False positive pattern in loop pointer rule

[romdr]

This pattern seems incorrect:

      - pattern: |
          for _, $VALUE := range $SOURCE {
            <... $ANYTHING(..., <... $VALUE ...>, ...) ...>
          }

This triggers a semgrep warning:

	input := []string{"a", "b", "c"}
	output := []string{}

	for _, val := range input {
		output = append(output, val)
	}

There is no pointer involved here.

Go Playground example here.

Semgrep Playground example:

[enncoded]

Hey! Thanks for filing this issue :)

I don't think Semgrep can do that kind of type analysis over contents of a collection in Go right now. I filed an issue to the engine team https://github.com/returntocorp/semgrep/issues/8117, so hopefully this should be fixed soon!