Skip to content

Commit 0e31eee

Browse files
hvitvedhvitved
committed
take2
1 parent b6b6e5a commit 0e31eee

File tree

5 files changed

+131
-8
lines changed

5 files changed

+131
-8
lines changed

‎rust/ql/lib/codeql/rust/internal/PathResolution.qll

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,6 @@ abstract class ItemNode extends Locatable {
208208
crateDefEdge(this, name, result, kind)
209209
or
210210
crateDependencyEdge(this, name, result) and
211-
not declaresDirectly(this, TTypeNamespace(), name) and
212211
kind.isInternal()
213212
or
214213
externCrateEdge(this, name, result) and
@@ -1233,17 +1232,23 @@ private class BuiltinSourceFile extends SourceFileItemNode {
12331232
BuiltinSourceFile() { this.getFile().getParentContainer() instanceof Builtins::BuiltinsFolder }
12341233
}
12351234

1235+
pragma[nomagic]
1236+
private predicate crateDependency(SourceFileItemNode file, string name, CrateItemNode dep) {
1237+
exists(CrateItemNode c | dep = c.(Crate).getDependency(name) | file = c.getASourceFile())
1238+
}
1239+
12361240
/**
12371241
* Holds if `file` depends on crate `dep` named `name`.
12381242
*/
12391243
pragma[nomagic]
12401244
private predicate crateDependencyEdge(SourceFileItemNode file, string name, CrateItemNode dep) {
1241-
exists(CrateItemNode c | dep = c.(Crate).getDependency(name) | file = c.getASourceFile())
1245+
crateDependency(file, name, dep)
12421246
or
1243-
// All files _should_ belong to a crate, but for those where we cannot identify the crate,
1244-
// we give access to all crates as a fallback.
1245-
not file = any(Crate c).getASourceFile() and
1246-
name = dep.getName()
1247+
// As a fallback, give all files access to crates that do not conflict with known dependencies
1248+
// and declarations.
1249+
name = dep.getName() and
1250+
not declaresDirectly(file, TTypeNamespace(), name) and
1251+
not crateDependency(file, name, _)
12471252
}
12481253

12491254
private predicate useTreeDeclares(UseTree tree, string name) {

‎rust/ql/test/library-tests/dataflow/sources/CONSISTENCY/PathResolutionConsistency.expected

