, the result of this query below will be empty:

https://lgtm.com/query/8418405387172037343/

import go

from CallExpr e
where e.getTarget().getName()="panic"
select e

But it should find the function call here:

https://github.com/ssst0n3/go-vendor-test/blob/main/vendor/st0n3/st0n3.go

package st0n3

func Crash() {
    panic("crash")
}

How to Use?

GO111MODULE=off codeql database create -l go <DATABASE_NAME> -c "vendor_extractor --package <PACKAGE>"

And then, you will get the correct database.

For example:

// TODO

get vendor-extractor binary

go get -u github.com/ssst0n3/go-vendor-test/cmd/vendor_extractor

download source code

cd $GOPATH/src/
mkdir -p github.com/ssst0n3/
cd github.com/ssst0n3/
git clone https://github.com/ssst0n3/go-vendor-test.git

create database

codeql database create -l go /tmp/go-vendor-test -c "vendor_extractor --package ."

Documentation

Index

• func ExtractPackages(pkgs []*packages.Package)
• func ExtractType(pkgs []*packages.Package)
• func ExtractTypePost(pkg *packages.Package)
• func ExtractTypePre(pkg *packages.Package) bool
• func ExtractUniverseScope()
• func LoadPackage(targetDir string, buildFlags []string, patterns []string) (pkgs []*packages.Package, err error)

Functions

func ExtractPackages

func ExtractPackages(pkgs []*packages.Package)

func ExtractType

func ExtractType(pkgs []*packages.Package)

func ExtractTypePost

func ExtractTypePost(pkg *packages.Package)

func ExtractTypePre

func ExtractTypePre(pkg *packages.Package) bool

func ExtractUniverseScope

func ExtractUniverseScope()

func LoadPackage

func LoadPackage(targetDir string, buildFlags []string, patterns []string) (pkgs []*packages.Package, err error)