Rust: Improve handling of implicit derefs/borrows in data flow

[hvitved]

This PR updates the handling of implicit dereferencing/borrowing in data flow to strictly follow what has been concluded by the type inference library. This revealed inconsistencies in some models (typically Argument[self] instead of Argument[self].Reference), which has been fixed.

This PR also adds implicit deref steps for qualifiers of field expressions.

Update: This PR also changes how explicit dereferences are treated in data flow: for *x we do the equivalent of *Deref::deref(&x) (see https://doc.rust-lang.org/std/ops/trait.Deref.html#deref-coercion), and this also works when x has type & or &mut, because of https://doc.rust-lang.org/std/ops/trait.Deref.html#impl-Deref-for-%26T and https://doc.rust-lang.org/std/ops/trait.Deref.html#impl-Deref-for-%26mut+T, which we add new models for.

DCA seems good; we loose some results, but I suspect the vast majority to be FPs due to the previous imprecision.

[hvitved]

CC @geoffw0 for the changes to models.

[Copilot]

Pull request overview

This PR improves the handling of implicit dereferencing and borrowing in Rust data flow analysis to align with type inference conclusions. The changes update data flow models to use .Reference where implicit borrows occur and add implicit deref steps for field expression qualifiers.

• Updates summary models to use Argument[self].Reference instead of Argument[self] for methods that take &self or &mut self
• Adds intermediate data flow nodes representing implicit borrows/derefs
• Changes some test queries from ValueFlow to TaintFlow to better align with the refined analysis

Reviewed changes

Copilot reviewed 40 out of 40 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
rust/ql/test/query-tests/security/CWE-770/UncontrolledAllocationSize.expected	Updated expected test results showing refined data flow edges with .Reference and intermediate borrow nodes
rust/ql/test/query-tests/security/CWE-614/InsecureCookie.expected	Shows removal of direct edges and addition of intermediate nodes for method calls on borrowed values
rust/ql/test/query-tests/security/CWE-312/CleartextStorageDatabase.expected	Updates flow edges to include explicit borrow steps before method calls
rust/ql/test/query-tests/security/CWE-312/CleartextLogging.expected	Similar refinements with intermediate nodes for borrowed method receivers
rust/ql/test/query-tests/security/CWE-117/LogInjection.expected	Model updates showing .Reference for iterator methods
rust/ql/test/query-tests/security/CWE-089/SqlInjection.expected	Extensive edge additions for intermediate borrow nodes in SQL query construction
rust/ql/test/query-tests/security/CWE-022/TaintedPath.expected	Path canonicalization flow now includes intermediate borrow steps
rust/ql/test/library-tests/type-inference/type-inference.ql	Function signature updates to accept additional parameter
rust/ql/test/library-tests/dataflow/taint/TaintFlowStep.expected	New edges showing borrowed state tracking
rust/ql/test/library-tests/dataflow/strings/main.rs	Comment update noting changed semantics for as_str()
rust/ql/test/library-tests/dataflow/strings/inline-taint-flow.expected	Flow edge refinements and model updates
rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected	Addition of intermediate nodes for path parameter extraction
rust/ql/test/library-tests/dataflow/sources/stdin/InlineFlow.expected	Extensive model updates for stdin read operations with .Reference
rust/ql/test/library-tests/dataflow/sources/net/InlineFlow.expected	Network I/O model updates with intermediate borrow nodes
rust/ql/test/library-tests/dataflow/sources/file/InlineFlow.expected	File I/O operations now track intermediate borrows explicitly
rust/ql/test/library-tests/dataflow/sources/env/InlineFlow.expected	Environment variable access model update
rust/ql/test/library-tests/dataflow/pointers/inline-flow.ql	Test query updated from ValueFlow to TaintFlow
rust/ql/test/library-tests/dataflow/modeled/inline-flow.ql	Test query updated from ValueFlow to TaintFlow

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[geoffw0]

Mode, test and DCA changes LGTM, apart from a couple of small issues / questions below. FWIW I think the fact that missing out .Reference on Argument[self].Reference used to work caused me some confusion. In future, we can get them right in the first place.

[geoffw0]

Should the comment above this change be clarified?

[hvitved]

Actually, this should no longer be needed.

[geoffw0]

Whether we store taint in the Pin itself or in the pointer field is, I think, a design choice. Either way, I'd like to have consistency, so if we're keeping this change can we also change:

• the model above (for <core::pin::Pin>::new) similarly to this one.
• the model one line below (for <core::pin::Pin>::into_inner) should read Argument[0].Field[core::pin::Pin::pointer].
• the model three lines below (for <core::pin::Pin>::set) should write into Argument[self].Reference.Field[core::pin::Pin::pointer].

Also the model at the top of the block (for core::pin::Pin) appears to be a mistake, lets get rid of it.

[hvitved]

Thanks, I'll update the models.

[geoffw0]

LGTM. There are a couple of minor test failures to address.

[hvitved]

Putting back into draft mode to resolve issues.

[hvitved]

LGTM. There are a couple of minor test failures to address.

The test failures uncovered bugs in how we handle explicit derefs in data flow; this has now been fixed in the latest commit. I ran a new DCA experiment, and it still looks good.

[hvitved]

Will be fixed by #20915.