Skip to content

Commit e820cdf

Browse files
hvitvedhvitved
committed
wip2
1 parent 57778c5 commit e820cdf

File tree

8 files changed

+80
-66
lines changed

8 files changed

+80
-66
lines changed

‎rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -461,25 +461,7 @@ module RustDataFlow implements InputSig<Location> {
461461
exists(Call c | c = call.asCall() |
462462
result.asCfgScope() = c.getARuntimeTarget()
463463
or
464-
exists(SummarizedCallable sc, Function staticTarget |
465-
staticTarget = getStaticTargetExt(c) and
466-
sc = result.asSummarizedCallable() and
467-
// Only use summarized callables with generated summaries in case
468-
// the static call target is not in the source code.
469-
// Note that if `applyGeneratedModel` holds it implies that there doesn't
470-
// exist a manual model.
471-
not (
472-
staticTarget.fromSource() and
473-
sc.applyGeneratedModel()
474-
)
475-
|
476-
sc = staticTarget
477-
or
478-
// only apply trait models to concrete implementations when they are not
479-
// defined in source code
480-
staticTarget.implements(sc) and
481-
not staticTarget.fromSource()
482-
)
464+
result.asSummarizedCallable() = getStaticTargetExt(c)
483465
)
484466
or
485467
exists(Function f | call = TImplicitDerefCall(_, _, _, f) |

‎rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll‎

Lines changed: 40 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -111,25 +111,55 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
111111
)
112112
}
113113

114-
private class SummarizedCallableFromModel extends SummarizedCallable::Range {
115-
private string path;
114+
private predicate summaryModel(
115+
Function f, string input, string output, string kind, Provenance provenance, boolean isExact,
116+
QlBuiltins::ExtensionId madId
117+
) {
118+
exists(string path, Function f0 |
119+
summaryModel(path, input, output, kind, provenance, madId) and
120+
f0.getCanonicalPath() = path
121+
|
122+
f = f0 and
123+
isExact = true
124+
or
125+
f.implements(f0) and
126+
isExact = false
127+
)
128+
}
116129

117-
SummarizedCallableFromModel() {
118-
summaryModel(path, _, _, _, _, _) and
119-
this.getCanonicalPath() = path
120-
}
130+
private predicate summaryModelRelevant(
131+
Function f, string input, string output, string kind, Provenance provenance,
132+
QlBuiltins::ExtensionId madId
133+
) {
134+
exists(boolean isExact | summaryModel(f, input, output, kind, provenance, isExact, madId) |
135+
(
136+
provenance.isManual()
137+
or
138+
provenance.isGenerated() and
139+
not any(Provenance manual | summaryModel(f, _, _, _, manual, _, _)).isManual() and
140+
not f.fromSource()
141+
) and
142+
(
143+
isExact = true
144+
or
145+
isExact = false and
146+
not summaryModel(f, _, _, _, provenance, true, _)
147+
)
148+
)
149+
}
150+
151+
private class SummarizedCallableFromModel extends SummarizedCallable::Range {
152+
SummarizedCallableFromModel() { summaryModelRelevant(this, _, _, _, _, _) }
121153

122154
override predicate hasProvenance(Provenance provenance) {
123-
summaryModel(path, _, _, _, provenance, _)
155+
summaryModelRelevant(this, _, _, _, provenance, _)
124156
}
125157

126-
private predicate hasManualModel() { summaryModel(path, _, _, _, "manual", _) }
127-
128158
override predicate propagatesFlow(
129159
string input, string output, boolean preservesValue, string model
130160
) {
131161
exists(string kind, string provenance, QlBuiltins::ExtensionId madId |
132-
summaryModel(path, input, output, kind, provenance, madId) and
162+
summaryModelRelevant(this, input, output, kind, provenance, madId) and
133163
model = "MaD:" + madId.toString() and
134164
(provenance = "manual" or not this.hasManualModel())
135165
|

