Go: more models for log.slog

[owen-mc]

Follow-on from #22004.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

go

Generated file changes for go

• Changes to framework-coverage-go.rst:

-    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,612,124
+    `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,625,127
-    Totals,,688,1072,1577
+    Totals,,688,1085,1580

• Changes to framework-coverage-go.csv:

- log,40,,3,,,,40,,,,,,,,,,,,,,,,,,,3,
+ log,43,,16,,,,43,,,,,,,,,,,,,,,,,,,16,

[Copilot]

⚠️ Not ready to approve

The updated change note is now incomplete/inaccurate relative to the expanded log/slog modeling added in this PR.

Pull request overview

This PR extends the Go standard-library log/slog modeling to cover additional APIs beyond the core logging calls, building on the earlier LoggerCall/log-injection support to improve query coverage and model validation.

Changes:

• Add log/slog models for With/WithGroup as log-injection sinks and add summary models for Attr/Value construction/accessors.
• Add a new frameworks/Slog library-test module to validate taint/value flows through the new models.
• Extend the LoggerCall concept library test cases to include With/WithGroup.

File summaries

File	Description
go/ql/test/library-tests/semmle/go/frameworks/Slog/test.go	New Go test cases exercising slog calls, Logger methods, With/WithGroup, and Attr/Value helpers.
go/ql/test/library-tests/semmle/go/frameworks/Slog/TaintFlows.ql	New inline-flow test query configuration for validating modeled sinks/summaries.
go/ql/test/library-tests/semmle/go/frameworks/Slog/TaintFlows.expected	Expected output marker file for the inline-flow test.
go/ql/test/library-tests/semmle/go/frameworks/Slog/go.mod	New Go module file (Go 1.21) for the Slog library test.
go/ql/test/library-tests/semmle/go/concepts/LoggerCall/slog.go	Adds With/WithGroup cases to the LoggerCall library test.
go/ql/lib/ext/log.slog.model.yml	Adds sink models for With/WithGroup and summary models for Attr/Value constructors/accessors.
go/ql/lib/change-notes/2026-06-17-model-log-slog.md	Updates the change note text (needs adjustment to reflect the full modeled surface).

Copilot's findings

• Files reviewed: 7/7 changed files
• Comments generated: 1

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.