Skip to content

Rust: Use QL computed canonical paths in MaD Field tokens #19667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Jun 12, 2025
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion misc/scripts/models-as-data/generate_mad.py
Original file line number Diff line number Diff line change
Expand Up @@ -214,4 +214,4 @@ def run(self):
self.save(typeBasedContent, ".typebased.model.yml")

if __name__ == '__main__':
Generator.make().run()
Generator.make().run()
19 changes: 2 additions & 17 deletions rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll
Original file line number Diff line number Diff line change
Expand Up @@ -68,29 +68,14 @@ module Input implements InputSig<Location, RustDataFlow> {
result = "Field" and
(
exists(Addressable a, int pos, string prefix |
// TODO: calculate in QL
arg = prefix + "(" + pos + ")" and
(
prefix = a.getExtendedCanonicalPath()
or
a = any(OptionEnum o).getSome() and
prefix = "crate::option::Option::Some"
or
exists(string name |
a = any(ResultEnum r).getVariant(name) and
prefix = "crate::result::Result::" + name
)
)
arg = prefix + "(" + pos + ")" and prefix = a.getCanonicalPath()
|
c.(TupleFieldContent).isStructField(a, pos)
or
c.(TupleFieldContent).isVariantField(a, pos)
)
or
exists(Addressable a, string field |
// TODO: calculate in QL
arg = a.getExtendedCanonicalPath() + "::" + field
|
exists(Addressable a, string field | arg = a.getCanonicalPath() + "::" + field |
c.(StructFieldContent).isStructField(a, field)
or
c.(StructFieldContent).isVariantField(a, field)
Expand Down
4 changes: 2 additions & 2 deletions rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,9 @@
* - `ReturnValue`: the value returned by a function call.
* - `Element`: an element in a collection.
* - `Field[t::f]`: field `f` of the variant/struct with canonical path `t`, for example
* `Field[crate::ihex::Record::Data::value]`.
* `Field[ihex::Record::Data::value]`.
* - `Field[t(i)]`: position `i` inside the variant/struct with canonical path `v`, for example
* `Field[crate::option::Option::Some(0)]`.
* `Field[core::option::Option::Some(0)]`.
* - `Field[i]`: the `i`th element of a tuple.
* 4. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
Expand Down
8 changes: 4 additions & 4 deletions rust/ql/lib/codeql/rust/frameworks/http.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,10 @@ extensions:
pack: codeql/rust-all
extensible: sourceModel
data:
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http1::SendRequest>::send_request", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http2::SendRequest>::send_request", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http1::SendRequest>::try_send_request", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http2::SendRequest>::try_send_request", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http1::SendRequest>::send_request", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http2::SendRequest>::send_request", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http1::SendRequest>::try_send_request", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http2::SendRequest>::try_send_request", "ReturnValue.Future.::Result::Ok(0)]", "remote", "manual"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one looks broken, we've lost Field[core::result

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@redsun82 : Did you see this comment?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm, shouldn't CI catch this?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's fixed now, it was an editing mistake during search&replace. But now I'm wary: shouldn't that have been catched?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think perhaps there are some validation checks that we could enable.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would Private::External::invalidSpecComponent like is used in this query flag that, if we didn't look for a SummarizedCallable?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I think so.

- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::Client>::get", "ReturnValue.Future", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::Client>::request", "ReturnValue.Future", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper-util:hyper-util", "<crate::client::legacy::Client>::get", "ReturnValue.Future", "remote", "manual"]
Expand Down
6 changes: 3 additions & 3 deletions rust/ql/lib/codeql/rust/frameworks/log.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,9 @@ extensions:
- ["lang:std", "<crate::io::stdio::StderrLock as crate::io::Write>::write", "Argument[0]", "log-injection", "manual"]
- ["lang:std", "<crate::io::stdio::StderrLock as crate::io::Write>::write_all", "Argument[0]", "log-injection", "manual"]
- ["lang:core", "crate::panicking::panic_fmt", "Argument[0]", "log-injection", "manual"]
- ["lang:core", "crate::panicking::assert_failed", "Argument[3].Field[crate::option::Option::Some(0)]", "log-injection", "manual"]
- ["lang:core", "crate::panicking::assert_failed", "Argument[3].Field[core::option::Option::Some(0)]", "log-injection", "manual"]
- ["lang:core", "<crate::option::Option>::expect", "Argument[0]", "log-injection", "manual"]
- ["repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err", "<crate::option::Option as crate::LogErrOption>::log_expect", "Argument[0]", "log-injection", "manual"]
- ["repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err", "<crate::result::Result as crate::LogErrResult>::log_unwrap", "Argument[self].Field[crate::result::Result::Err(0)]", "log-injection", "manual"]
- ["repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err", "<crate::result::Result as crate::LogErrResult>::log_unwrap", "Argument[self].Field[core::result::Result::Err(0)]", "log-injection", "manual"]
