Go: Model `log/slog` as a logging sink#22004

sauyon

The standard-library structured logger log/slog (Go 1.21+) was not modeled, so go/log-injection and go/clear-text-logging were blind to any code that logs through it.

Model its logging functions and *slog.Logger methods — Debug, Info, Warn, Error, their Context variants, and Log/LogAttrs — as log-injection sinks (the kind that feeds LoggerCall, powering both queries). Adds log/slog cases to the LoggerCall library test.

The standard-library structured logger `log/slog` (Go 1.21+) was not modeled, so `go/log-injection` and `go/clear-text-logging` were blind to any code that logs through it. Model its logging functions and `*slog.Logger` methods — `Debug`, `Info`, `Warn`, `Error`, their `Context` variants, and `Log`/`LogAttrs` — as `log-injection` sinks (the kind that feeds `LoggerCall`, powering both queries). Adds `log/slog` cases to the `LoggerCall` library test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds CodeQL Go sink modeling for the standard-library log/slog (Go 1.21+) so that go/log-injection and go/clear-text-logging can recognize slog logging calls via LoggerCall, and extends the corresponding library test coverage.

Changes:

Added sinkModel entries for log/slog package-level functions and *slog.Logger methods (including Context variants and Log/LogAttrs).
Added log/slog call sites to the LoggerCall library test suite.
Bumped the test module’s Go version to 1.21 to enable log/slog.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
go/ql/test/library-tests/semmle/go/concepts/LoggerCall/slog.go	Adds `slog` call sites with inline expectations for `LoggerCall`.
go/ql/test/library-tests/semmle/go/concepts/LoggerCall/main.go	Introduces `key` constant and invokes `slogTest()`.
go/ql/test/library-tests/semmle/go/concepts/LoggerCall/go.mod	Updates Go version to 1.21 for `log/slog` availability.
go/ql/lib/ext/log.slog.model.yml	Adds `log/slog` sink models for `log-injection`.
go/ql/lib/change-notes/2026-06-17-model-log-slog.md	Documents the new `log/slog` models in change notes.

Copilot review on github#22004: the Log/LogAttrs test cases didn't pass any variadic args/attrs, so the Argument[..3] portion of the sink range was untested. Pass an ...any arg to slog.Log/Logger.Log and a slog.Attr to slog.LogAttrs/Logger.LogAttrs, with inline expectations asserting they're captured as logged components. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

github-actions

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

go

Generated file changes for go

Changes to framework-coverage-go.rst:

-    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,612,104
+    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,612,124
-    Totals,,688,1072,1557
+    Totals,,688,1072,1577

Changes to framework-coverage-go.csv:

- log,20,,3,,,,20,,,,,,,,,,,,,,,,,,,3,
+ log,40,,3,,,,40,,,,,,,,,,,,,,,,,,,3,

owen-mc

Hi Sauyon. Long time, no see! Thanks for this contribution. I've been meaning to get around to it since we skipped it 😬 . There are a few extra things that could be modeled (With as a sink, summary models for the methods for making Attrs), but this will cover the vast majority of the usage. I'll try to find time to do the rest as a follow-up.

sauyon requested a review from a team as a code owner June 18, 2026 03:14

Copilot AI review requested due to automatic review settings June 18, 2026 03:14

github-actions Bot added documentation Go labels Jun 18, 2026

Copilot started reviewing on behalf of sauyon June 18, 2026 03:15 View session

Copilot AI reviewed Jun 18, 2026

View reviewed changes

owen-mc approved these changes Jun 18, 2026

View reviewed changes

owen-mc mentioned this pull request Jun 18, 2026

Go: more models for log.slog #22006

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Go: Model `log/slog` as a logging sink#22004