Skip to content

Commit b490912

Browse files
hvitvedhvitved
committed
Rust: Adapt to changes in FlowSummaryImpl 
1 parent 447c044 commit b490912

File tree

7 files changed

+108
-139
lines changed

7 files changed

+108
-139
lines changed

‎rust/ql/lib/codeql/rust/dataflow/FlowSummary.qll‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,13 @@ module SummarizedCallable {
1717
Range() { any() }
1818

1919
override predicate propagatesFlow(
20-
string input, string output, boolean preservesValue, string model
20+
string input, string output, boolean preservesValue, Provenance p, boolean isExact,
21+
string model
2122
) {
22-
this.propagatesFlow(input, output, preservesValue) and model = ""
23+
this.propagatesFlow(input, output, preservesValue) and
24+
p = "manual" and
25+
isExact = true and
26+
model = ""
2327
}
2428

2529
/**

‎rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ module Input implements InputSig<Location, RustDataFlow> {
3030

3131
class SummarizedCallableBase = Function;
3232

33+
predicate callableFromSource(SummarizedCallableBase c) { c.fromSource() }
34+
3335
abstract private class SourceSinkBase extends AstNode {
3436
/** Gets the associated call. */
3537
abstract Call getCall();

‎rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll‎

Lines changed: 26 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -111,60 +111,35 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
111111
)
112112
}
113113

114-
private predicate summaryModel(
115-
Function f, string input, string output, string kind, Provenance provenance, boolean isInherited,
116-
QlBuiltins::ExtensionId madId
117-
) {
118-
exists(string path, Function f0 |
119-
summaryModel(path, input, output, kind, provenance, madId) and
120-
f0.getCanonicalPath() = path
121-
|
122-
f = f0 and
123-
isInherited = false
124-
or
125-
f.implements(f0) and
126-
isInherited = true
127-
)
128-
}
129-
130-
private predicate summaryModelRelevant(
131-
Function f, string input, string output, string kind, Provenance provenance, boolean isInherited,
132-
QlBuiltins::ExtensionId madId
133-
) {
134-
summaryModel(f, input, output, kind, provenance, isInherited, madId) and
135-
// Only apply generated or inherited models to functions in library code and
136-
// when no strictly better model exists
137-
if provenance.isGenerated() or isInherited = true
138-
then
139-
not f.fromSource() and
140-
not exists(Provenance other | summaryModel(f, _, _, _, other, false, _) |
141-
provenance.isGenerated() and other.isManual()
114+
private class SummarizedCallableFromModel extends SummarizedCallable::Range {
115+
string input_;
116+
string output_;
117+
string kind;
118+
Provenance p_;
119+
boolean isExact_;
120+
QlBuiltins::ExtensionId madId;
121+
122+
SummarizedCallableFromModel() {
123+
exists(string path, Function f |
124+
summaryModel(path, input_, output_, kind, p_, madId) and
125+
f.getCanonicalPath() = path
126+
|
127+
this = f and isExact_ = true
142128
or
143-
provenance = other and isInherited = true
129+
this.implements(f) and
130+
isExact_ = false
144131
)
145-
else any()
146-
}
147-
148-
private class SummarizedCallableFromModel extends SummarizedCallable::Range {
149-
SummarizedCallableFromModel() { summaryModelRelevant(this, _, _, _, _, _, _) }
150-
151-
override predicate hasProvenance(Provenance provenance) {
152-
summaryModelRelevant(this, _, _, _, provenance, _, _)
153132
}
154133

155134
override predicate propagatesFlow(
156-
string input, string output, boolean preservesValue, string model
135+
string input, string output, boolean preservesValue, Provenance p, boolean isExact, string model
157136
) {
158-
exists(string kind, QlBuiltins::ExtensionId madId |
159-
summaryModelRelevant(this, input, output, kind, _, _, madId) and
160-
model = "MaD:" + madId.toString()
161-
|
162-
kind = "value" and
163-
preservesValue = true
164-
or
165-
kind = "taint" and
166-
preservesValue = false
167-
)
137+
input = input_ and
138+
output = output_ and
139+
(if kind = "value" then preservesValue = true else preservesValue = false) and
140+
p = p_ and
141+
isExact = isExact_ and
142+
model = "MaD:" + madId.toString()
168143
}
169144
}
170145

