Rust: Adapt to FlowSummaryImpl changes

Author: hvitved

rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll

@@ -448,6 +448,8 @@ module RustDataFlowGen<RustDataFlowInputSig Input> implements InputSig<Location>
       or
       result = ps.getSelfParam() and this.isSelf()
     }
+
+    ParamBase getParameter(Callable c) { result = this.getParameterIn(c.getParamList()) }
   }
 
   /**
@@ -510,10 +512,6 @@ module RustDataFlowGen<RustDataFlowInputSig Input> implements InputSig<Location>
       node.asExpr() = stripParens(match.getScrutinee()) or
       node.asPat() = match.getAnArm().getPat()
     )
-    or
-    FlowSummaryImpl::Private::Steps::sourceLocalStep(_, node, _)
-    or
-    FlowSummaryImpl::Private::Steps::sinkLocalStep(node, _, _)
   }
 
   class DataFlowExpr = Expr;
@@ -1289,10 +1287,10 @@ private module Cached {
       FlowSummaryImpl::Public::AcceptingValue acceptingValue, string kind, string model
     |
       FlowSummaryImpl::Private::barrierGuardSpec(b, stack, acceptingValue, kind, model) and
-      e = FlowSummaryImpl::StepsInput::getSinkNode(b, stack.headOfSingleton()).asExpr() and
+      e = FlowSummaryImpl::Input2::getSinkExitElement(b, stack.headOfSingleton()) and
       kmp = TMkPair(kind, model) and
       gv = convertAcceptingValue(acceptingValue) and
-      g = b.getCall()
+      g.(Call).getResolvedTarget() = b
     )
   }
 
@@ -1303,15 +1301,8 @@ private module Cached {
       FlowSummaryImpl::Public::BarrierElement b,
       FlowSummaryImpl::Private::SummaryComponentStack stack
     |
-      FlowSummaryImpl::Private::barrierSpec(b, stack, kind, model)
-    |
-      n = FlowSummaryImpl::StepsInput::getSourceNode(b, stack, false)
-      or
-      // For barriers like `Argument[0]` we want to target the pre-update node
-      n =
-        FlowSummaryImpl::StepsInput::getSourceNode(b, stack, true)
-            .(PostUpdateNode)
-            .getPreUpdateNode()
+      FlowSummaryImpl::Private::barrierSpec(b, stack, kind, model) and
+      exists(FlowSummaryImpl::Input2::getSourceEntryElement(b, stack, _, n.asExpr()))
     )
     or
     ParameterizedBarrierGuard<TKindModelPair, barrierGuardChecks/4>::getABarrierNode(TMkPair(kind,

rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll

@@ -29,27 +29,22 @@ predicate encodeContentStructField(StructFieldContent c, string arg) {
 
 module Input implements InputSig<Location, RustDataFlow> {
   private import codeql.rust.frameworks.stdlib.Stdlib
-  private import codeql.util.Void
 
   class SummarizedCallableBase = Function;
 
-  class FlowSummaryCallBase = Void;
+  class FlowSummaryCallBase extends AstNode {
+    FlowSummaryCallBase() { none() }
+  }
 
   predicate callableFromSource(SummarizedCallableBase c) { c.fromSource() }
 
-  abstract private class SourceSinkBase extends AstNode {
-    /** Gets the associated call. */
-    abstract Call getCall();
-
-    /** Holds if the associated call resolves to `path`. */
-    final predicate callResolvesTo(string path) {
-      path = this.getCall().getResolvedTarget().getCanonicalPath()
-    }
+  DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {
+    result.asSummarizedCallable() = c
   }
 
-  abstract class SourceBase extends SourceSinkBase { }
+  class SourceBase = Function;
 
-  abstract class SinkBase extends SourceSinkBase { }
+  class SinkBase = Function;
 
   predicate neutralElement(
     Input::SummarizedCallableBase c, string kind, string provenance, boolean isExact
@@ -61,22 +56,6 @@ module Input implements InputSig<Location, RustDataFlow> {
     )
   }
 
-  private class CallExprFunction extends SourceBase, SinkBase {
-    private CallExpr call;
-
-    CallExprFunction() { this = call.getFunction() }
-
-    override Call getCall() { result = call }
-  }
-
-  private class MethodCallExprNameRef extends SourceBase, SinkBase {
-    private MethodCallExpr call;
-
-    MethodCallExprNameRef() { this = call.getIdentifier() }
-
-    override MethodCallExpr getCall() { result = call }
-  }
-
   RustDataFlow::ArgumentPosition callbackSelfParameterPosition() { result.isClosureSelf() }
 
   ReturnKind getStandardReturnValueKind() { result = TNormalReturnKind() }
@@ -147,18 +126,16 @@ module Input implements InputSig<Location, RustDataFlow> {
 
 private import Make<Location, RustDataFlow, Input> as Impl
 
-module StepsInput implements Impl::Private::StepsInputSig {
-  Impl::Private::SummaryNode getSummaryNode(RustDataFlow::Node n) {
-    result = n.(FlowSummaryNode).getSummaryNode()
+module Input2 implements Impl::Private::InputSig2 {
+  class SourceSinkReportingElement extends AstNode {
+    DataFlowCallable getEnclosingCallable() { result.asCfgScope() = this.getEnclosingCfgScope() }
   }
 