‎rust/ql/lib/codeql/rust/frameworks/asyncstd/fs.model.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,6 @@ extensions:
3838
pack: codeql/rust-all
3939
extensible: summaryModel
4040
data:
41-
- ["<async_std::path::pathbuf::PathBuf as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue.Reference", "taint", "manual"]
41+
# - ["<async_std::path::pathbuf::PathBuf as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue.Reference", "taint", "manual"]
4242
- ["async_std::fs::canonicalize::canonicalize", "Argument[0].OptionalStep[normalize-path]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
4343
- ["async_std::fs::canonicalize::canonicalize", "Argument[0].OptionalBarrier[normalize-path]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]

‎rust/ql/lib/codeql/rust/frameworks/stdlib/alloc.model.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ extensions:
4747
- ["<core::alloc::layout::Layout>::pad_to_align", "Argument[self].Reference", "ReturnValue", "taint", "manual"]
4848
- ["<core::alloc::layout::Layout>::size", "Argument[self].Reference", "ReturnValue", "taint", "manual"]
4949
# String
50-
- ["<alloc::string::String as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue.Reference", "taint", "manual"]
50+
# - ["<alloc::string::String as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue.Reference", "taint", "manual"]
5151
- ["<alloc::string::String>::as_str", "Argument[self]", "ReturnValue", "value", "manual"]
5252
- ["<alloc::string::String>::as_bytes", "Argument[self]", "ReturnValue", "value", "manual"]
5353
- ["<_ as alloc::string::ToString>::to_string", "Argument[self].Reference", "ReturnValue", "taint", "manual"]

‎rust/ql/lib/codeql/rust/frameworks/stdlib/core.model.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ extensions:
66
# Builtin deref
77
- ["<& as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue", "value", "manual"]
88
- ["<&mut as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue", "value", "manual"]
9+
- ["<_ as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue.Reference", "taint", "hq-generated"]
910
# Index
1011
- ["<_ as core::ops::index::Index>::index", "Argument[self].Reference.Element", "ReturnValue.Reference", "value", "manual"]
1112
- ["<_ as core::ops::index::IndexMut>::index_mut", "Argument[self].Reference.Element", "ReturnValue.Reference", "value", "manual"]

‎rust/ql/lib/codeql/rust/frameworks/stdlib/fs.model.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ extensions:
5858
data:
5959
- ["std::fs::canonicalize", "Argument[0].OptionalStep[normalize-path]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
6060
- ["std::fs::canonicalize", "Argument[0].OptionalBarrier[normalize-path]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
61-
- ["<std::path::PathBuf as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue.Reference", "taint", "manual"]
61+
# - ["<std::path::PathBuf as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue.Reference", "taint", "manual"]
6262
- ["<std::path::PathBuf>::as_path", "Argument[self].Reference", "ReturnValue.Reference", "value", "manual"]
6363
- ["<std::path::PathBuf>::as_mut_os_string", "Argument[Self].Reference", "ReturnValue.Reference", "value", "manual"]
6464
- ["<std::path::PathBuf>::into_os_string", "Argument[Self]", "ReturnValue", "value", "manual"]