@@ -211,7 +186,7 @@ private module Debug {
211186
private predicate relevantManualModel(SummarizedCallableImpl sc, string can) {
212187
exists(Provenance manual |
213188
can = sc.getCanonicalPath() and
214-
summaryModelRelevant(sc, _, _, _, manual, false, _) and
189+
sc.(SummarizedCallableFromModel).propagatesFlow(_, _, _, manual, true, _) and
215190
manual.isManual()
216191
)
217192
}
@@ -221,7 +196,7 @@ private module Debug {
221196
) {
222197
exists(RustDataFlow::ParameterPosition pos, TypeMention tm |
223198
relevantManualModel(sc, can) and
224-
sc.propagatesFlow(input, _, _, _) and
199+
sc.propagatesFlow(input, _, _, _, _, _) and
225200
input.head() = SummaryComponent::argument(pos) and
226201
p = pos.getParameterIn(sc.getParamList()) and
227202
tm.resolveType() instanceof RefType and
@@ -238,7 +213,7 @@ private module Debug {
238213
) {
239214
exists(TypeMention tm |
240215
relevantManualModel(sc, can) and
241-
sc.propagatesFlow(_, output, _, _) and
216+
sc.propagatesFlow(_, output, _, _, _, _) and
242217
tm.resolveType() instanceof RefType and
243218
output.head() = SummaryComponent::return(_) and
244219
not output.tail().head() =

