Rust: cookie and biscotti crypto query sinks

[geoffw0]

While writing the insecure cookie query (WIP), I've been using the cookie and biscotti crates. I noticed they both have the capability to take encryption keys and this can be modelled.

In addition to modelling those I've added a model for alloc::vec::from_elem and cleaned up the scattered manual models for <core::convert::From>::from.

[Copilot]

Pull Request Overview

This PR adds cryptographic key modeling for the cookie and biscotti crates to detect when hard-coded cryptographic values are passed as keys. The changes include models for key creation functions and test updates to verify the new detection capabilities.

• Added sink models for cookie::Key::from and biscotti::Key::from to detect hard-coded cryptographic keys
• Consolidated the scattered manual models for <core::convert::From>::from into a single generic model
• Added a model for alloc::vec::from_elem to track element propagation

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
rust/ql/test/query-tests/security/CWE-798/test_cookie.rs	New test file demonstrating hard-coded cryptographic key usage in cookie and biscotti libraries
rust/ql/test/query-tests/security/CWE-798/options.yml	Added cookie and biscotti crate dependencies for testing
rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected	Updated test expectations with new detections for cookie/biscotti hard-coded keys
rust/ql/test/query-tests/security/CWE-022/TaintedPath.expected	Updated expectations reflecting the consolidated From model changes
rust/ql/test/library-tests/dataflow/strings/inline-taint-flow.expected	Updated expectations with new generic From model
rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml	Added generic <_ as core::convert::From>::from model
rust/ql/lib/codeql/rust/frameworks/stdlib/lang-alloc.model.yml	Added alloc::vec::from_elem model and removed specific String From model
rust/ql/lib/codeql/rust/frameworks/stdlib/fs.model.yml	Removed PathBuf From model in favor of generic one
rust/ql/lib/codeql/rust/frameworks/cookie.model.yml	New model file defining cookie key sink
rust/ql/lib/codeql/rust/frameworks/biscotti.model.yml	New model file defining biscotti key sink
rust/ql/lib/change-notes/2025-09-12-cookie.md	Added change note for the new cryptography models

[geoffw0]

DCA LGTM (small slowdown, believed to be wobble).

[paldepind]

LGTM! Great to have one single from model :)

[geoffw0]

Thanks for reviewing.

[hvitved]

I would have expected that this should be a taint model and not a value model?

[geoffw0]

I agree - here: #20529