Rust: fix CleartextLogging query

[aibaars]

This pull request adds argument 1 of log::__private_api::log as a log injection sink.

Line 42: debug!("message = {}", password);
expands to:

// Recursive expansion of debug! macro
// ====================================

{
    {
        let lvl = (log::Level::Debug);
        if lvl <= log::STATIC_MAX_LEVEL && lvl <= log::max_level() {
            log::__private_api::log(
                ({ log::__private_api::GlobalLogger }),
                log::__private_api::format_args!("message = {}", password),
                lvl,
                &(
                    (log::__private_api::module_path!()),
                    log::__private_api::module_path!(),
                    log::__private_api::loc(),
                ),
                (),
            );
        }
    }
}

Most likely this commit is responsible for the sudden test failure. That commit is part of the log crate since version 0.4.27.

An alternative "fix" would be to pin version of the log the dependency in the test case, but that's not a great solution. It's probably a good thing that we are notified by changes that break our tests.

qltest_dependencies:
    - log = { version = "= 0.4.26", features = ["kv"] }
    - simple_logger = { version = "5.0.0" }

[Copilot]

Pull Request Overview

This pull request addresses a break in the CleartextLogging query by updating the log injection sink mappings in the log model YAML file to support changes introduced in log version 0.4.27.

• Updated the argument index mappings in log.model.yml for pre-0.4.27 compatibility.
• Adjusted inline comments to reflect the new mapping of parameters.

Files not reviewed (2)

• rust/ql/test/query-tests/security/CWE-020/RegexInjection.expected: Language not supported
• rust/ql/test/query-tests/security/CWE-312/CleartextLogging.expected: Language not supported

Comments suppressed due to low confidence (1)

rust/ql/lib/codeql/rust/frameworks/log.model.yml:6

• [nitpick] Consider clarifying the inline comment for this entry to explicitly state that it maps the logger parameter for pre-0.4.27 in order to improve maintainability and readability.

+      - ["repo:https://github.com/rust-lang/log:log", "crate::__private_api::log", "Argument[0]", "log-injection", "manual"] # logger / args (pre v0.4.27)

Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more

[geoffw0]

LGTM, thank you for figuring this one!