Skip to content

Conversation

@geoffw0
Copy link
Contributor

@geoffw0 geoffw0 commented Sep 26, 2025

Correct the model of from from value to taint.

This exposed an issue with the sources for rust/hard-coded-cryptographic-value, also fixed.

I'll do a DCA run to check for other unexpected consequences.

@geoffw0 geoffw0 requested a review from a team as a code owner September 26, 2025 09:07
@geoffw0 geoffw0 removed the request for review from a team September 26, 2025 09:07
@geoffw0 geoffw0 added the no-change-note-required This PR does not need a change note label Sep 26, 2025
Copilot AI review requested due to automatic review settings September 26, 2025 09:07
@geoffw0 geoffw0 added the Rust Pull requests that update Rust code label Sep 26, 2025
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Correct the data flow model of the From trait from value to taint in Rust's core library, which exposed an issue with sources in the hard-coded cryptographic value query that was also fixed.

Key changes:

  • Changed the flow model for <_ as core::convert::From>::from from value to taint
  • Fixed array repeat expressions ([0; 10]) not being recognized as hardcoded cryptographic sources
  • Updated test expectations to reflect the corrected taint flow behavior

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file
File Description
rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml Changed From trait model from value to taint flow
rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll Added support for array repeat expressions as hardcoded sources
rust/ql/test/library-tests/dataflow/strings/main.rs Updated test comment from hasValueFlow to hasTaintFlow
rust/ql/test/library-tests/dataflow/strings/inline-taint-flow.expected Updated expected test results for taint flow
rust/ql/test/query-tests/security/CWE-022/TaintedPath.expected Updated expected test results for taint flow
rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected Updated expected test results reflecting array repeat expression support

paldepind
paldepind previously approved these changes Sep 26, 2025
Copy link
Contributor

@paldepind paldepind left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense 👍

hvitved
hvitved previously approved these changes Sep 26, 2025
Copy link
Contributor

@hvitved hvitved left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@geoffw0 geoffw0 dismissed stale reviews from hvitved and paldepind via 1635ef9 September 26, 2025 13:11
@geoffw0
Copy link
Contributor Author

geoffw0 commented Sep 26, 2025

Fixed the merge conflict.

@geoffw0
Copy link
Contributor Author

geoffw0 commented Sep 26, 2025

Thanks for re-approving.

@geoffw0 geoffw0 merged commit a0b533b into github:main Sep 26, 2025
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-change-note-required This PR does not need a change note Rust Pull requests that update Rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants