Go: fix CFG for nested labels

[owen-mc]

Fix Go CFG construction for goto statements targeting an enclosing label, including the inner label in stacked labels.

Problem

The shared CFG logic resolves goto targets that are sibling statements in the same block. It did not handle this pattern:

outer:
inner:
{
    goto inner
}

Here, inner encloses the current block rather than appearing inside it. The goto completion therefore failed to reach its target.

This kind of code is rarely written by hand, but is commonly generated by parser generators.

Fix

We already have Go-specific goto handling to cover targets that the shared block logic cannot see. Currently it just covers Top-level statements in function bodies.. In this PR we extend it to labels enclosing the current node.

The target is matched against the direct LabeledStmt, ensuring stacked labels such as inner and outer remain distinct.

A focused CFG regression test covers all gotos in the stacked-label example and demonstrates the missing inner edge before the fix.

I have validated this fixed some incorrect alert changes in real projects.

This does not need a change note because it fixes FPs that have never been in a release.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new guard still prevents resolution when an enclosing label directly labels the goto statement.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Guard incorrectly rejects nested labeled goto resolution · New

What changed in this PR

Fixes Go CFG resolution for goto statements targeting enclosing and stacked labels.

Changes:

• Extends Go-specific goto target handling to enclosing labels.
• Adds an inline CFG regression test for stacked labels.

File	Description
ControlFlowGraphImpl.qll	Resolves additional enclosing goto targets.
GotoTarget.ql	Defines inline CFG assertions.
gotos.go	Adds stacked-label test cases.
GotoTarget.expected	Adds the generated expected baseline.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.