Lines changed: 92 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,54 @@
11
multipleCallTargets
22
| test.rs:98:14:98:43 | ...::_print(...) |
33
| test.rs:110:14:110:33 | ...::_print(...) |
4+
| test.rs:113:23:113:46 | ...::builder(...) |
5+
| test.rs:113:23:113:55 | ... .uri(...) |
6+
| test.rs:113:23:113:78 | ... .body(...) |
47
| test.rs:113:62:113:77 | ...::from(...) |
8+
| test.rs:120:19:120:42 | ...::builder(...) |
9+
| test.rs:120:19:120:51 | ... .uri(...) |
10+
| test.rs:120:19:120:74 | ... .body(...) |
511
| test.rs:120:58:120:73 | ...::from(...) |
12+
| test.rs:124:9:124:25 | response.status() |
13+
| test.rs:124:9:124:38 | ... .is_success() |
14+
| test.rs:130:18:130:32 | response.body() |
15+
| test.rs:131:18:131:36 | response.body_mut() |
16+
| test.rs:133:24:133:43 | response.into_body() |
617
| test.rs:136:22:136:43 | ...::_print(...) |
718
| test.rs:141:22:141:43 | ...::_print(...) |
819
| test.rs:145:22:145:44 | ...::_print(...) |
20+
| test.rs:158:27:158:44 | response.headers() |
21+
| test.rs:160:16:160:63 | headers.contains_key(...) |
922
| test.rs:161:26:161:110 | ...::_print(...) |
23+
| test.rs:161:47:161:64 | response.headers() |
24+
| test.rs:163:22:163:65 | ... .to_str() |
25+
| test.rs:164:22:164:67 | ... .as_bytes() |
26+
| test.rs:165:22:165:60 | headers.get(...) |
27+
| test.rs:168:16:168:51 | headers.contains_key(...) |
1028
| test.rs:169:26:169:111 | ...::_print(...) |
29+
| test.rs:169:47:169:64 | response.headers() |
30+
| test.rs:169:47:169:84 | ... .get(...) |
31+
| test.rs:169:47:169:102 | ... .to_str() |
32+
| test.rs:170:22:170:48 | headers.get(...) |
33+
| test.rs:171:22:171:48 | headers.get(...) |
34+
| test.rs:171:22:171:66 | ... .to_str() |
35+
| test.rs:172:22:172:48 | headers.get(...) |
36+
| test.rs:172:22:172:68 | ... .as_bytes() |
37+
| test.rs:176:16:176:57 | headers.contains_key(...) |
38+
| test.rs:177:22:177:39 | response.headers() |
39+
| test.rs:177:22:177:65 | ... .get(...) |
40+
| test.rs:178:31:178:67 | headers.get_all(...) |
1141
| test.rs:179:30:179:68 | ...::_print(...) |
42+
| test.rs:179:45:179:59 | cookie.to_str() |
43+
| test.rs:181:26:181:40 | cookie.to_str() |
44+
| test.rs:185:33:185:53 | response.into_parts() |
45+
| test.rs:187:16:187:69 | ... .contains_key(...) |
1246
| test.rs:188:26:188:105 | ...::_print(...) |
47+
| test.rs:188:47:188:96 | ... .to_str() |
48+
| test.rs:190:22:190:71 | ... .to_str() |
49+
| test.rs:191:22:191:73 | ... .as_bytes() |
50+
| test.rs:192:22:192:66 | ... .get(...) |
1351
| test.rs:229:22:229:72 | ... .read_to_string(...) |
14-
| test.rs:483:22:483:50 | file.read_to_end(...) |
15-
| test.rs:489:22:489:53 | file.read_to_string(...) |
1652
| test.rs:610:18:610:38 | ...::_print(...) |
1753
| test.rs:615:18:615:45 | ...::_print(...) |
1854
| test.rs:619:25:619:49 | address.to_socket_addrs() |
@@ -87,3 +123,57 @@ multipleCallTargets
87123
| web_frameworks.rs:102:14:102:25 | a.as_bytes() |
88124
| web_frameworks.rs:158:14:158:23 | a.as_str() |
89125
| web_frameworks.rs:159:14:159:25 | a.as_bytes() |
126+
| web_frameworks.rs:188:14:188:27 | request.body() |
127+
| web_frameworks.rs:189:9:189:25 | request.headers() |
128+
| web_frameworks.rs:189:9:189:39 | ... .get(...) |
129+
| web_frameworks.rs:190:14:190:32 | request.into_body() |
130+
multiplePathResolutions
131+
| test.rs:113:23:113:26 | http |
132+
| test.rs:113:23:113:35 | ...::Request |
133+
| test.rs:120:19:120:22 | http |
134+
| test.rs:120:19:120:31 | ...::Request |
135+
| test.rs:160:37:160:40 | http |
136+
| test.rs:160:37:160:48 | ...::header |
137+
| test.rs:160:37:160:62 | ...::CONTENT_TYPE |
138+
| test.rs:161:66:161:69 | http |
139+
| test.rs:161:66:161:77 | ...::header |
140+
| test.rs:161:66:161:91 | ...::CONTENT_TYPE |
141+
| test.rs:162:31:162:34 | http |
142+
| test.rs:162:31:162:42 | ...::header |
143+
| test.rs:162:31:162:56 | ...::CONTENT_TYPE |
144+
| test.rs:163:30:163:33 | http |
145+
| test.rs:163:30:163:41 | ...::header |
146+
| test.rs:163:30:163:55 | ...::CONTENT_TYPE |
147+
| test.rs:164:30:164:33 | http |
148+
| test.rs:164:30:164:41 | ...::header |
149+
| test.rs:164:30:164:55 | ...::CONTENT_TYPE |
150+
| test.rs:165:34:165:37 | http |
151+
| test.rs:165:34:165:45 | ...::header |
152+
| test.rs:165:34:165:59 | ...::CONTENT_TYPE |
153+
| test.rs:176:37:176:40 | http |
154+
| test.rs:176:37:176:48 | ...::header |
155+
| test.rs:176:37:176:56 | ...::COOKIE |
156+
| test.rs:177:45:177:48 | http |
157+
| test.rs:177:45:177:56 | ...::header |
158+
| test.rs:177:45:177:64 | ...::COOKIE |
159+
| test.rs:178:47:178:50 | http |
160+
| test.rs:178:47:178:58 | ...::header |
161+
| test.rs:178:47:178:66 | ...::COOKIE |
162+
| test.rs:187:43:187:46 | http |
163+
| test.rs:187:43:187:54 | ...::header |
164+
| test.rs:187:43:187:68 | ...::CONTENT_TYPE |
165+
| test.rs:188:61:188:64 | http |
166+
| test.rs:188:61:188:72 | ...::header |
167+
| test.rs:188:61:188:86 | ...::CONTENT_TYPE |
168+
| test.rs:189:37:189:40 | http |
169+
| test.rs:189:37:189:48 | ...::header |
170+
| test.rs:189:37:189:62 | ...::CONTENT_TYPE |
171+
| test.rs:190:36:190:39 | http |
172+
| test.rs:190:36:190:47 | ...::header |
173+
| test.rs:190:36:190:61 | ...::CONTENT_TYPE |
174+
| test.rs:191:36:191:39 | http |
175+
| test.rs:191:36:191:47 | ...::header |
176+
| test.rs:191:36:191:61 | ...::CONTENT_TYPE |
177+
| test.rs:192:40:192:43 | http |
178+
| test.rs:192:40:192:51 | ...::header |
179+
| test.rs:192:40:192:65 | ...::CONTENT_TYPE |

