Skip to content

Commit 0ce4b7b

Browse files
geoffw0geoffw0
committed
Rust: Add models.
1 parent e082ae8 commit 0ce4b7b

3 files changed

Lines changed: 73 additions & 10 deletions

File tree

‎rust/ql/lib/codeql/rust/frameworks/stdlib/core.model.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,11 @@ extensions:
129129
- ["<core::str>::parse", "Argument[self].Reference", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
130130
- ["<core::str>::trim", "Argument[self].Reference", "ReturnValue.Reference", "taint", "manual"]
131131
- ["<core::str>::to_string", "Argument[self].Reference", "ReturnValue", "taint", "manual"]
132+
# Fmt
133+
- ["<_ as core::fmt::Write>::write_fmt", "Argument[0]", "Argument[self].Reference", "taint", "manual"]
134+
- ["<_ as core::fmt::Write>::write_str", "Argument[0].Reference", "Argument[self].Reference", "taint", "manual"]
135+
- ["<_ as core::fmt::Write>::write_char", "Argument[0]", "Argument[self].Reference", "taint", "manual"]
136+
- ["core::fmt::write", "Argument[1]", "Argument[0].Reference", "taint", "manual"]
132137
# Ord
133138
- ["<_ as core::cmp::Ord>::min", "Argument[self,0]", "ReturnValue", "value", "manual"]
134139
- ["<_ as core::cmp::Ord>::max", "Argument[self,0]", "ReturnValue", "value", "manual"]

