diff --git a/go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll b/go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll index ecf277e882af..4da2f6fe0ca7 100644 --- a/go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll +++ b/go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll @@ -123,9 +123,19 @@ module NetHttp { private DataFlow::Node getSummaryInputOrOutputNode( DataFlow::CallNode call, SummaryComponentStack stack ) { - exists(int n | - stack = SummaryComponentStack::argument(n) and - result = call.getArgument(n) + exists(int n | result = call.getSyntacticArgument(n) | + if result = call.getImplicitVarargsArgument(_) + then + exists( + int lastParamIndex, SummaryComponentStack varArgsSliceArgument, + SummaryComponent arrayContentSC, DataFlow::ArrayContent arrayContent + | + lastParamIndex = call.getCall().getCalleeType().getNumParameter() - 1 and + varArgsSliceArgument = SummaryComponentStack::argument(lastParamIndex) and + arrayContentSC = SummaryComponent::content(arrayContent) and + stack = SummaryComponentStack::push(arrayContentSC, varArgsSliceArgument) + ) + else stack = SummaryComponentStack::argument(n) ) or stack = SummaryComponentStack::argument(-1) and