github · owen-mc · Mar 13, 2026 · Mar 11, 2026 · Mar 11, 2026 · Mar 9, 2026
@@ -199,6 +199,7 @@ def annotate_as_appropriate(filename, lines):
     # as overlay[local?].  It is not clear that these heuristics are exactly what we want,
     # but they seem to work well enough for now (as determined by speed and accuracy numbers).
     if (filename.endswith("Test.qll") or
+        re.search(r"go/ql/lib/semmle/go/security/[^/]+[.]qll$", filename.replace(os.sep, "/")) or
         ((filename.endswith("Query.qll") or filename.endswith("Config.qll")) and
          any("implements DataFlow::ConfigSig" in line for line in lines))):
         return None

@@ -8,5 +8,7 @@
  * `FileSystemAccess`, or the `Source` and `Sink` classes associated with the security queries
  * to model frameworks that are not covered by the standard library.
  */
+overlay[local?]
+module;
 
 import go
@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with Go programs.
  */
+overlay[local?]
+module;
 
 import Customizations
 import semmle.go.Architectures

@@ -2,6 +2,8 @@
  * Provides classes and predicates related to contextual queries
  * in the code viewer.
  */
+overlay[local?]
+module;
 
 import go
 private import codeql.util.FileSystem

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with AST nodes.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,4 +1,6 @@
 /** Provides classes for working with architectures. */
+overlay[local]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with code comments.
  */
+overlay[local]
+module;
 
 import go
 

@@ -3,6 +3,8 @@
  * access or system command execution, for which individual framework libraries
  * provide concrete subclasses.
  */
+overlay[local?]
+module;
 
 import go
 import semmle.go.dataflow.FunctionInputsAndOutputs

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with declarations.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,4 +1,6 @@
 /** Provides classes for working with errors and warnings recorded during extraction. */
+overlay[local]
+module;
 
 import go
 

@@ -1,4 +1,6 @@
 /** Provides classes for working with Go frontend errors recorded during extraction. */
+overlay[local]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with expressions.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,4 +1,6 @@
 /** Provides classes for working with files and folders. */
+overlay[local]
+module;
 
 import go
 private import codeql.util.FileSystem

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with go.mod files.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,4 +1,6 @@
 /** Provides classes for working with HTML documents. */
+overlay[local]
+module;
 
 import go
 

@@ -1,4 +1,6 @@
 /** Provides classes for working with locations and program elements that have locations. */
+overlay[local]
+module;
 
 import go
 private import semmle.go.Overlay

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with packages.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides queries to pretty-print a Go AST as a graph.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with scopes and declared objects.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with statements.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides predicates and classes for working with string operations.
  */
+overlay[local?]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with Go types.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,4 +1,6 @@
 /** This module provides general utility classes and predicates. */
+overlay[local]
+module;
 
 /**
  * A Boolean value.

@@ -1,4 +1,6 @@
 /** Provides the `VariableWithFields` class, for working with variables with a chain of field or element accesses chained to it. */
+overlay[local]
+module;
 
 import go
 

@@ -1,4 +1,6 @@
 /** Provides a class for generated files. */
+overlay[local]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with HTTP-related concepts such as requests and responses.
  */
+overlay[local?]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with basic blocks.
  */
+overlay[local]
+module;
 
 import go
 private import ControlFlowGraphImpl

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with a CFG-based program representation.
  */
+overlay[local]
+module;
 
 import go
 private import ControlFlowGraphImpl
@@ -62,6 +64,7 @@ module ControlFlow {
     BasicBlock getBasicBlock() { result.getANode() = this }
 
     /** Holds if this node dominates `dominee` in the control-flow graph. */
+    overlay[caller?]
     pragma[inline]
     predicate dominatesNode(ControlFlow::Node dominee) {
       exists(ReachableBasicBlock thisbb, ReachableBasicBlock dbb, int i, int j |

