Rust: Update legacy MaD models 2

[geoffw0]

Update some more legacy MaD models to the new model format (continues from #19934 , but should be independent of that).

[geoffw0]

Accepted test regressions. There are almost no results left for rust/weak-sensitive-data-hashing, this needs addressing before the PR can be merged (@hvitved please advise).

We also lose some results in a test case involving a loop, similar to the one discussed in #19934 (comment) .

[aibaars]

Currently getStaticTarget() fails on md5::Md5::digest. This are the relevant lines:

pub type Md5 = CoreWrapper<Md5Core>;

impl<D: FixedOutput + Default + Update + HashMarker> Digest for D {
    fn digest(data: impl AsRef<[u8]>) -> Output<Self> { ... }
}

• https://github.com/RustCrypto/hashes/blob/md-5-v0.10.6/md5/src/lib.rs#L134
• https://github.com/RustCrypto/traits/blob/digest-v0.10.7/digest/src/digest.rs#L57

[aibaars]

@hvitved I guess the type variable in for D is the cause of the trouble, isn't it?

[hvitved]

Yes, we don't currently handle impl<T> Foo for T; I have added this instance to our internal issue tracking this.

[geoffw0]

Thanks. I've just created an issue to track test results we are losing but expect to get back with type inference improvements - the idea being we can merge this before we get it back if we want to.

[geoffw0]

I think the only remaining issue is the CWE-328 test regressions, which we now have an issue two issues tracking. I'm taking this out of draft and starting a DCA run...

[geoffw0]

DCA LGTM, apart from lost query sinks and cryptographic operations. Likely all are the CWE-328 issue we picked up in tests.

(there's some discussion going on elsewhere about whether to temporarily accept these regressions, or put in a temporary fix; other than that I think we're good to merge now)

[geoffw0]

Merge conflict fixed.