Go: Handle quoted dots in hostname regexps

[theinfosecguy]

go/incomplete-hostname-regexp reports literal hostname dots inside Go's \Q...\E quoting as wildcards. For example, ^\Qhttps://github.com/\E$ produces a false positive.

Recognize quoted dots when the complete pattern is statically known. Preserve existing alerts for wildcard dots outside quoting and unsafe concatenations with escaped quote openers, and retain existing behavior for unresolved patterns.

Add regressions for raw and interpreted strings, quoting boundaries, constant aliases, and regexp compilation and matching APIs, plus a change note.

Validation:

• All four Go CWE-020 query-test suites pass with CodeQL 2.27.0.
• The new quoting fixture covers 13 unsafe operations and 11 safe operations.
• QL formatting and git diff --check pass.

Fixes #15894.

[owen-mc]

Thanks for this contribution. Before I review this, can I ask how you came across this problem, and why you want it fixed. Did you experience FPs caused by it? Or did you find the issue that you linked to? From my point of view this is quite a lot of added complication in the code for a low value FP fix. There are other things that we could be spending time on that would improve CodeQL more.

[theinfosecguy]

I came across #15894 while looking for a way to contribute and reproduced it locally. Fair point about the added complexity. I'm happy to pick up something higher priority.

[owen-mc]

What languages are you interested in working on? Since our support for Rust is much newer, there are some FPs to fix there which would be much more impactful. CodeQL for actions is also a newly-supported language, where there are lots of things that could be improved.

Another way to contribute is to add queries that we have for some languages to other languages where they are missing. For example, I used Copilot to make #22019 (C#) but I haven't had a chance to review it. I also wanted to adopt this request forgery query for C# written by Microsoft on their fork of CodeQL.

Complicated modelling is also very welcome, like your Spring MVC PR.

[theinfosecguy]

Thanks, Owen! I'm open to working across languages, though I'd lean toward GitHub Actions over Rust. Is there a specific issue you'd like me to prioritize?

[owen-mc]

#19635
Probably the best way is looking at open issues. It's probably also worth looking at open PRs relating to CodeQL for Actions to check what's in progress. Unfortunately there isn't much capacity for reviewing Actions PRs at the moment.