-  DataFlowCall getACall(Public::SummarizedCallable sc) { result.asCall().getStaticTarget() = sc }
-
-  /** Gets the argument of `source` described by `sc`, if any. */
-  private Expr getSourceNodeArgument(Input::SourceBase source, Impl::Private::SummaryComponent sc) {
+  /** Gets the argument of `call` described by `sc`, if any. */
+  private Expr getArg(Call call, Impl::Private::SummaryComponent sc) {
     exists(RustDataFlow::ArgumentPosition pos |
       sc = Impl::Private::SummaryComponent::argument(pos) and
-      result = pos.getArgument(source.getCall())
+      result = pos.getArgument(call)
     )
   }
 
@@ -175,47 +152,98 @@ module StepsInput implements Impl::Private::StepsInputSig {
     )
   }
 
-  RustDataFlow::DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) {
-    result.asCfgScope() = source.getEnclosingCfgScope()
-  }
-
-  additional RustDataFlow::Node getSourceNode(
-    Input::SourceBase source, Impl::Private::SummaryComponentStack s, boolean isArgPostUpdate
+  bindingset[source, s]
+  additional SourceSinkReportingElement getSourceEntryElement(
+    Impl::Public::SourceElement source, Impl::Private::SummaryComponentStack s, boolean isArg,
+    SourceSinkReportingElement exit
   ) {
-    s.head() = Impl::Private::SummaryComponent::return(_) and
-    result.asExpr() = source.getCall() and
-    isArgPostUpdate = false
+    s.headOfSingleton() = Impl::Private::SummaryComponent::return(_) and
+    result.(Call).getResolvedTarget() = source and
+    isArg = false and
+    exit = result
     or
-    exists(RustDataFlow::ArgumentPosition pos, Expr arg |
-      s.head() = Impl::Private::SummaryComponent::parameter(pos) and
-      arg = getSourceNodeArgument(source, s.tail().headOfSingleton()) and
-      result.asParameter() = getCallable(arg).getParam(pos.getPosition()) and
-      isArgPostUpdate = false
+    exists(RustDataFlow::ArgumentPosition pos |
+      s.head() = Impl::Private::SummaryComponent::parameter(pos)
+    |
+      exists(Call call, Expr arg |
+        call.getResolvedTarget() = source and
+        arg = getArg(call, s.tail().headOfSingleton()) and
+        exit = pos.getParameter(getCallable(arg)) and
+        result = call and
+        isArg = false
+      )
+      or
+      exists(Function f |
+        f = source
+        or
+        f.implements(source)
+      |
+        s.length() = 1 and
+        result = pos.getParameter(f) and
+        exit = result and
+        isArg = false
+      )
     )
     or
-    result.(RustDataFlow::PostUpdateNode).getPreUpdateNode().asExpr() =
-      getSourceNodeArgument(source, s.headOfSingleton()) and
-    isArgPostUpdate = true
+    exists(Call call |
+      call.getResolvedTarget() = source and
+      result = getArg(call, s.headOfSingleton()) and
+      exit = result and
+      isArg = true
+    )
   }
 
-  RustDataFlow::Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) {
-    result = getSourceNode(source, s, _)
+  bindingset[source, s]
+  SourceSinkReportingElement getSourceEntryElement(
+    Impl::Public::SourceElement source, Impl::Private::SummaryComponentStack s
+  ) {
+    result = getSourceEntryElement(source, s, _, _)
   }
 
-  RustDataFlow::Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) {
-    exists(InvocationExpr call, Expr arg, RustDataFlow::ArgumentPosition pos |
-      result.asExpr() = arg and
-      sc = Impl::Private::SummaryComponent::argument(pos) and
-      call = sink.getCall() and
-      arg = pos.getArgument(call)
+  bindingset[e, s]
+  NodePublic getSourceExitNode(SourceSinkReportingElement e, Impl::Private::SummaryComponentStack s) {
+    exists(Impl::Public::SourceElement source, boolean isArg, SourceSinkReportingElement exit |
+      e = getSourceEntryElement(source, s, isArg, exit)
+    |
+      isArg = false and
+      result.(Node).getAstNode() = exit
+      or
+      isArg = true and
+      result.(PostUpdateNode).getPreUpdateNode().(Node).getAstNode() = exit
+    )
+  }
+
+  SourceSinkReportingElement getSinkExitElement(
+    Impl::Public::SinkElement sink, Impl::Private::SummaryComponent sc
+  ) {
+    exists(Call call |
+      call.getResolvedTarget() = sink and
+      result = getArg(call, sc)
     )
   }
+
+  bindingset[e, sc]
+  NodePublic getSinkEntryNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) {
+    result.asExpr() = e and
+    exists(sc)
+  }
+}
+
+private import Impl::Private::Make2<Input2> as Impl2
+
+module StepsInput implements Impl2::StepsInputSig {
+  Impl2::SummaryNode getSummaryNode(RustDataFlow::Node n) {
+    result = n.(FlowSummaryNode).getSummaryNode()
+  }
+
+  DataFlowCall getACall(Public::SummarizedCallable sc) { result.asCall().getStaticTarget() = sc }
 }
 
 module Private {
   import Impl::Private
+  import Impl2
 
-  module Steps = Impl::Private::Steps<StepsInput>;
+  module Steps = Impl2::Steps<StepsInput>;
 
   private import codeql.rust.dataflow.FlowSource
   private import codeql.rust.dataflow.FlowSink

rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll

@@ -212,7 +212,7 @@ private class FlowSourceFromModel extends FlowSource::Range {
 