‎rust/ql/test/library-tests/dataflow/global/viableCallable.expected‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
| main.rs:2:5:2:12 | ... + ... | {EXTERNAL LOCATION} | fn add |
1+
| main.rs:2:5:2:12 | ... + ... | {EXTERNAL LOCATION} | [summarized] fn add |
22
| main.rs:13:5:13:13 | source(...) | main.rs:1:1:3:1 | fn source |
33
| main.rs:17:13:17:23 | get_data(...) | main.rs:12:1:14:1 | fn get_data |
44
| main.rs:18:5:18:11 | sink(...) | main.rs:5:1:7:1 | fn sink |
5-
| main.rs:27:9:27:12 | [implicit deref call 0 in RefMut] self | {EXTERNAL LOCATION} | fn deref |
6-
| main.rs:31:9:31:12 | [implicit deref call 0 in Ref] self | {EXTERNAL LOCATION} | fn deref |
5+
| main.rs:27:9:27:12 | [implicit deref call 0 in RefMut] self | {EXTERNAL LOCATION} | [summarized] fn deref |
6+
| main.rs:31:9:31:12 | [implicit deref call 0 in Ref] self | {EXTERNAL LOCATION} | [summarized] fn deref |
77
| main.rs:37:5:37:22 | sink(...) | main.rs:5:1:7:1 | fn sink |
88
| main.rs:37:10:37:21 | a.get_data() | main.rs:30:5:32:5 | fn get_data |
99
| main.rs:38:5:38:25 | a.set_data(...) | main.rs:26:5:28:5 | fn set_data |
@@ -62,33 +62,38 @@
6262
| main.rs:228:13:228:34 | ...::new(...) | main.rs:221:5:224:5 | fn new |
6363
| main.rs:228:24:228:33 | source(...) | main.rs:1:1:3:1 | fn source |
6464
| main.rs:230:5:230:11 | sink(...) | main.rs:5:1:7:1 | fn sink |
65-
| main.rs:244:9:244:12 | [implicit deref call 0 in RefMut] self | {EXTERNAL LOCATION} | fn deref |
66-
| main.rs:252:11:252:15 | * ... | {EXTERNAL LOCATION} | fn deref |
65+
| main.rs:244:9:244:12 | [implicit deref call 0 in RefMut] self | {EXTERNAL LOCATION} | [summarized] fn deref |
66+
| main.rs:252:11:252:15 | * ... | {EXTERNAL LOCATION} | [summarized] fn deref |
6767
| main.rs:258:28:258:36 | source(...) | main.rs:1:1:3:1 | fn source |
68+
| main.rs:260:13:260:17 | ... + ... | main.rs:236:5:239:5 | [summarized] fn add |
6869
| main.rs:260:13:260:17 | ... + ... | main.rs:236:5:239:5 | fn add |
6970
| main.rs:261:5:261:17 | sink(...) | main.rs:5:1:7:1 | fn sink |
7071
| main.rs:264:28:264:36 | source(...) | main.rs:1:1:3:1 | fn source |
72+
| main.rs:265:13:265:17 | ... + ... | main.rs:236:5:239:5 | [summarized] fn add |
7173
| main.rs:265:13:265:17 | ... + ... | main.rs:236:5:239:5 | fn add |
7274
| main.rs:266:5:266:17 | sink(...) | main.rs:5:1:7:1 | fn sink |
7375
| main.rs:268:28:268:36 | source(...) | main.rs:1:1:3:1 | fn source |
76+
| main.rs:270:13:270:20 | a.add(...) | main.rs:236:5:239:5 | [summarized] fn add |
7477
| main.rs:270:13:270:20 | a.add(...) | main.rs:236:5:239:5 | fn add |
7578
| main.rs:271:5:271:17 | sink(...) | main.rs:5:1:7:1 | fn sink |
7679
| main.rs:275:28:275:37 | source(...) | main.rs:1:1:3:1 | fn source |
80+
| main.rs:277:5:277:36 | ...::mul_assign(...) | main.rs:243:5:245:5 | [summarized] fn mul_assign |
7781
| main.rs:277:5:277:36 | ...::mul_assign(...) | main.rs:243:5:245:5 | fn mul_assign |
7882
| main.rs:278:5:278:17 | sink(...) | main.rs:5:1:7:1 | fn sink |
7983