- ["repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err", "<crate::result::Result as crate::LogErrResult>::log_expect", "Argument[0]", "log-injection", "manual"]
- ["repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err", "<crate::result::Result as crate::LogErrResult>::log_expect", "Argument[self].Field[crate::result::Result::Err(0)]", "log-injection", "manual"]
- ["repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err", "<crate::result::Result as crate::LogErrResult>::log_expect", "Argument[self].Field[core::result::Result::Err(0)]", "log-injection", "manual"]
24 changes: 12 additions & 12 deletions rust/ql/lib/codeql/rust/frameworks/reqwest.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ extensions:
pack: codeql/rust-all
extensible: sourceModel
data:
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "crate::get", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "crate::blocking::get", "ReturnValue.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "crate::get", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "crate::blocking::get", "ReturnValue.Field[core::result::Result::Ok(0)]", "remote", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
Expand All @@ -15,13 +15,13 @@ extensions:
pack: codeql/rust-all
extensible: summaryModel
data:
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::text", "Argument[self]", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::text_with_charset", "Argument[self]", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::bytes", "Argument[self]", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::chunk", "Argument[self]", "ReturnValue.Future.Field[crate::result::Result::Ok(0)].Field[crate::option::Option::Some(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::blocking::response::Response>::text", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::blocking::response::Response>::text_with_charset", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::blocking::response::Response>::bytes", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::async_impl::response::Response>::text", "Argument[self]", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::async_impl::response::Response>::bytes", "Argument[self]", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::async_impl::response::Response>::chunk", "Argument[self]", "ReturnValue.Future.Field[crate::result::Result::Ok(0)].Field[crate::option::Option::Some(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::text", "Argument[self]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::text_with_charset", "Argument[self]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::bytes", "Argument[self]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::chunk", "Argument[self]", "ReturnValue.Future.Field[core::result::Result::Ok(0)].Field[core::option::Option::Some(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::blocking::response::Response>::text", "Argument[self]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::blocking::response::Response>::text_with_charset", "Argument[self]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::blocking::response::Response>::bytes", "Argument[self]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::async_impl::response::Response>::text", "Argument[self]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::async_impl::response::Response>::bytes", "Argument[self]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::async_impl::response::Response>::chunk", "Argument[self]", "ReturnValue.Future.Field[core::result::Result::Ok(0)].Field[core::option::Option::Some(0)]", "taint", "manual"]
4 changes: 2 additions & 2 deletions rust/ql/lib/codeql/rust/frameworks/rusqlite.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ extensions:
pack: codeql/rust-all
extensible: sourceModel
data:
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::row::Row>::get", "ReturnValue.Field[crate::result::Result::Ok(0)]", "database", "manual"]
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::row::Row>::get", "ReturnValue.Field[core::result::Result::Ok(0)]", "database", "manual"]
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::row::Row>::get_unwrap", "ReturnValue", "database", "manual"]
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::row::Row>::get_ref", "ReturnValue.Field[crate::result::Result::Ok(0)]", "database", "manual"]
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::row::Row>::get_ref", "ReturnValue.Field[core::result::Result::Ok(0)]", "database", "manual"]
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::row::Row>::get_ref_unwrap", "ReturnValue", "database", "manual"]
10 changes: 5 additions & 5 deletions rust/ql/lib/codeql/rust/frameworks/stdlib/env.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@ extensions:
data:
- ["lang:std", "crate::env::args", "ReturnValue.Element", "commandargs", "manual"]
- ["lang:std", "crate::env::args_os", "ReturnValue.Element", "commandargs", "manual"]
- ["lang:std", "crate::env::current_dir", "ReturnValue.Field[crate::result::Result::Ok(0)]", "commandargs", "manual"]
- ["lang:std", "crate::env::current_exe", "ReturnValue.Field[crate::result::Result::Ok(0)]", "commandargs", "manual"]
- ["lang:std", "crate::env::home_dir", "ReturnValue.Field[crate::option::Option::Some(0)]", "commandargs", "manual"]
- ["lang:std", "crate::env::var", "ReturnValue.Field[crate::result::Result::Ok(0)]", "environment", "manual"]
- ["lang:std", "crate::env::var_os", "ReturnValue.Field[crate::option::Option::Some(0)]", "environment", "manual"]
