Rust: Distinguish &mut T from &T in type inference

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/OperationImpl.qll

@@ -30,6 +30,7 @@ module Impl {
       op = "!" and path = "core::ops::bit::Not" and method = "not" and borrows = 0
       or
       // Dereference
+      // todo: handle `core::ops::deref::DerefMut`
       op = "*" and path = "core::ops::deref::Deref" and method = "deref" and borrows = 1
     )
     or

rust/ql/lib/codeql/rust/frameworks/stdlib/Builtins.qll

@@ -162,15 +162,20 @@ class ArrayType extends BuiltinType {
   override string getDisplayName() { result = "[;]" }
 }
 
-/** The builtin reference type `&T`. */
-class RefType extends BuiltinType {
-  RefType() { this.getName() = "Ref" }
+/** A builtin reference type `&T` or `&mut T`. */
+abstract private class RefTypeImpl extends BuiltinType { }
+
+final class RefType = RefTypeImpl;
+
+/** The builtin shared reference type `&T`. */
+class RefSharedType extends RefTypeImpl {
+  RefSharedType() { this.getName() = "Ref" }
 
   override string getDisplayName() { result = "&" }
 }
 
-/** The builtin reference type `&mut T`. */
-class RefMutType extends BuiltinType {
+/** The builtin mutable reference type `&mut T`. */
+class RefMutType extends RefTypeImpl {
   RefMutType() { this.getName() = "RefMut" }
 
   override string getDisplayName() { result = "&mut" }

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -771,8 +771,12 @@ private TypeItemNode resolveBuiltin(TypeRepr tr) {
   tr instanceof ArrayTypeRepr and
   result instanceof Builtins::ArrayType
   or
-  tr instanceof RefTypeRepr and
-  result instanceof Builtins::RefType
+  tr =
+    any(RefTypeRepr rtr |
+      if rtr.isMut()
+      then result instanceof Builtins::RefMutType
+      else result instanceof Builtins::RefSharedType
+    )
   or
   tr.(PtrTypeRepr).isConst() and
   result instanceof Builtins::PtrConstType

rust/ql/lib/codeql/rust/internal/Type.qll

@@ -224,21 +224,33 @@ TypeParamTypeParameter getArrayTypeParameter() {
   result = any(ArrayType t).getPositionalTypeParameter(0)
 }
 
-/**
- * A reference type.
- *
- * Reference types like `& i64` are modeled as normal generic types
- * with a single type argument.
- */
-class RefType extends StructType {
-  RefType() { this.getStruct() instanceof Builtins::RefType }
+abstract class RefType extends StructType { }
+
+pragma[nomagic]
+TypeParamTypeParameter getRefTypeParameter() {
+  result = any(RefType t).getPositionalTypeParameter(0)
+}
+
+class RefMutType extends RefType {
+  RefMutType() { this.getStruct() instanceof Builtins::RefMutType }
+
+  override string toString() { result = "&mut" }
+}
+
+pragma[nomagic]
+TypeParamTypeParameter getRefMutTypeParameter() {
+  result = any(RefMutType t).getPositionalTypeParameter(0)
+}
+
+class RefSharedType extends RefType {
+  RefSharedType() { this.getStruct() instanceof Builtins::RefSharedType }
 
   override string toString() { result = "&" }
 }
 
 pragma[nomagic]
-TypeParamTypeParameter getRefTypeParameter() {
-  result = any(RefType t).getPositionalTypeParameter(0)
+TypeParamTypeParameter getRefSharedTypeParameter() {
+  result = any(RefSharedType t).getPositionalTypeParameter(0)
 }
 
 /**