| main.rs:281:28:281:37 | source(...) | main.rs:1:1:3:1 | fn source |
84+
| main.rs:282:5:282:10 | ... *= ... | main.rs:243:5:245:5 | [summarized] fn mul_assign |
8085
| main.rs:282:5:282:10 | ... *= ... | main.rs:243:5:245:5 | fn mul_assign |
8186
| main.rs:283:5:283:17 | sink(...) | main.rs:5:1:7:1 | fn sink |
8287
| main.rs:286:28:286:37 | source(...) | main.rs:1:1:3:1 | fn source |
83-
| main.rs:288:13:288:29 | * ... | {EXTERNAL LOCATION} | fn deref |
88+
| main.rs:288:13:288:29 | * ... | {EXTERNAL LOCATION} | [summarized] fn deref |
8489
| main.rs:288:14:288:29 | ...::deref(...) | main.rs:251:5:253:5 | fn deref |
8590
| main.rs:289:5:289:11 | sink(...) | main.rs:5:1:7:1 | fn sink |
8691
| main.rs:291:28:291:37 | source(...) | main.rs:1:1:3:1 | fn source |
8792
| main.rs:292:13:292:14 | * ... | main.rs:251:5:253:5 | fn deref |
8893
| main.rs:293:5:293:11 | sink(...) | main.rs:5:1:7:1 | fn sink |
8994
| main.rs:295:28:295:37 | source(...) | main.rs:1:1:3:1 | fn source |
9095
| main.rs:296:13:296:13 | [implicit deref call 0 in MyInt] a | main.rs:251:5:253:5 | fn deref |
91-
| main.rs:296:13:296:23 | a.min(...) | {EXTERNAL LOCATION} | fn min |
96+
| main.rs:296:13:296:23 | a.min(...) | {EXTERNAL LOCATION} | [summarized] fn min |
9297
| main.rs:297:5:297:11 | sink(...) | main.rs:5:1:7:1 | fn sink |
9398
| main.rs:319:28:319:36 | source(...) | main.rs:1:1:3:1 | fn source |
9499
| main.rs:321:30:321:54 | ...::take_self(...) | main.rs:309:5:311:5 | fn take_self |
@@ -106,14 +111,14 @@
106111
| main.rs:346:17:346:25 | source(...) | main.rs:1:1:3:1 | fn source |
107112
| main.rs:347:9:347:15 | sink(...) | main.rs:5:1:7:1 | fn sink |
108113
| main.rs:350:5:350:17 | sink(...) | main.rs:5:1:7:1 | fn sink |
109-
| main.rs:354:13:354:55 | ...::block_on(...) | {EXTERNAL LOCATION} | fn block_on |
114+
| main.rs:354:13:354:55 | ...::block_on(...) | {EXTERNAL LOCATION} | [summarized] fn block_on |
110115
| main.rs:354:41:354:54 | async_source(...) | main.rs:335:1:339:1 | fn async_source |
111116
| main.rs:355:5:355:11 | sink(...) | main.rs:5:1:7:1 | fn sink |
112-
| main.rs:357:5:357:62 | ...::block_on(...) | {EXTERNAL LOCATION} | fn block_on |
117+
| main.rs:357:5:357:62 | ...::block_on(...) | {EXTERNAL LOCATION} | [summarized] fn block_on |
113118
| main.rs:357:33:357:61 | test_async_await_async_part(...) | main.rs:341:1:351:1 | fn test_async_await_async_part |
114119
| main.rs:367:13:367:29 | self.get_number() | main.rs:378:9:380:9 | fn get_number |
115120
| main.rs:367:13:367:29 | self.get_number() | main.rs:386:9:388:9 | fn get_number |
116-
| main.rs:367:13:367:33 | ... * ... | {EXTERNAL LOCATION} | fn mul |
121+
| main.rs:367:13:367:33 | ... * ... | {EXTERNAL LOCATION} | [summarized] fn mul |
117122
| main.rs:371:13:371:21 | source(...) | main.rs:1:1:3:1 | fn source |
118123
| main.rs:379:13:379:21 | source(...) | main.rs:1:1:3:1 | fn source |
119124
| main.rs:391:13:391:22 | source(...) | main.rs:1:1:3:1 | fn source |

0 commit comments

Comments
 (0)