-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Rust: Correct from model to taint #20529
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
…ntional dependence on the taint flow.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
Correct the data flow model of the From trait from value to taint in Rust's core library, which exposed an issue with sources in the hard-coded cryptographic value query that was also fixed.
Key changes:
- Changed the flow model for
<_ as core::convert::From>::fromfromvaluetotaint - Fixed array repeat expressions (
[0; 10]) not being recognized as hardcoded cryptographic sources - Updated test expectations to reflect the corrected taint flow behavior
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml | Changed From trait model from value to taint flow |
| rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll | Added support for array repeat expressions as hardcoded sources |
| rust/ql/test/library-tests/dataflow/strings/main.rs | Updated test comment from hasValueFlow to hasTaintFlow |
| rust/ql/test/library-tests/dataflow/strings/inline-taint-flow.expected | Updated expected test results for taint flow |
| rust/ql/test/query-tests/security/CWE-022/TaintedPath.expected | Updated expected test results for taint flow |
| rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected | Updated expected test results reflecting array repeat expression support |
paldepind
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Makes sense 👍
hvitved
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks
|
Fixed the merge conflict. |
|
Thanks for re-approving. |
Correct the model of
fromfromvaluetotaint.This exposed an issue with the sources for
rust/hard-coded-cryptographic-value, also fixed.I'll do a DCA run to check for other unexpected consequences.