@@ -3,6 +3,8 @@
  *
  * Provides predicates for building intra-procedural CFGs.
  */
+overlay[local]
+module;
 
 import go
 

@@ -9,6 +9,8 @@
  * Each instruction is also a control-flow node, but there are control-flow nodes that are not
  * instructions (synthetic entry and exit nodes, as well as no-op skip nodes).
  */
+overlay[local]
+module;
 
 import go
 private import semmle.go.controlflow.ControlFlowGraphImpl

@@ -14,6 +14,8 @@
  * (intraprocedural) data flow, invoke `DataFlow::localFlow` or
  * `DataFlow::LocalFlowStep` with arguments of type `DataFlow::Node`.
  */
+overlay[local?]
+module;
 
 import go
 

@@ -84,6 +84,8 @@
  *    "taint" indicates a default additional taint step and "value" indicates a
  *    globally applicable value-preserving step.
  */
+overlay[local?]
+module;
 
 private import go
 private import internal.ExternalFlowExtensions::Extensions as Extensions

@@ -1,6 +1,8 @@
 /**
  * Provides classes and predicates for defining flow summaries.
  */
+overlay[local?]
+module;
 
 import go
 private import internal.FlowSummaryImpl as Impl

@@ -2,6 +2,8 @@
  * Provides QL classes for indicating data flow through a function parameter, return value,
  * or receiver.
  */
+overlay[local]
+module;
 
 import go
 private import semmle.go.dataflow.internal.DataFlowPrivate

@@ -29,6 +29,8 @@
  * common reason for this is that the analysis cannot prove that there
  * are no side-effects that might cause the computed value to change.
  */
+overlay[local]
+module;
 
 /*
  * Note to developers: the correctness of this module depends on the

@@ -1,6 +1,8 @@
 /**
  * Provides a class for representing and reasoning about properties of data-flow nodes.
  */
+overlay[local]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides classes for working with static single assignment form (SSA).
  */
+overlay[local]
+module;
 
 import go
 private import SsaImpl

@@ -3,6 +3,8 @@
  *
  * Provides predicates for constructing an SSA representation for functions.
  */
+overlay[local]
+module;
 
 import go
 

@@ -2,6 +2,8 @@
  * Provides classes for performing local (intra-procedural) and
  * global (inter-procedural) taint-tracking analyses.
  */
+overlay[local?]
+module;
 
 import semmle.go.dataflow.DataFlow
 

@@ -1,6 +1,8 @@
 /**
  * Provides an implementation of a commonly used barrier guard for sanitizing untrusted URLs.
  */
+overlay[local?]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides an implementation of a commonly used barrier guard for sanitizing untrusted URLs.
  */
+overlay[local?]
+module;
 
 import go
 

@@ -1,6 +1,8 @@
 /**
  * Provides an implementation of a commonly used barrier guard for sanitizing untrusted URLs.
  */
+overlay[local?]
+module;
 
 import go
 

@@ -1,4 +1,6 @@
 /** Contains predicates for dealing with container flow. */
+overlay[local?]
+module;
 
 import go
 private import DataFlowNodes

@@ -1,3 +1,6 @@
+overlay[local?]
+module;
+
 private import go
 private import DataFlowPrivate
 
@@ -119,6 +122,7 @@ class ArgumentPosition extends int {
 }
 
 /** Holds if arguments at position `apos` match parameters at position `ppos`. */
+overlay[caller?]
 pragma[inline]
 predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
 
@@ -130,6 +134,7 @@ private predicate isInterfaceMethod(Method c) {
  * Holds if `call` is passing `arg` to param `p` in any circumstance except passing
  * a receiver parameter to a concrete method.
  */
+overlay[caller?]
 pragma[inline]
 predicate golangSpecificParamArgFilter(
   DataFlowCall call, DataFlow::ParameterNode p, DataFlow::ArgumentNode arg
-Original file line number
+Diff line change
@@ Expand Up / @@ -3,6 +3,8 @@ @@
      *
      * Provides predicates for building intra-procedural CFGs.
      */
+    overlay[local]
+    module;
     import go
@@ Expand Down @@