Go: Enable GoKit module into the default list

[flabbergastedbd]

Changes

Enable GoKit framework by default in go.qll

[owen-mc]

Is there a particular reason you think we should include it in the default list now? The reasoning behind the current situation is here.

[smowton]

Presumably when adding this in 3ed9e66 the idea must have been that it's common for gokit to be used in a scenario where "remote" data is actually coming from another microservice under our control and the data is in fact trusted. What makes you think it ought to be enabled by default?

[flabbergastedbd]

Thanks for the context around why this is an opt-in and not a default. My reasoning is two fold:

• GoKit is also used by externally exposed applications as well (an api gateway example existed since long time), as it can support different transports and serialisation including JSON over HTTP. Even if it used for inter service calls, security issues often arise due to the differing assumptions around data sanitisation across service boundaries.
• GoKit is very similar in abstractions for when compared to GoMicro, which is included by default.

I do not have enough large enough dataset around usage types of GoKit library, but if the team strongly feels that this should remain an opt-in due to known data/usage patterns; it makes sense.

[owen-mc]

After some internal discussion we agree with you.

Please remove the line import semmle.go.frameworks.GoKit from go/ql/test/library-tests/semmle/go/frameworks/GoKit/untrustedflowsource.ql. Then I will check that CI passes, then do a larger test on many repositories that use GoKit to check how many new alerts this will produce. If that is all fine then I will merge the PR.

[flabbergastedbd]

Ping @owen-mc

[owen-mc]

Thank you for this contribution.