Go: Use value flow instead of taint flow for go/incorrect-integer-conversion

[owen-mc]

This should remove some FPs and also improve performance, especially on projects with lots of FPs. I have done a DCA run and the results look good. I will do a DCA QA run.

[smowton]

s/DCA/QA?

[owen-mc]

Probably the best way of reviewing this is spot-checking some of the alert changes in QA. (I've checked the DCA ones and they're fine.)

[smowton]

Should we add back steps that are clearly taint-preserving for this query, like some arithmetic?

[owen-mc]

@smowton It's a bit complicated, as technically any arithmetic might change how many bits are required to represent the number in question. So it opens us up to false positives. Have you seen any examples of alerts which are lost which would be found if we added arithmetic taint steps? (Also, in the longer term we should probably use the shared range analysis, which will do this for us.)

[smowton]

No. I'm afraid I haven't the time to trawl results from the QA run, so if you've done so and are satisfied with the results I'll just take your word for it and approve.

[smowton]

(add a change note though)

[owen-mc]

On closer examination of the QA results, we are currently losing results because value flow through append isn't working correctly. I'm marking this as a draft until I can merge #16413, rebase and rerun QA.