Skip to content

Commit ea09efb

Browse files
hvitvedhvitved
committed
Rust: Model Deref trait in type inference
1 parent 8be1439 commit ea09efb

File tree

15 files changed

+390
-186
lines changed

15 files changed

+390
-186
lines changed

‎rust/ql/lib/codeql/rust/internal/TypeInference.qll‎

Lines changed: 107 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1550,24 +1550,13 @@ private module MethodResolution {
15501550
* Same as `getACandidateReceiverTypeAt`, but without borrows.
15511551
*/
15521552
pragma[nomagic]
1553-
private Type getACandidateReceiverTypeAtNoBorrow(string derefChain, TypePath path) {
1553+
Type getACandidateReceiverTypeAtNoBorrow(string derefChain, TypePath path) {
15541554
result = this.getReceiverTypeAt(path) and
15551555
derefChain = ""
15561556
or
1557-
this.supportsAutoDerefAndBorrow() and
1558-
exists(TypePath path0, Type t0, string derefChain0 |
1559-
this.hasNoCompatibleTargetMutBorrow(derefChain0) and
1560-
t0 = this.getACandidateReceiverTypeAtNoBorrow(derefChain0, path0)
1561-
|
1562-
path0.isCons(getRefTypeParameter(), path) and
1563-
result = t0 and
1564-
derefChain = derefChain0 + ".ref"
1565-
or
1566-
path0.isEmpty() and
1567-
path = path0 and
1568-
t0 = getStringStruct() and
1569-
result = getStrStruct() and
1570-
derefChain = derefChain0 + ".str"
1557+
exists(ImplicitDeref::DerefImplItemNode impl, string derefChain0 |
1558+
result = ImplicitDeref::getDereferencedCandidateReceiverType(this, impl, derefChain0, path) and
1559+
derefChain = derefChain0 + "." + impl.getId()
15711560
)
15721561
}
15731562

@@ -1895,8 +1884,11 @@ private module MethodResolution {
18951884
}
18961885

18971886
predicate receiverHasImplicitDeref(AstNode receiver) {
1898-
exists(this.resolveCallTarget(_, ".ref", TNoBorrowKind())) and
1899-
receiver = this.getArg(any(ArgumentPosition pos | pos.isSelf()))
1887+
exists(ImplicitDeref::DerefImplItemNode impl |
1888+
impl.isRefImpl() and
1889+
exists(this.resolveCallTarget(_, "." + impl.getId(), TNoBorrowKind())) and
1890+
receiver = this.getArg(any(ArgumentPosition pos | pos.isSelf()))
1891+
)
19001892
}
19011893

19021894
predicate argumentHasImplicitBorrow(AstNode arg, BorrowKind borrow) {
@@ -2165,6 +2157,98 @@ private module MethodResolution {
21652157
Location getLocation() { result = mc_.getLocation() }
21662158
}
21672159

