wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/FunctionOverloading.qll

@@ -86,7 +86,7 @@ predicate traitTypeParameterOccurrence(
   TypeParameter traitTp
 ) {
   f = trait.getAssocItem(functionName) and
-  traitTp = getAssocFunctionTypeAt(f, trait, pos, path) and
+  traitTp = getAssocFunctionTypeInclNonMethodSelfAt(f, trait, pos, path) and
   traitTp = trait.(TraitTypeAbstraction).getATypeParameter()
 }
 
@@ -141,7 +141,7 @@ pragma[nomagic]
 private Type getAssocFunctionNonTypeParameterTypeAt(
   ImplItemNode impl, Function f, FunctionPosition pos, TypePath path
 ) {
-  result = getAssocFunctionTypeAt(f, impl, pos, path) and
+  result = getAssocFunctionTypeInclNonMethodSelfAt(f, impl, pos, path) and
   not result instanceof TypeParameter
 }
 

rust/ql/lib/codeql/rust/internal/typeinference/FunctionType.qll

@@ -82,7 +82,9 @@ private newtype TAssocFunctionType =
     // through `i`. This ensures that `parent` is either a supertrait of `i` or
     // `i` in an `impl` block implementing `parent`.
     (parent = i or BaseTypes::rootTypesSatisfaction(_, TTrait(parent), i, _, _)) and
-    exists(pos.getTypeMention(f))
+    // We always include the `self` position, even for non-methods, where it is used
+    // to match type qualifiers against the `impl` or trait type, such as in `Vec::new`.
+    (exists(pos.getTypeMention(f)) or pos.isSelf())
   }
 
 bindingset[abs, constraint, tp]
@@ -116,6 +118,22 @@ Type getAssocFunctionTypeAt(Function f, ImplOrTraitItemNode i, FunctionPosition
   )
 }
 
+/**
+ * Same as `getAssocFunctionTypeAt`, but also includes types at the `self` position
+ * for non-methods.
+ */
+pragma[nomagic]
+Type getAssocFunctionTypeInclNonMethodSelfAt(
+  Function f, ImplOrTraitItemNode i, FunctionPosition pos, TypePath path
+) {
+  result = getAssocFunctionTypeAt(f, i, pos, path)
+  or
+  f = i.getASuccessor(_) and
+  not f.hasSelfParam() and
+  pos.isSelf() and
+  result = resolveImplOrTraitType(i, path)
+}
+
 /**
  * The type of an associated function at a given position, when its implicit
  * `Self` type parameter is specialized to a given trait or `impl` block.
@@ -174,7 +192,7 @@ class AssocFunctionType extends MkAssocFunctionType {
   Type getTypeAt(TypePath path) {
     exists(Function f, FunctionPosition pos, ImplOrTraitItemNode i, Type t |
       this.appliesTo(f, i, pos) and
-      t = getAssocFunctionTypeAt(f, i, pos, path)
+      t = getAssocFunctionTypeInclNonMethodSelfAt(f, i, pos, path)
     |
       not t instanceof SelfTypeParameter and
       result = t
@@ -184,9 +202,12 @@ class AssocFunctionType extends MkAssocFunctionType {
   }
 
   private TypeMention getTypeMention() {
-    exists(Function f, FunctionPosition pos |
-      this.appliesTo(f, _, pos) and
+    exists(Function f, ImplOrTraitItemNode i, FunctionPosition pos | this.appliesTo(f, i, pos) |
       result = pos.getTypeMention(f)
+      or
+      pos.isSelf() and
+      not f.hasSelfParam() and
+      result = [i.(Impl).getSelfTy().(TypeMention), i.(TypeMention)]
     )
   }
 
@@ -294,8 +315,9 @@ module ArgIsInstantiationOf<
  */
 signature module ArgsAreInstantiationsOfInputSig {
   /**
-   * Holds if `f` implements a trait function with type parameter `traitTp`, where
-   * we need to check that the type of `f` for `traitTp` is satisfied.
+   * Holds if `f` implements (or is itself) a trait function with type parameter
+   * `traitTp`, where we need to check that the type of `f` for `traitTp` is
+   * satisfied.
    *
    * `pos` is one of the positions in `f` in which the relevant type occours.
    */