Skip to content

fix(G118): eliminate false positive when cancel is called via struct field in a closure#1596

Merged
ccojocar merged 2 commits intosecurego:masterfrom
ravisastryk:fix/1595-g118-struct-field
Mar 10, 2026
Merged

fix(G118): eliminate false positive when cancel is called via struct field in a closure#1596
ccojocar merged 2 commits intosecurego:masterfrom
ravisastryk:fix/1595-g118-struct-field

Conversation

@ravisastryk
Copy link
Copy Markdown
Contributor

Fix G118 false positive when cancel is called via struct field in a closure

Fixes #1595

Problem

G118 fires a false positive when a cancel function is stored into a struct field after construction and later invoked through that field inside a deferred closure:

foo.cancel = cancel
defer func() { foo.cancel() }()

The existing fix from #1593 handles the constructor + return pattern but not this one. Here the struct is never returned — the call lives in a closure, which SSA compiles into a separate *ssa.Function. The isCancelCalled BFS traces referrers of the FieldAddr from the Store, but that value has no referrers bridging to the closure’s own FieldAddr, so the call is never seen.

Fix

Adds isFieldCalledInAnyFunc which scans all SSA functions (including closures) for a FieldAddr matching the same struct pointer type and field index. If any such address is loaded and used as a call or defer target, the cancel is considered handled.

Called from the Store+FieldAddr branch in isCancelCalled, after the existing isStructFieldReturnedFromFunc check.

Testing

  • Added test samples for the exact pattern from the issue (deferred closure) and the direct-call variant
  • Verified genuinely lost cancels (field assigned but never called) still trigger G118
  • All existing G118 tests pass

…d post-construction

When a cancel function is assigned to a struct field after construction
(e.g. s.cancel = cancel), the SSA FieldAddr for the store is a distinct
value from any FieldAddr created later for defer s.cancel() or inside a
closure. The existing isCancelCalledViaStructField only matched receiver
methods and missed these patterns.

Add isFieldCalledInAnyFunc which scans all SSA functions (including
closures) for a FieldAddr with matching struct pointer type and field
index, then checks whether the loaded value is called. As a side effect,
this also resolves the known false positive for nested struct field access.

fixes: 1595
@ravisastryk ravisastryk marked this pull request as ready for review March 10, 2026 16:03
@ccojocar ccojocar merged commit 8895462 into securego:master Mar 10, 2026
7 checks passed
@ravisastryk ravisastryk deleted the fix/1595-g118-struct-field branch March 10, 2026 16:22
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 10, 2026

Codecov Report

❌ Patch coverage is 88.88889% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.90%. Comparing base (619ce21) to head (dc5511e).
⚠️ Report is 1 commits behind head on master.

Files with missing lines Patch % Lines
analyzers/context_propagation.go 88.88% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1596      +/-   ##
==========================================
+ Coverage   80.89%   80.90%   +0.01%     
==========================================
  Files         104      104              
  Lines        9929     9947      +18     
==========================================
+ Hits         8032     8048      +16     
- Misses       1407     1408       +1     
- Partials      490      491       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

ravisastryk added a commit to ravisastryk/gosec that referenced this pull request Mar 12, 2026
  G118 was incorrectly reporting context cancellation function not called
  when the cancel function was assigned to a package-level variable (e.g.,
  in init()) and called in a separate function (e.g., signal handler).

  Root cause: isCancelCalled() lacked special handling for *ssa.Global
  (package-level variables), causing cross-function tracking to fail.

  Solution: Add dedicated tracking for package-level globals, similar to
  the struct field handling added in PR securego#1596. The fix includes:
  - Check in *ssa.Store case to detect global variable assignments
  - isGlobalCalledInAnyFunc() helper to search all functions for calls
  - isValueCalled() generalized helper for BFS value tracking
ravisastryk added a commit to ravisastryk/gosec that referenced this pull request Mar 12, 2026
  G118 was incorrectly reporting context cancellation function not called
  when the cancel function was assigned to a package-level variable (e.g.,
  in init()) and called in a separate function (e.g., signal handler).

  Root cause: isCancelCalled() lacked special handling for *ssa.Global
  (package-level variables), causing cross-function tracking to fail.

  Solution: Add dedicated tracking for package-level globals, similar to
  the struct field handling added in PR securego#1596. The fix includes:
  - Check in *ssa.Store case to detect global variable assignments
  - isGlobalCalledInAnyFunc() helper to search all functions for calls
  - isValueCalled() generalized helper for BFS value tracking
ccojocar pushed a commit that referenced this pull request Mar 12, 2026
#1602)

* fix(G118): eliminate false positive for package-level cancel variables

  G118 was incorrectly reporting context cancellation function not called
  when the cancel function was assigned to a package-level variable (e.g.,
  in init()) and called in a separate function (e.g., signal handler).

  Root cause: isCancelCalled() lacked special handling for *ssa.Global
  (package-level variables), causing cross-function tracking to fail.

  Solution: Add dedicated tracking for package-level globals, similar to
  the struct field handling added in PR #1596. The fix includes:
  - Check in *ssa.Store case to detect global variable assignments
  - isGlobalCalledInAnyFunc() helper to search all functions for calls
  - isValueCalled() generalized helper for BFS value tracking

* additional test
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Another struct member related false G118 positive

2 participants