2160+
module ImplicitDeref {
2161+
private import codeql.rust.elements.internal.generated.Raw
2162+
private import codeql.rust.elements.internal.generated.Synth
2163+
2164+
/** An `impl` block that implements the `Deref` trait. */
2165+
class DerefImplItemNode extends ImplItemNode {
2166+
DerefImplItemNode() { this.resolveTraitTy() instanceof DerefTrait }
2167+
2168+
/**
2169+
* Holds if this `impl` block is the special `Deref` implementation for
2170+
* `&T` or `&mut T`:
2171+
*
2172+
* ```rust
2173+
* impl<T: ?Sized> const Deref for &T
2174+
* ```
2175+
*
2176+
* or
2177+
*
2178+
* ```rust
2179+
* impl<T: ?Sized> const Deref for &mut T
2180+
* ```
2181+
*/
2182+
predicate isRefImpl() { this.resolveSelfTyBuiltin() instanceof Builtins::RefType }
2183+
2184+
/** Gets an internal unique ID used to identify this block amongst all `Deref` impl blocks. */
2185+
int getId() { idOfRaw(Synth::convertAstNodeToRaw(this), result) }
2186+
}
2187+
2188+
private class DerefImplItemRaw extends Raw::Impl {
2189+
DerefImplItemRaw() { this = Synth::convertAstNodeToRaw(any(DerefImplItemNode i)) }
2190+
}
2191+
2192+
private predicate id(DerefImplItemRaw x, DerefImplItemRaw y) { x = y }
2193+
2194+
private predicate idOfRaw(DerefImplItemRaw x, int y) = equivalenceRelation(id/2)(x, y)
2195+
2196+
private newtype TMethodCallDerefCand =
2197+
MkMethodCallDerefCand(MethodCall mc, string derefChain) {
2198+
mc.supportsAutoDerefAndBorrow() and
2199+
mc.hasNoCompatibleTargetMutBorrow(derefChain) and
2200+
exists(mc.getACandidateReceiverTypeAtNoBorrow(derefChain, _))
2201+
}
2202+
2203+
private class MethodCallDerefCand extends MkMethodCallDerefCand {
2204+
MethodCall mc_;
2205+
string derefChain;
2206+
2207+
MethodCallDerefCand() { this = MkMethodCallDerefCand(mc_, derefChain) }
2208+
2209+
MethodCall getMethodCall() { result = mc_ }
2210+
2211+
Type getTypeAt(TypePath path) {
2212+
result = substituteLookupTraits(mc_.getACandidateReceiverTypeAtNoBorrow(derefChain, path)) and
2213+
not result = TNeverType() and
2214+
not result = TUnknownType()
2215+
}
2216+
2217+
string toString() { result = mc_.toString() + " [" + derefChain + "]" }
2218+
2219+
Location getLocation() { result = mc_.getLocation() }
2220+
}
2221+
2222+
private module MethodCallSatisfiesConstraintInput implements
2223+
SatisfiesConstraintInputSig<MethodCallDerefCand>
2224+
{
2225+
pragma[nomagic]
2226+
predicate relevantConstraint(MethodCallDerefCand mc, Type constraint) {
2227+
exists(mc) and
2228+
constraint.(TraitType).getTrait() instanceof DerefTrait
2229+
}
2230+
2231+
predicate useUniversalConditions() { none() }
2232+
}
2233+
2234+
pragma[nomagic]
2235+
private AssociatedTypeTypeParameter getDerefTargetTypeParameter() {
2236+
result.getTypeAlias() = any(DerefTrait ft).getTargetType()
2237+
}
2238+
2239+
pragma[nomagic]
2240+
Type getDereferencedCandidateReceiverType(
2241+
MethodCall mc, DerefImplItemNode impl, string derefChain, TypePath path
2242+
) {
2243+
exists(MethodCallDerefCand mcc, TypePath exprPath |
2244+
mcc = MkMethodCallDerefCand(mc, derefChain) and
2245+
SatisfiesConstraint<MethodCallDerefCand, MethodCallSatisfiesConstraintInput>::satisfiesConstraintType(mcc,
2246+
impl, _, exprPath, result) and
2247+
exprPath.isCons(getDerefTargetTypeParameter(), path)
2248+
)
2249+
}
2250+
}
2251+
21682252
private module ReceiverSatisfiesBlanketLikeConstraintInput implements
21692253
BlanketImplementation::SatisfiesBlanketConstraintInputSig<MethodCallCand>
21702254
{
@@ -2522,9 +2606,12 @@ private Type inferMethodCallType1(AstNode n, boolean isReturn, TypePath path) {
25222606
path = path0
25232607
or
25242608
// adjust for implicit deref
2525-
apos.isSelf() and
2526-
derefChainBorrow = ".ref;" and
2527-
path = TypePath::cons(getRefTypeParameter(), path0)
2609+
exists(MethodResolution::ImplicitDeref::DerefImplItemNode impl |
2610+
impl.isRefImpl() and
2611+
apos.isSelf() and
2612+
derefChainBorrow = "." + impl.getId() + ";" and
2613+
path = TypePath::cons(getRefTypeParameter(), path0)
2614+
)
25282615
or
25292616
// adjust for implicit borrow
25302617
apos.isSelf() and
@@ -3372,9 +3459,6 @@ private Type inferTryExprType(TryExpr te, TypePath path) {
33723459
pragma[nomagic]
33733460
private StructType getStrStruct() { result = TStruct(any(Builtins::Str s)) }
33743461

3375-
pragma[nomagic]
3376-
private StructType getStringStruct() { result = TStruct(any(StringStruct s)) }
3377-
33783462
pragma[nomagic]
33793463
private Type inferLiteralType(LiteralExpr le, TypePath path, boolean certain) {
33803464
path.isEmpty() and

