Skip to content

Go: Model log/slog as a logging sink #22004

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
owen-mc merged 2 commits into from
Jun 18, 2026
Merged

Go: Model log/slog as a logging sink #22004

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
00427d2
Go: Model `log/slog` as a logging sink
sauyon Jun 18, 2026
b7ef551
Address review: exercise variadic args/attrs in slog Log/LogAttrs tests
sauyon Jun 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions go/ql/lib/change-notes/2026-06-17-model-log-slog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
---
category: minorAnalysis
---
* Added models for the `log/slog` package (Go 1.21+). Its logging functions and
`*slog.Logger` methods (`Debug`/`Info`/`Warn`/`Error`, their `Context`
variants, and `Log`/`LogAttrs`) are now recognized as logging sinks, so the
`go/log-injection` and `go/clear-text-logging` queries cover code that logs
through `slog`.
29 changes: 29 additions & 0 deletions go/ql/lib/ext/log.slog.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
extensions:
- addsTo:
pack: codeql/go-all
extensible: sinkModel
data:
# Package-level convenience functions (msg string, args ...any).
- ["log/slog", "", False, "Debug", "", "", "Argument[0..1]", "log-injection", "manual"]
- ["log/slog", "", False, "Info", "", "", "Argument[0..1]", "log-injection", "manual"]
- ["log/slog", "", False, "Warn", "", "", "Argument[0..1]", "log-injection", "manual"]
- ["log/slog", "", False, "Error", "", "", "Argument[0..1]", "log-injection", "manual"]
# Context variants (ctx, msg string, args ...any).
- ["log/slog", "", False, "DebugContext", "", "", "Argument[1..2]", "log-injection", "manual"]
- ["log/slog", "", False, "InfoContext", "", "", "Argument[1..2]", "log-injection", "manual"]
- ["log/slog", "", False, "WarnContext", "", "", "Argument[1..2]", "log-injection", "manual"]
- ["log/slog", "", False, "ErrorContext", "", "", "Argument[1..2]", "log-injection", "manual"]
# Log/LogAttrs (ctx, level, msg string, args/attrs ...).
- ["log/slog", "", False, "Log", "", "", "Argument[2..3]", "log-injection", "manual"]
- ["log/slog", "", False, "LogAttrs", "", "", "Argument[2..3]", "log-injection", "manual"]
# Methods on *slog.Logger.
- ["log/slog", "Logger", True, "Debug", "", "", "Argument[0..1]", "log-injection", "manual"]
- ["log/slog", "Logger", True, "Info", "", "", "Argument[0..1]", "log-injection", "manual"]
- ["log/slog", "Logger", True, "Warn", "", "", "Argument[0..1]", "log-injection", "manual"]
- ["log/slog", "Logger", True, "Error", "", "", "Argument[0..1]", "log-injection", "manual"]
- ["log/slog", "Logger", True, "DebugContext", "", "", "Argument[1..2]", "log-injection", "manual"]
- ["log/slog", "Logger", True, "InfoContext", "", "", "Argument[1..2]", "log-injection", "manual"]
- ["log/slog", "Logger", True, "WarnContext", "", "", "Argument[1..2]", "log-injection", "manual"]
- ["log/slog", "Logger", True, "ErrorContext", "", "", "Argument[1..2]", "log-injection", "manual"]
- ["log/slog", "Logger", True, "Log", "", "", "Argument[2..3]", "log-injection", "manual"]
- ["log/slog", "Logger", True, "LogAttrs", "", "", "Argument[2..3]", "log-injection", "manual"]
2 changes: 1 addition & 1 deletion go/ql/test/library-tests/semmle/go/concepts/LoggerCall/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module codeql-go-tests/concepts/loggercall

go 1.15
go 1.21

require (
github.com/golang/glog v1.2.5
Expand Down
2 changes: 2 additions & 0 deletions go/ql/test/library-tests/semmle/go/concepts/LoggerCall/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,12 @@ package main

const fmt = "formatted %s string"
const text = "test"
const key = "key"

var v []byte

func main() {
glogTest(len(v))
stdlib()
slogTest()
}
40 changes: 40 additions & 0 deletions go/ql/test/library-tests/semmle/go/concepts/LoggerCall/slog.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
package main

import (
"context"
"log/slog"
)

func slogTest() {
ctx := context.Background()
var logger *slog.Logger
var attr slog.Attr

// Methods on *slog.Logger: Debug/Info/Warn/Error(msg string, args ...any).
logger.Debug(text) // $ logger=text
logger.Info(text) // $ logger=text
logger.Warn(text) // $ logger=text
logger.Error(text) // $ logger=text
logger.Info(text, key, v) // $ logger=text logger=key logger=v

// Context variants: (ctx, msg string, args ...any).
logger.DebugContext(ctx, text) // $ logger=text
logger.InfoContext(ctx, text) // $ logger=text
logger.WarnContext(ctx, text) // $ logger=text
logger.ErrorContext(ctx, text) // $ logger=text
logger.InfoContext(ctx, text, key, v) // $ logger=text logger=key logger=v

// Log/LogAttrs: (ctx, level, msg string, args/attrs ...).
logger.Log(ctx, slog.LevelInfo, text, key, v) // $ logger=text logger=key logger=v
logger.LogAttrs(ctx, slog.LevelInfo, text, attr) // $ logger=text logger=attr

// Package-level convenience functions.
slog.Debug(text) // $ logger=text
slog.Info(text) // $ logger=text
slog.Warn(text) // $ logger=text
slog.Error(text) // $ logger=text
slog.Info(text, key, v) // $ logger=text logger=key logger=v
slog.InfoContext(ctx, text, key, v) // $ logger=text logger=key logger=v
slog.Log(ctx, slog.LevelInfo, text, key, v) // $ logger=text logger=key logger=v
slog.LogAttrs(ctx, slog.LevelInfo, text, attr) // $ logger=text logger=attr
}
Loading