‎rust/ql/test/library-tests/dataflow/sources/CONSISTENCY/TypeInferenceConsistency.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
nonUniqueCertainType
2+
| file:///home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-body-1.0.1/src/lib.rs:140:9:140:28 | SelfParam | Ptr.&T |
3+
| file:///home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-body-1.0.1/src/lib.rs:165:9:165:28 | SelfParam | Ptr.&T |
24
| web_frameworks.rs:139:30:139:39 | ...::get(...) | |
35
| web_frameworks.rs:140:34:140:43 | ...::get(...) | |
46
| web_frameworks.rs:141:30:141:39 | ...::get(...) | |
7+
| web_frameworks.rs:186:9:186:15 | request | |
8+
| web_frameworks.rs:186:9:186:15 | request | |
9+
| web_frameworks.rs:188:14:188:20 | request | |
10+
| web_frameworks.rs:189:9:189:15 | request | |
11+
| web_frameworks.rs:190:14:190:20 | request | |

‎rust/ql/test/query-tests/security/CWE-770/CONSISTENCY/PathResolutionConsistency.expected

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,18 @@
11
multipleCallTargets
2+
| main.rs:218:14:218:30 | ...::malloc(...) |
3+
| main.rs:219:13:219:27 | ...::malloc(...) |
4+
| main.rs:220:13:220:37 | ...::aligned_alloc(...) |
5+
| main.rs:221:13:221:37 | ...::aligned_alloc(...) |
6+
| main.rs:222:13:222:31 | ...::calloc(...) |
7+
| main.rs:223:13:223:55 | ...::calloc(...) |
8+
| main.rs:224:13:224:32 | ...::realloc(...) |
29
| main.rs:229:13:229:40 | ...::with_capacity(...) |
310
| main.rs:233:18:233:47 | ...::with_capacity(...) |
11+
multiplePathResolutions
12+
| main.rs:218:14:218:17 | libc |
13+
| main.rs:219:13:219:16 | libc |
14+
| main.rs:220:13:220:16 | libc |
15+
| main.rs:221:13:221:16 | libc |
16+
| main.rs:222:13:222:16 | libc |
17+
| main.rs:223:13:223:16 | libc |
18+
| main.rs:224:13:224:16 | libc |

‎rust/ql/test/query-tests/security/CWE-825/CONSISTENCY/PathResolutionConsistency.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
multipleCallTargets
2+
| deallocation.rs:106:16:106:32 | ...::malloc(...) |
3+
| deallocation.rs:112:3:112:41 | ...::free(...) |
24
| deallocation.rs:260:11:260:29 | ...::from(...) |
35
| deallocation.rs:261:11:261:29 | ...::from(...) |
46
| lifetime.rs:610:13:610:31 | ...::from(...) |
@@ -7,3 +9,7 @@ multipleCallTargets
79
| lifetime.rs:612:41:612:52 | bar.as_str() |
810
| lifetime.rs:628:13:628:31 | ...::from(...) |
911
| lifetime.rs:629:32:629:43 | baz.as_str() |
12+
multiplePathResolutions
13+
| deallocation.rs:106:16:106:19 | libc |
14+
| deallocation.rs:112:3:112:6 | libc |
15+
| deallocation.rs:112:29:112:32 | libc |

0 commit comments

Comments
 (0)