‎rust/ql/test/library-tests/dataflow/global/viableCallable.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@
8484
| main.rs:292:13:292:14 | * ... | main.rs:251:5:253:5 | fn deref |
8585
| main.rs:293:5:293:11 | sink(...) | main.rs:5:1:7:1 | fn sink |
8686
| main.rs:295:28:295:37 | source(...) | main.rs:1:1:3:1 | fn source |
87+
| main.rs:296:13:296:23 | a.min(...) | {EXTERNAL LOCATION} | fn min |
8788
| main.rs:297:5:297:11 | sink(...) | main.rs:5:1:7:1 | fn sink |
8889
| main.rs:319:28:319:36 | source(...) | main.rs:1:1:3:1 | fn source |
8990
| main.rs:321:30:321:54 | ...::take_self(...) | main.rs:309:5:311:5 | fn take_self |

‎rust/ql/test/library-tests/dataflow/sources/file/InlineFlow.expected‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ models
3535
| 34 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_to_string; Argument[self].Reference; Argument[0].Reference; taint |
3636
| 35 | Summary: <_ as tokio::io::util::async_read_ext::AsyncReadExt>::read_u8; Argument[self].Reference; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
3737
| 36 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
38-
| 37 | Summary: <std::path::PathBuf>::as_path; Argument[self].Reference; ReturnValue.Reference; value |
38+
| 37 | Summary: <std::path::Path>::canonicalize; Argument[self].Reference.OptionalBarrier[normalize-path]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
39+
| 38 | Summary: <std::path::PathBuf>::as_path; Argument[self].Reference; ReturnValue.Reference; value |
3940
edges
4041
| test.rs:12:13:12:18 | buffer | test.rs:13:14:13:19 | buffer | provenance | |
4142
| test.rs:12:31:12:43 | ...::read | test.rs:12:31:12:55 | ...::read(...) [Ok] | provenance | Src:MaD:11 |
@@ -51,12 +52,15 @@ edges
5152
| test.rs:22:22:22:52 | TryExpr | test.rs:22:13:22:18 | buffer | provenance | |
5253
| test.rs:29:13:29:16 | path | test.rs:30:14:30:17 | path | provenance | |
5354
| test.rs:29:13:29:16 | path | test.rs:31:14:31:17 | path | provenance | |
55+
| test.rs:29:13:29:16 | path | test.rs:40:14:40:17 | path | provenance | |
5456
| test.rs:29:13:29:16 | path | test.rs:41:14:41:17 | path | provenance | |
5557
| test.rs:29:20:29:27 | e.path() | test.rs:29:13:29:16 | path | provenance | |
5658
| test.rs:29:22:29:25 | path | test.rs:29:20:29:27 | e.path() | provenance | Src:MaD:4 MaD:4 |
5759
| test.rs:30:14:30:17 | path | test.rs:30:14:30:25 | path.clone() | provenance | MaD:18 |
5860
| test.rs:31:14:31:17 | path | test.rs:31:14:31:25 | path.clone() | provenance | MaD:18 |
59-
| test.rs:31:14:31:25 | path.clone() | test.rs:31:14:31:35 | ... .as_path() | provenance | MaD:37 |
61+
| test.rs:31:14:31:25 | path.clone() | test.rs:31:14:31:35 | ... .as_path() | provenance | MaD:38 |
62+
| test.rs:40:14:40:17 | path | test.rs:40:14:40:32 | path.canonicalize() [Ok] | provenance | MaD:37 |
63+
| test.rs:40:14:40:32 | path.canonicalize() [Ok] | test.rs:40:14:40:41 | ... .unwrap() | provenance | MaD:36 |
6064
| test.rs:43:13:43:21 | file_name | test.rs:44:14:44:22 | file_name | provenance | |
6165
| test.rs:43:13:43:21 | file_name | test.rs:49:14:49:22 | file_name | provenance | |
6266
| test.rs:43:25:43:37 | e.file_name() | test.rs:43:13:43:21 | file_name | provenance | |
@@ -273,6 +277,9 @@ nodes
273277
| test.rs:31:14:31:17 | path | semmle.label | path |
274278
| test.rs:31:14:31:25 | path.clone() | semmle.label | path.clone() |
275279
| test.rs:31:14:31:35 | ... .as_path() | semmle.label | ... .as_path() |
280+
| test.rs:40:14:40:17 | path | semmle.label | path |
281+
| test.rs:40:14:40:32 | path.canonicalize() [Ok] | semmle.label | path.canonicalize() [Ok] |
282+
| test.rs:40:14:40:41 | ... .unwrap() | semmle.label | ... .unwrap() |
276283
| test.rs:41:14:41:17 | path | semmle.label | path |
277284
| test.rs:43:13:43:21 | file_name | semmle.label | file_name |
278285
| test.rs:43:25:43:37 | e.file_name() | semmle.label | e.file_name() |
@@ -492,6 +499,7 @@ testFailures
492499
| test.rs:23:14:23:19 | buffer | test.rs:22:22:22:39 | ...::read_to_string | test.rs:23:14:23:19 | buffer | $@ | test.rs:22:22:22:39 | ...::read_to_string | ...::read_to_string |
493500
| test.rs:30:14:30:25 | path.clone() | test.rs:29:22:29:25 | path | test.rs:30:14:30:25 | path.clone() | $@ | test.rs:29:22:29:25 | path | path |
494501
| test.rs:31:14:31:35 | ... .as_path() | test.rs:29:22:29:25 | path | test.rs:31:14:31:35 | ... .as_path() | $@ | test.rs:29:22:29:25 | path | path |
502+
| test.rs:40:14:40:41 | ... .unwrap() | test.rs:29:22:29:25 | path | test.rs:40:14:40:41 | ... .unwrap() | $@ | test.rs:29:22:29:25 | path | path |
495503
| test.rs:41:14:41:17 | path | test.rs:29:22:29:25 | path | test.rs:41:14:41:17 | path | $@ | test.rs:29:22:29:25 | path | path |
496504
| test.rs:44:14:44:30 | file_name.clone() | test.rs:43:27:43:35 | file_name | test.rs:44:14:44:30 | file_name.clone() | $@ | test.rs:43:27:43:35 | file_name | file_name |
497505
| test.rs:49:14:49:22 | file_name | test.rs:43:27:43:35 | file_name | test.rs:49:14:49:22 | file_name | $@ | test.rs:43:27:43:35 | file_name | file_name |

