Update Go Path Injection Sanitizer and Sink

[Kwstubbs]

Account for os.PathSeparator in Go sanitizer and remove CreateTemp from valid sinks

[Copilot]

Pull Request Overview

This PR updates the Go path injection query to improve sanitization detection and removes a false positive. The changes account for os.PathSeparator as a valid path sanitizer alongside hardcoded "/" and remove CreateTemp from path injection sinks due to proper built-in sanitization.

• Updates path injection sanitizers to recognize os.PathSeparator usage
• Removes CreateTemp from path injection sinks in the os package model
• Adds test coverage for the new sanitizer pattern

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
go/ql/test/query-tests/Security/CWE-022/TaintedPath.go	Adds test case for os.PathSeparator sanitization pattern
go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected	Updates expected test results for line number changes
go/ql/lib/ext/os.model.yml	Removes CreateTemp from path injection sinks
go/ql/lib/change-notes/2025-07-15-path-injection-sanitizers.md	Documents the changes in release notes

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. A recent commit removed the previously reported differences.

[Kwstubbs]

Sorry, I somehow forgot to add the actual CodeQL change.

[owen-mc]

You'll also have to update the test expectation here since CreateTemp is no longer a sink.

[owen-mc]

If we use getStringValue on any reference of os.PathSeparator then we'll get its actual string value (the compiler knows what value a constant has). On Windows of course this is "\". So we can simplify this to:

Suggested change

	concatNode.getOperand(0).asExpr().(StringLit).getValue() = "/"
	or
	exists(DeclaredConstant dc |
	dc.hasQualifiedName("os", "PathSeparator") and
	dc.getAReference() = concatNode.getOperand(0).asExpr().getAChildExpr*()
	)
	concatNode.getOperand(0).getStringValue() = ["/", "\"]

The above code allows using the string literal "\" as well, which seems sensible for any code which is written to only be run on Windows. What do you think?

[Kwstubbs]

I have added concatNode.getOperand(0).getStringValue().prefix(1) to account for cases where there is additional text but the first element is still appropriate.

[owen-mc]

Thanks for these improvements. I've taken the liberty of rewording the change note directly as I'm about to go away for 4 weeks so you'd be waiting a long time for a review otherwise.

[Kwstubbs]

@owen-mc just want to send a reminder for possibly merging soon 😄

[owen-mc]

Oops. Thanks for the reminder. I think I forgot that you can't merge it yourself.