‎rust/ql/test/library-tests/format-macros-legacy/inline-taint-flow.expected‎

Lines changed: 63 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,51 @@
11
models
2-
| 1 | Summary: alloc::fmt::format; Argument[0]; ReturnValue; taint |
2+
| 1 | Summary: <_ as core::fmt::Write>::write_fmt; Argument[0]; Argument[self].Reference; taint |
3+
| 2 | Summary: <_ as core::fmt::Write>::write_str; Argument[0].Reference; Argument[self].Reference; taint |
4+
| 3 | Summary: <alloc::string::String>::as_str; Argument[self].Reference; ReturnValue.Reference; taint |
5+
| 4 | Summary: alloc::fmt::format; Argument[0]; ReturnValue; taint |
6+
| 5 | Summary: core::fmt::write; Argument[1]; Argument[0].Reference; taint |
37
edges
48
| main.rs:12:9:12:9 | a | main.rs:13:10:13:25 | FormatArgsExpr | provenance | |
59
| main.rs:12:13:12:21 | source(...) | main.rs:12:9:12:9 | a | provenance | |
610
| main.rs:13:10:13:25 | ...::format(...) | main.rs:13:10:13:25 | MacroExpr | provenance | |
7-
| main.rs:13:10:13:25 | FormatArgsExpr | main.rs:13:10:13:25 | ...::format(...) | provenance | MaD:1 |
11+
| main.rs:13:10:13:25 | FormatArgsExpr | main.rs:13:10:13:25 | ...::format(...) | provenance | MaD:4 |
812
| main.rs:15:9:15:9 | b | main.rs:16:10:16:23 | FormatArgsExpr | provenance | |
913
| main.rs:15:13:15:21 | source(...) | main.rs:15:9:15:9 | b | provenance | |
1014
| main.rs:16:10:16:23 | ...::format(...) | main.rs:16:10:16:23 | MacroExpr | provenance | |
11-
| main.rs:16:10:16:23 | FormatArgsExpr | main.rs:16:10:16:23 | ...::format(...) | provenance | MaD:1 |
15+
| main.rs:16:10:16:23 | FormatArgsExpr | main.rs:16:10:16:23 | ...::format(...) | provenance | MaD:4 |
1216
| main.rs:18:9:18:9 | c | main.rs:19:13:19:36 | FormatArgsExpr | provenance | |
1317
| main.rs:18:13:18:21 | source(...) | main.rs:18:9:18:9 | c | provenance | |
1418
| main.rs:19:9:19:9 | s | main.rs:20:10:20:10 | s | provenance | |
1519
| main.rs:19:13:19:36 | ...::format(...) | main.rs:19:9:19:9 | s | provenance | |
16-
| main.rs:19:13:19:36 | FormatArgsExpr | main.rs:19:13:19:36 | ...::format(...) | provenance | MaD:1 |
20+
| main.rs:19:13:19:36 | FormatArgsExpr | main.rs:19:13:19:36 | ...::format(...) | provenance | MaD:4 |
1721
| main.rs:32:9:32:9 | a | main.rs:33:9:33:9 | b | provenance | |
1822
| main.rs:32:13:32:21 | source(...) | main.rs:32:9:32:9 | a | provenance | |
1923
| main.rs:33:9:33:9 | b | main.rs:34:30:34:30 | b | provenance | |
2024
| main.rs:34:9:34:9 | c | main.rs:35:10:35:10 | c | provenance | |
2125
| main.rs:34:13:34:31 | ...::format(...) | main.rs:34:9:34:9 | c | provenance | |
22-
| main.rs:34:30:34:30 | b | main.rs:34:13:34:31 | ...::format(...) | provenance | MaD:1 |
26+
| main.rs:34:30:34:30 | b | main.rs:34:13:34:31 | ...::format(...) | provenance | MaD:4 |
27+
| main.rs:38:9:38:9 | d | main.rs:39:28:39:28 | d | provenance | |
28+
| main.rs:38:13:38:21 | source(...) | main.rs:38:9:38:9 | d | provenance | |
29+
| main.rs:39:13:39:16 | [post] buf1 | main.rs:40:10:40:13 | buf1 | provenance | |
30+
| main.rs:39:28:39:28 | d | main.rs:39:28:39:37 | d.as_str() [&ref] | provenance | MaD:3 |
31+
| main.rs:39:28:39:37 | d.as_str() [&ref] | main.rs:39:13:39:16 | [post] buf1 | provenance | MaD:2 |
32+
| main.rs:43:9:43:9 | e | main.rs:44:28:44:46 | MacroExpr | provenance | |
33+
| main.rs:43:13:43:21 | source(...) | main.rs:43:9:43:9 | e | provenance | |
34+
| main.rs:44:13:44:16 | [post] buf2 | main.rs:45:10:45:13 | buf2 | provenance | |
35+
| main.rs:44:28:44:46 | MacroExpr | main.rs:44:13:44:16 | [post] buf2 | provenance | MaD:1 |
36+
| main.rs:48:9:48:9 | f | main.rs:49:40:49:58 | MacroExpr | provenance | |
37+
| main.rs:48:13:48:21 | source(...) | main.rs:48:9:48:9 | f | provenance | |
38+
| main.rs:49:29:49:37 | [post] &mut buf3 [&ref] | main.rs:49:34:49:37 | [post] buf3 | provenance | |
39+
| main.rs:49:34:49:37 | [post] buf3 | main.rs:50:10:50:13 | buf3 | provenance | |
40+
| main.rs:49:40:49:58 | MacroExpr | main.rs:49:29:49:37 | [post] &mut buf3 [&ref] | provenance | MaD:5 |
41+
| main.rs:54:9:54:9 | g | main.rs:55:13:55:33 | FormatArgsExpr | provenance | |
42+
| main.rs:54:13:54:21 | source(...) | main.rs:54:9:54:9 | g | provenance | |
43+
| main.rs:55:13:55:33 | FormatArgsExpr | main.rs:55:20:55:23 | [post] buf4 | provenance | MaD:1 |
44+
| main.rs:55:20:55:23 | [post] buf4 | main.rs:56:10:56:13 | buf4 | provenance | |
45+
| main.rs:59:9:59:9 | h | main.rs:60:13:60:33 | FormatArgsExpr | provenance | |
46+
| main.rs:59:13:59:21 | source(...) | main.rs:59:9:59:9 | h | provenance | |
47+
| main.rs:60:13:60:33 | FormatArgsExpr | main.rs:60:22:60:25 | [post] buf5 | provenance | MaD:1 |
48+
| main.rs:60:22:60:25 | [post] buf5 | main.rs:61:10:61:13 | buf5 | provenance | |
2349
nodes
2450
| main.rs:12:9:12:9 | a | semmle.label | a |
2551
| main.rs:12:13:12:21 | source(...) | semmle.label | source(...) |
@@ -44,10 +70,42 @@ nodes
4470
| main.rs:34:13:34:31 | ...::format(...) | semmle.label | ...::format(...) |
4571
| main.rs:34:30:34:30 | b | semmle.label | b |
4672
| main.rs:35:10:35:10 | c | semmle.label | c |
73+
| main.rs:38:9:38:9 | d | semmle.label | d |
74+
| main.rs:38:13:38:21 | source(...) | semmle.label | source(...) |
75+
| main.rs:39:13:39:16 | [post] buf1 | semmle.label | [post] buf1 |
76+
| main.rs:39:28:39:28 | d | semmle.label | d |
77+
| main.rs:39:28:39:37 | d.as_str() [&ref] | semmle.label | d.as_str() [&ref] |
78+
| main.rs:40:10:40:13 | buf1 | semmle.label | buf1 |
79+
| main.rs:43:9:43:9 | e | semmle.label | e |
80+
| main.rs:43:13:43:21 | source(...) | semmle.label | source(...) |
81+
| main.rs:44:13:44:16 | [post] buf2 | semmle.label | [post] buf2 |
82+
| main.rs:44:28:44:46 | MacroExpr | semmle.label | MacroExpr |
83+
| main.rs:45:10:45:13 | buf2 | semmle.label | buf2 |
84+
| main.rs:48:9:48:9 | f | semmle.label | f |
85+
| main.rs:48:13:48:21 | source(...) | semmle.label | source(...) |
86+
| main.rs:49:29:49:37 | [post] &mut buf3 [&ref] | semmle.label | [post] &mut buf3 [&ref] |
87+
| main.rs:49:34:49:37 | [post] buf3 | semmle.label | [post] buf3 |
88+
| main.rs:49:40:49:58 | MacroExpr | semmle.label | MacroExpr |
89+
| main.rs:50:10:50:13 | buf3 | semmle.label | buf3 |
90+
| main.rs:54:9:54:9 | g | semmle.label | g |
91+
| main.rs:54:13:54:21 | source(...) | semmle.label | source(...) |
92+
| main.rs:55:13:55:33 | FormatArgsExpr | semmle.label | FormatArgsExpr |
93+
| main.rs:55:20:55:23 | [post] buf4 | semmle.label | [post] buf4 |
94+
| main.rs:56:10:56:13 | buf4 | semmle.label | buf4 |
95+
| main.rs:59:9:59:9 | h | semmle.label | h |
96+
| main.rs:59:13:59:21 | source(...) | semmle.label | source(...) |
97+
| main.rs:60:13:60:33 | FormatArgsExpr | semmle.label | FormatArgsExpr |
98+
| main.rs:60:22:60:25 | [post] buf5 | semmle.label | [post] buf5 |
99+
| main.rs:61:10:61:13 | buf5 | semmle.label | buf5 |
47100
subpaths
48101
testFailures
49102
#select
50103
| main.rs:13:10:13:25 | MacroExpr | main.rs:12:13:12:21 | source(...) | main.rs:13:10:13:25 | MacroExpr | $@ | main.rs:12:13:12:21 | source(...) | source(...) |
51104
| main.rs:16:10:16:23 | MacroExpr | main.rs:15:13:15:21 | source(...) | main.rs:16:10:16:23 | MacroExpr | $@ | main.rs:15:13:15:21 | source(...) | source(...) |
52105
| main.rs:20:10:20:10 | s | main.rs:18:13:18:21 | source(...) | main.rs:20:10:20:10 | s | $@ | main.rs:18:13:18:21 | source(...) | source(...) |
53106
| main.rs:35:10:35:10 | c | main.rs:32:13:32:21 | source(...) | main.rs:35:10:35:10 | c | $@ | main.rs:32:13:32:21 | source(...) | source(...) |
107+
| main.rs:40:10:40:13 | buf1 | main.rs:38:13:38:21 | source(...) | main.rs:40:10:40:13 | buf1 | $@ | main.rs:38:13:38:21 | source(...) | source(...) |
108+
| main.rs:45:10:45:13 | buf2 | main.rs:43:13:43:21 | source(...) | main.rs:45:10:45:13 | buf2 | $@ | main.rs:43:13:43:21 | source(...) | source(...) |
109+
| main.rs:50:10:50:13 | buf3 | main.rs:48:13:48:21 | source(...) | main.rs:50:10:50:13 | buf3 | $@ | main.rs:48:13:48:21 | source(...) | source(...) |
110+
| main.rs:56:10:56:13 | buf4 | main.rs:54:13:54:21 | source(...) | main.rs:56:10:56:13 | buf4 | $@ | main.rs:54:13:54:21 | source(...) | source(...) |
111+
| main.rs:61:10:61:13 | buf5 | main.rs:59:13:59:21 | source(...) | main.rs:61:10:61:13 | buf5 | $@ | main.rs:59:13:59:21 | source(...) | source(...) |