‎rust/ql/test/library-tests/dataflow/local/inline-flow.expected‎

Lines changed: 23 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,16 @@ models
66
| 5 | Summary: <_ as core::ops::index::Index>::index; Argument[self].Reference.Element; ReturnValue.Reference; value |
77
| 6 | Summary: <alloc::boxed::Box as core::ops::deref::Deref>::deref; Argument[self].Reference.Field[alloc::boxed::Box(0)]; ReturnValue.Reference; value |
88
| 7 | Summary: <alloc::boxed::Box>::new; Argument[0]; ReturnValue.Field[alloc::boxed::Box(0)]; value |
9-
| 8 | Summary: <alloc::string::String as core::ops::deref::Deref>::deref; Argument[self]; ReturnValue; value |
10-
| 9 | Summary: <core::i64 as core::convert::From>::from; Argument[0]; ReturnValue; taint |
11-
| 10 | Summary: <core::option::Option>::unwrap; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
12-
| 11 | Summary: <core::option::Option>::unwrap_or; Argument[0]; ReturnValue; value |
13-
| 12 | Summary: <core::option::Option>::unwrap_or; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
14-
| 13 | Summary: <core::option::Option>::unwrap_or_else; Argument[0].ReturnValue; ReturnValue; value |
15-
| 14 | Summary: <core::option::Option>::unwrap_or_else; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
16-
| 15 | Summary: <core::result::Result>::err; Argument[self].Field[core::result::Result::Err(0)]; ReturnValue.Field[core::option::Option::Some(0)]; value |
17-
| 16 | Summary: <core::result::Result>::expect; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
18-
| 17 | Summary: <core::result::Result>::expect_err; Argument[self].Field[core::result::Result::Err(0)]; ReturnValue; value |
19-
| 18 | Summary: <core::result::Result>::ok; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue.Field[core::option::Option::Some(0)]; value |
20-
| 19 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
9+
| 8 | Summary: <core::option::Option>::unwrap; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
10+
| 9 | Summary: <core::option::Option>::unwrap_or; Argument[0]; ReturnValue; value |
11+
| 10 | Summary: <core::option::Option>::unwrap_or; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
12+
| 11 | Summary: <core::option::Option>::unwrap_or_else; Argument[0].ReturnValue; ReturnValue; value |
13+
| 12 | Summary: <core::option::Option>::unwrap_or_else; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
14+
| 13 | Summary: <core::result::Result>::err; Argument[self].Field[core::result::Result::Err(0)]; ReturnValue.Field[core::option::Option::Some(0)]; value |
15+
| 14 | Summary: <core::result::Result>::expect; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
16+
| 15 | Summary: <core::result::Result>::expect_err; Argument[self].Field[core::result::Result::Err(0)]; ReturnValue; value |
17+
| 16 | Summary: <core::result::Result>::ok; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue.Field[core::option::Option::Some(0)]; value |
18+
| 17 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
2119
edges
2220
| main.rs:23:9:23:9 | s | main.rs:24:10:24:10 | s | provenance | |
2321
| main.rs:23:9:23:9 | s | main.rs:26:12:26:12 | x | provenance | |
@@ -129,17 +127,17 @@ edges
129127
| main.rs:278:9:278:10 | s1 [Some] | main.rs:279:10:279:11 | s1 [Some] | provenance | |
130128
| main.rs:278:14:278:29 | Some(...) [Some] | main.rs:278:9:278:10 | s1 [Some] | provenance | |
131129
| main.rs:278:19:278:28 | source(...) | main.rs:278:14:278:29 | Some(...) [Some] | provenance | |
132-
| main.rs:279:10:279:11 | s1 [Some] | main.rs:279:10:279:20 | s1.unwrap() | provenance | MaD:10 |
130+