- ["lang:std", "crate::env::current_dir", "ReturnValue.Field[core::result::Result::Ok(0)]", "commandargs", "manual"]
- ["lang:std", "crate::env::current_exe", "ReturnValue.Field[core::result::Result::Ok(0)]", "commandargs", "manual"]
- ["lang:std", "crate::env::home_dir", "ReturnValue.Field[core::option::Option::Some(0)]", "commandargs", "manual"]
- ["lang:std", "crate::env::var", "ReturnValue.Field[core::result::Result::Ok(0)]", "environment", "manual"]
- ["lang:std", "crate::env::var_os", "ReturnValue.Field[core::option::Option::Some(0)]", "environment", "manual"]
- ["lang:std", "crate::env::vars", "ReturnValue.Element", "environment", "manual"]
- ["lang:std", "crate::env::vars_os", "ReturnValue.Element", "environment", "manual"]
14 changes: 7 additions & 7 deletions rust/ql/lib/codeql/rust/frameworks/stdlib/fs.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@ extensions:
pack: codeql/rust-all
extensible: sourceModel
data:
- ["lang:std", "crate::fs::read", "ReturnValue.Field[crate::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "crate::fs::read_to_string", "ReturnValue.Field[crate::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "crate::fs::read_link", "ReturnValue.Field[crate::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "crate::fs::read", "ReturnValue.Field[core::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "crate::fs::read_to_string", "ReturnValue.Field[core::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "crate::fs::read_link", "ReturnValue.Field[core::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "<crate::fs::DirEntry>::path", "ReturnValue", "file", "manual"]
- ["lang:std", "<crate::fs::DirEntry>::file_name", "ReturnValue", "file", "manual"]
- ["lang:std", "<crate::fs::File>::open", "ReturnValue.Field[crate::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "<crate::fs::File>::open_buffered", "ReturnValue.Field[crate::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "<crate::fs::File>::open", "ReturnValue.Field[core::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "<crate::fs::File>::open_buffered", "ReturnValue.Field[core::result::Result::Ok(0)]", "file", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
Expand Down Expand Up @@ -48,5 +48,5 @@ extensions:
- ["lang:std", "<crate::path::PathBuf as crate::convert::From>::from", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["lang:std", "<crate::path::Path>::join", "Argument[self]", "ReturnValue", "taint", "manual"]
- ["lang:std", "<crate::path::Path>::join", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["lang:std", "<crate::path::Path>::canonicalize", "Argument[self].OptionalStep[normalize-path]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["lang:std", "<crate::path::Path>::canonicalize", "Argument[self].OptionalBarrier[normalize-path]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["lang:std", "<crate::path::Path>::canonicalize", "Argument[self].OptionalStep[normalize-path]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["lang:std", "<crate::path::Path>::canonicalize", "Argument[self].OptionalBarrier[normalize-path]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
4 changes: 2 additions & 2 deletions rust/ql/lib/codeql/rust/frameworks/stdlib/io.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ extensions:
extensible: summaryModel
data:
- ["lang:std", "<crate::io::buffered::bufreader::BufReader>::new", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["lang:std", "<crate::io::buffered::bufreader::BufReader as crate::io::BufRead>::fill_buf", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["lang:std", "<crate::io::buffered::bufreader::BufReader as crate::io::BufRead>::fill_buf", "Argument[self]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["lang:std", "<crate::io::buffered::bufreader::BufReader>::buffer", "Argument[self]", "ReturnValue", "taint", "manual"]
- ["lang:std", "<crate::io::stdio::Stdin as crate::io::Read>::read", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
- ["lang:std", "<crate::io::stdio::StdinLock as crate::io::Read>::read", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
Expand All @@ -36,4 +36,4 @@ extensions:
- ["lang:std", "crate::io::Read::chain", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["lang:std", "crate::io::Read::take", "Argument[self]", "ReturnValue", "taint", "manual"]
- ["lang:std", "<crate::io::stdio::Stdin>::lock", "Argument[self]", "ReturnValue", "taint", "manual"]
- ["lang:std", "<crate::io::Split as crate::iter::traits::iterator::Iterator>::next", "Argument[self]", "ReturnValue.Field[crate::option::Option::Some(0)].Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["lang:std", "<crate::io::Split as crate::iter::traits::iterator::Iterator>::next", "Argument[self]", "ReturnValue.Field[core::option::Option::Some(0)].Field[core::result::Result::Ok(0)]", "taint", "manual"]
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,6 @@ extensions:
- ["lang:alloc", "<crate::string::String>::as_str", "Argument[self]", "ReturnValue", "value", "manual"]
- ["lang:alloc", "<crate::string::String>::as_bytes", "Argument[self]", "ReturnValue", "value", "manual"]
- ["lang:alloc", "<_ as crate::string::ToString>::to_string", "Argument[self]", "ReturnValue", "taint", "manual"]
- ["lang:alloc", "<crate::string::String>::parse", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["lang:alloc", "<crate::string::String>::parse", "Argument[self]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["lang:alloc", "<crate::string::String>::trim", "Argument[self]", "ReturnValue.Reference", "taint", "manual"]
- ["lang:alloc", "<crate::string::String as crate::convert::From>::from", "Argument[0]", "ReturnValue", "value", "manual"]
Loading