‎rust/ql/test/library-tests/format-macros-legacy/main.rs‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,28 +37,28 @@ pub fn exercises_reconstruction() {
3737
let mut buf1 = String::new();
3838
let d = source(5);
3939
let _ = buf1.write_str(d.as_str());
40-
sink(buf1); // $ MISSING: hasTaintFlow=5
40+
sink(buf1); // $ hasTaintFlow=5
4141

4242
let mut buf2 = String::new();
4343
let e = source(6);
4444
let _ = buf2.write_fmt(format_args!("{e}"));
45-
sink(buf2); // $ MISSING: hasTaintFlow=6
45+
sink(buf2); // $ hasTaintFlow=6
4646

4747
let mut buf3 = String::new();
4848
let f = source(7);
4949
let _ = std::fmt::write(&mut buf3, format_args!("{f}"));
50-
sink(buf3); // $ MISSING: hasTaintFlow=7
50+
sink(buf3); // $ hasTaintFlow=7
5151

5252
use std::fmt::Write;
5353
let mut buf4 = String::new();
5454
let g = source(8);
5555
let _ = write!(buf4, "{}", g);
56-
sink(buf4); // $ MISSING: hasTaintFlow=8
56+
sink(buf4); // $ hasTaintFlow=8
5757

5858
let mut buf5 = String::new();
5959
let h = source(9);
6060
let _ = writeln!(buf5, "{h}");
61-
sink(buf5); // $ MISSING: hasTaintFlow=9
61+
sink(buf5); // $ hasTaintFlow=9
6262
}
6363

6464
// The log-injection sinks (`println!`/`eprintln!`/`panic!`) are reconstructed

0 commit comments

Comments
 (0)