| main.rs:279:10:279:11 | s1 [Some] | main.rs:279:10:279:20 | s1.unwrap() | provenance | MaD:8 |
133131
| main.rs:283:9:283:10 | s1 [Some] | main.rs:284:10:284:11 | s1 [Some] | provenance | |
134132
| main.rs:283:14:283:29 | Some(...) [Some] | main.rs:283:9:283:10 | s1 [Some] | provenance | |
135133
| main.rs:283:19:283:28 | source(...) | main.rs:283:14:283:29 | Some(...) [Some] | provenance | |
136-
| main.rs:284:10:284:11 | s1 [Some] | main.rs:284:10:284:24 | s1.unwrap_or(...) | provenance | MaD:12 |
137-
| main.rs:287:23:287:32 | source(...) | main.rs:287:10:287:33 | s2.unwrap_or(...) | provenance | MaD:11 |
134+
| main.rs:284:10:284:11 | s1 [Some] | main.rs:284:10:284:24 | s1.unwrap_or(...) | provenance | MaD:10 |
135+
| main.rs:287:23:287:32 | source(...) | main.rs:287:10:287:33 | s2.unwrap_or(...) | provenance | MaD:9 |
138136
| main.rs:291:9:291:10 | s1 [Some] | main.rs:292:10:292:11 | s1 [Some] | provenance | |
139137
| main.rs:291:14:291:29 | Some(...) [Some] | main.rs:291:9:291:10 | s1 [Some] | provenance | |
140138
| main.rs:291:19:291:28 | source(...) | main.rs:291:14:291:29 | Some(...) [Some] | provenance | |
141-
| main.rs:292:10:292:11 | s1 [Some] | main.rs:292:10:292:32 | s1.unwrap_or_else(...) | provenance | MaD:14 |
142-
| main.rs:295:31:295:40 | source(...) | main.rs:295:10:295:41 | s2.unwrap_or_else(...) | provenance | MaD:13 |
139+
| main.rs:292:10:292:11 | s1 [Some] | main.rs:292:10:292:32 | s1.unwrap_or_else(...) | provenance | MaD:12 |
140+
| main.rs:295:31:295:40 | source(...) | main.rs:295:10:295:41 | s2.unwrap_or_else(...) | provenance | MaD:11 |
143141
| main.rs:299:9:299:10 | s1 [Some] | main.rs:301:14:301:15 | s1 [Some] | provenance | |
144142
| main.rs:299:14:299:29 | Some(...) [Some] | main.rs:299:9:299:10 | s1 [Some] | provenance | |
145143
| main.rs:299:19:299:28 | source(...) | main.rs:299:14:299:29 | Some(...) [Some] | provenance | |
@@ -150,16 +148,16 @@ edges
150148
| main.rs:308:32:308:45 | Ok(...) [Ok] | main.rs:308:9:308:10 | r1 [Ok] | provenance | |
151149
| main.rs:308:35:308:44 | source(...) | main.rs:308:32:308:45 | Ok(...) [Ok] | provenance | |
152150
| main.rs:309:9:309:11 | o1a [Some] | main.rs:311:10:311:12 | o1a [Some] | provenance | |
153-
| main.rs:309:28:309:29 | r1 [Ok] | main.rs:309:28:309:34 | r1.ok() [Some] | provenance | MaD:18 |
151+
| main.rs:309:28:309:29 | r1 [Ok] | main.rs:309:28:309:34 | r1.ok() [Some] | provenance | MaD:16 |
154152
| main.rs:309:28:309:34 | r1.ok() [Some] | main.rs:309:9:309:11 | o1a [Some] | provenance | |
155-
| main.rs:311:10:311:12 | o1a [Some] | main.rs:311:10:311:21 | o1a.unwrap() | provenance | MaD:10 |
153+
| main.rs:311:10:311:12 | o1a [Some] | main.rs:311:10:311:21 | o1a.unwrap() | provenance | MaD:8 |
156154
| main.rs:314:9:314:10 | r2 [Err] | main.rs:316:28:316:29 | r2 [Err] | provenance | |
157155
| main.rs:314:32:314:46 | Err(...) [Err] | main.rs:314:9:314:10 | r2 [Err] | provenance | |
158156
| main.rs:314:36:314:45 | source(...) | main.rs:314:32:314:46 | Err(...) [Err] | provenance | |
159157
| main.rs:316:9:316:11 | o2b [Some] | main.rs:318:10:318:12 | o2b [Some] | provenance | |
160-
| main.rs:316:28:316:29 | r2 [Err] | main.rs:316:28:316:35 | r2.err() [Some] | provenance | MaD:15 |
158+
| main.rs:316:28:316:29 | r2 [Err] | main.rs:316:28:316:35 | r2.err() [Some] | provenance | MaD:13 |
161159
| main.rs:316:28:316:35 | r2.err() [Some] | main.rs:316:9:316:11 | o2b [Some] | provenance | |
162-
| main.rs:318:10:318:12 | o2b [Some] | main.rs:318:10:318:21 | o2b.unwrap() | provenance | MaD:10 |
160+
| main.rs:318:10:318:12 | o2b [Some] | main.rs:318:10:318:21 | o2b.unwrap() | provenance | MaD:8 |
163161