‎rust/ql/test/library-tests/dataflow/sources/file/TaintSources.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77
| test.rs:51:52:51:59 | read_dir | Flow source 'FileSource' of type file (DEFAULT). |
88
| test.rs:54:22:54:25 | path | Flow source 'FileSource' of type file (DEFAULT). |
99
| test.rs:55:27:55:35 | file_name | Flow source 'FileSource' of type file (DEFAULT). |
10+
| test.rs:57:56:57:63 | read_dir | Flow source 'FileSource' of type file (DEFAULT). |
11+
| test.rs:60:22:60:25 | path | Flow source 'FileSource' of type file (DEFAULT). |
12+
| test.rs:61:27:61:35 | file_name | Flow source 'FileSource' of type file (DEFAULT). |
1013
| test.rs:65:22:65:34 | ...::read_link | Flow source 'FileSource' of type file (DEFAULT). |
1114
| test.rs:74:31:74:45 | ...::read | Flow source 'FileSource' of type file (DEFAULT). |
1215
| test.rs:79:31:79:45 | ...::read | Flow source 'FileSource' of type file (DEFAULT). |

‎rust/ql/test/library-tests/dataflow/sources/file/test.rs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ fn test_fs() -> Result<(), Box<dyn std::error::Error>> {
3737
sink(path.to_path_buf()); // $ MISSING: hasTaintFlow
3838
sink(path.file_name().unwrap()); // $ MISSING: hasTaintFlow
3939
sink(path.extension().unwrap()); // $ MISSING: hasTaintFlow
40-
sink(path.canonicalize().unwrap()); // $ MISSING: hasTaintFlow
40+
sink(path.canonicalize().unwrap()); // $ hasTaintFlow
4141
sink(path); // $ hasTaintFlow
4242

4343
let file_name = e.file_name(); // $ Alert[rust/summary/taint-sources]
@@ -54,11 +54,11 @@ fn test_fs() -> Result<(), Box<dyn std::error::Error>> {
5454
let path = e.path(); // $ Alert[rust/summary/taint-sources]
5555
let file_name = e.file_name(); // $ Alert[rust/summary/taint-sources]
5656
}
57-
for entry in std::path::PathBuf::from("directory").read_dir()? {
57+
for entry in std::path::PathBuf::from("directory").read_dir()? { // $ Alert[rust/summary/taint-sources]
5858
let e = entry?;
5959

60-
let path = e.path(); // $ MISSING: Alert[rust/summary/taint-sources]
61-
let file_name = e.file_name(); // $ MISSING: Alert[rust/summary/taint-sources]
60+
let path = e.path(); // $ Alert[rust/summary/taint-sources]
61+
let file_name = e.file_name(); // $ Alert[rust/summary/taint-sources]
6262
}
6363

6464
{

0 commit comments

Comments
 (0)