   FlowSourceFromModel() {
     sourceModel(path, _, _, _, _) and
-    this.callResolvesTo(path)
+    this.getCanonicalPath() = path
   }
 
   override predicate isSource(string output, string kind, Provenance provenance, string model) {
@@ -234,7 +234,7 @@ private class FlowSinkFromModel extends FlowSink::Range {
 
   FlowSinkFromModel() {
     sinkModel(path, _, _, _, _) and
-    this.callResolvesTo(path)
+    this.getCanonicalPath() = path
   }
 
   override predicate isSink(string input, string kind, Provenance provenance, string model) {
@@ -256,7 +256,7 @@ private class FlowBarrierFromModel extends FlowBarrier::Range {
 
   FlowBarrierFromModel() {
     barrierModel(path, _, _, _, _) and
-    this.callResolvesTo(path)
+    this.getCanonicalPath() = path
   }
 
   override predicate isBarrier(string output, string kind, Provenance provenance, string model) {
@@ -272,7 +272,7 @@ private class FlowBarrierGuardFromModel extends FlowBarrierGuard::Range {
 
   FlowBarrierGuardFromModel() {
     barrierGuardModel(path, _, _, _, _, _) and
-    this.callResolvesTo(path)
+    this.getCanonicalPath() = path
   }
 
   override predicate isBarrierGuard(

rust/ql/lib/codeql/rust/dataflow/internal/Node.qll

@@ -93,25 +93,16 @@ class FlowSummaryNode extends Node, TFlowSummaryNode {
   }
 
   override CfgScope getCfgScope() {
-    result = this.getSummaryNode().getSourceElement().getEnclosingCfgScope()
-    or
-    result = this.getSummaryNode().getSinkElement().getEnclosingCfgScope()
+    result = this.getSummaryNode().getSourceSinkReportingElement().getEnclosingCfgScope()
   }
 
   override DataFlowCallable getEnclosingCallable() {
-    result.asCfgScope() = this.getCfgScope()
-    or
-    result.asSummarizedCallable() = this.getSummarizedCallable()
+    result = this.getSummaryNode().getEnclosingCallable()
   }
 
   override Location getLocation() {
     Stages::DataFlowStage::ref() and
-    exists(this.getSummarizedCallable()) and
-    result instanceof EmptyLocation
-    or
-    result = this.getSourceElement().getLocation()
-    or
-    result = this.getSinkElement().getLocation()
+    result = this.getSummaryNode().getLocation()
   }
 
   override string toString() {
@@ -761,9 +752,7 @@ newtype TNode =
   TIndexOutNode(IndexExpr ie, Boolean isPost) or
   TSsaNode(SsaImpl::DataFlowIntegration::SsaNode node) or
   TFlowSummaryNode(FlowSummaryImpl::Private::SummaryNode sn) {
-    forall(AstNode n | n = sn.getSinkElement() or n = sn.getSourceElement() |
-      n.hasEnclosingCfgScope()
-    )
+    forall(AstNode n | n = sn.getSourceSinkReportingElement() | n.hasEnclosingCfgScope())
   } or
   TClosureSelfReferenceNode(CfgScope c) { lambdaCreationExpr(c) } or
   TCaptureNode(VariableCapture::Flow::SynthesizedCaptureNode cn) or

rust/ql/lib/utils/test/InlineFlowTest.qll

@@ -38,9 +38,18 @@ private module FlowTestImpl implements InputSig<Location, RustDataFlow> {
       result = arg.(ArrayListExpr).getExpr(0).toString()
     )
     or
-    sourceNode(src, _) and
-    result =
-      src.(Node::FlowSummaryNode).getSourceElement().getCall().getPositionalArgument(0).toString() and
+    exists(AstNode n |
+      sourceNode(src, _) and
+      n = src.(Node::FlowSummaryNode).getSummaryNode().getSourceSinkReportingElement()
+    |
+      result = n.(Call).getPositionalArgument(0).toString()
+      or
+      result = n.(Param).getPat().(IdentPat).getName().getText()
+      or
+      not n instanceof Call and
+      not n instanceof Param and
+      result = n.toString()
+    ) and
     // Don't use the result if it contains spaces
     not result.matches("% %")
   }

rust/ql/test/library-tests/dataflow/models/main.rs

@@ -339,7 +339,7 @@ trait MyTrait {
 
 impl MyTrait for () {
     fn test_param_source(i: i64) {
-        sink(i) // $ MISSING: hasValueFlow=i
+        sink(i) // $ hasValueFlow=i
     }
 }