| main.rs:322:9:322:10 | s1 [Ok] | main.rs:325:14:325:15 | s1 [Ok] | provenance | |
164162
| main.rs:322:32:322:45 | Ok(...) [Ok] | main.rs:322:9:322:10 | s1 [Ok] | provenance | |
165163
| main.rs:322:35:322:44 | source(...) | main.rs:322:32:322:45 | Ok(...) [Ok] | provenance | |
@@ -169,11 +167,11 @@ edges
169167
| main.rs:335:9:335:10 | s1 [Ok] | main.rs:336:10:336:11 | s1 [Ok] | provenance | |
170168
| main.rs:335:32:335:45 | Ok(...) [Ok] | main.rs:335:9:335:10 | s1 [Ok] | provenance | |
171169
| main.rs:335:35:335:44 | source(...) | main.rs:335:32:335:45 | Ok(...) [Ok] | provenance | |
172-
| main.rs:336:10:336:11 | s1 [Ok] | main.rs:336:10:336:22 | s1.expect(...) | provenance | MaD:16 |
170+
| main.rs:336:10:336:11 | s1 [Ok] | main.rs:336:10:336:22 | s1.expect(...) | provenance | MaD:14 |
173171
| main.rs:339:9:339:10 | s2 [Err] | main.rs:341:10:341:11 | s2 [Err] | provenance | |
174172
| main.rs:339:32:339:46 | Err(...) [Err] | main.rs:339:9:339:10 | s2 [Err] | provenance | |
175173
| main.rs:339:36:339:45 | source(...) | main.rs:339:32:339:46 | Err(...) [Err] | provenance | |
176-
| main.rs:341:10:341:11 | s2 [Err] | main.rs:341:10:341:26 | s2.expect_err(...) | provenance | MaD:17 |
174+
| main.rs:341:10:341:11 | s2 [Err] | main.rs:341:10:341:26 | s2.expect_err(...) | provenance | MaD:15 |
177175
| main.rs:350:9:350:10 | s1 [A] | main.rs:352:11:352:12 | s1 [A] | provenance | |
178176
| main.rs:350:14:350:39 | ...::A(...) [A] | main.rs:350:9:350:10 | s1 [A] | provenance | |
179177
| main.rs:350:29:350:38 | source(...) | main.rs:350:14:350:39 | ...::A(...) [A] | provenance | |
@@ -264,13 +262,11 @@ edges
264262
| main.rs:506:13:506:25 | a.to_string() | main.rs:506:9:506:9 | b | provenance | |
265263
| main.rs:507:9:507:9 | c | main.rs:512:10:512:10 | c | provenance | |
266264
| main.rs:507:13:507:13 | b | main.rs:507:13:507:28 | b.parse() [Ok] | provenance | MaD:4 |
267-
| main.rs:507:13:507:13 | b | main.rs:507:13:507:28 | b.parse() [Ok] | provenance | MaD:8 |
268-
| main.rs:507:13:507:28 | b.parse() [Ok] | main.rs:507:13:507:37 | ... .unwrap() | provenance | MaD:19 |
265+
| main.rs:507:13:507:28 | b.parse() [Ok] | main.rs:507:13:507:37 | ... .unwrap() | provenance | MaD:17 |
269266
| main.rs:507:13:507:37 | ... .unwrap() | main.rs:507:9:507:9 | c | provenance | |
270267
| main.rs:508:9:508:9 | d | main.rs:513:10:513:10 | d | provenance | |
271268
| main.rs:508:18:508:18 | b | main.rs:508:18:508:26 | b.parse() [Ok] | provenance | MaD:4 |
272-
| main.rs:508:18:508:18 | b | main.rs:508:18:508:26 | b.parse() [Ok] | provenance | MaD:8 |
273-
| main.rs:508:18:508:26 | b.parse() [Ok] | main.rs:508:18:508:35 | ... .unwrap() | provenance | MaD:19 |
269+
| main.rs:508:18:508:26 | b.parse() [Ok] | main.rs:508:18:508:35 | ... .unwrap() | provenance | MaD:17 |
274270
| main.rs:508:18:508:35 | ... .unwrap() | main.rs:508:9:508:9 | d | provenance | |
275271
| main.rs:517:9:517:10 | vs [element] | main.rs:519:10:519:11 | vs [element] | provenance | |
276272
| main.rs:517:9:517:10 | vs [element] | main.rs:523:14:523:15 | vs [element] | provenance | |
@@ -301,7 +297,6 @@ edges
301297
| main.rs:572:9:572:9 | b | main.rs:576:20:576:20 | b | provenance | |
302298
| main.rs:572:18:572:27 | source(...) | main.rs:572:9:572:9 | b | provenance | |
303299
| main.rs:576:20:576:20 | b | main.rs:576:10:576:21 | ...::from(...) | provenance | MaD:3 |
304-
| main.rs:576:20:576:20 | b | main.rs:576:10:576:21 | ...::from(...) | provenance | MaD:9 |
305300
nodes
306301
| main.rs:19:10:19:18 | source(...) | semmle.label | source(...) |
307302
| main.rs:23:9:23:9 | s | semmle.label | s |

0 commit comments

Comments
 (0)