Skip to content

Rust: Update supported-frameworks.rst and add a few more native-tls models #22382

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
geoffw0 wants to merge 4 commits into
base: main
Choose a base branch
from
+442 −351
Open

Rust: Update supported-frameworks.rst and add a few more native-tls models #22382

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b5825df
Rust: Add a couple of missing crates to supported-frameworks.rst.
geoffw0 Aug 13, 2026
ccb0003
Rust: Add a bit more test coverage for native-tls.
geoffw0 Aug 19, 2026
355c966
Rust: Add a few more models for native_tls and related crates.
geoffw0 Aug 13, 2026
fe411d7
Rust: Change note.
geoffw0 Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/codeql/reusables/supported-frameworks.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,6 +327,7 @@ and the CodeQL library pack ``codeql/rust-all`` (`changelog <https://github.com/
`actix-web <https://crates.io/crates/actix-web>`__, Web framework
alloc, Standard library
`async-std <https://crates.io/crates/async-std>`__, Asynchronous programming library
`axum <https://crates.io/crates/axum>`__, Web framework
`biscotti <https://crates.io/crates/biscotti>`__, Cookie management
`clap <http://crates.io/crates/clap>`__, Utility library
`cookie <https://crates.io/crates/cookie>`__, Cookie management
Expand All @@ -341,6 +342,8 @@ and the CodeQL library pack ``codeql/rust-all`` (`changelog <https://github.com/
`memchr <https://crates.io/crates/memchr>`__, Utility library
`mysql <https://crates.io/crates/mysql>`__, Database
`mysql_async <https://crates.io/crates/mysql_async>`__, Database
`native-tls <https://crates.io/crates/native-tls>`__, Network communicator
`async-native-tls <https://crates.io/crates/async-native-tls>`__, Network communicator
`once_cell <https://crates.io/crates/once_cell>`__, Utility library
`poem <https://crates.io/crates/poem>`__, Web framework
`postgres <https://crates.io/crates/postgres>`__, Database
Expand Down
4 changes: 4 additions & 0 deletions rust/ql/lib/change-notes/2026-08-19-native-tls-summary-models.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added new flow summary models for the `native-tls`, `async-native-tls`, and `tokio-native-tls` crates.
8 changes: 8 additions & 0 deletions rust/ql/lib/codeql/rust/frameworks/native-tls.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,11 @@ extensions:
- ["<native_tls::TlsConnectorBuilder>::danger_accept_invalid_hostnames", "Argument[0]", "disable-certificate", "manual"]
- ["<async_native_tls::connect::TlsConnector>::danger_accept_invalid_certs", "Argument[0]", "disable-certificate", "manual"]
- ["<async_native_tls::connect::TlsConnector>::danger_accept_invalid_hostnames", "Argument[0]", "disable-certificate", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
data:
- ["<native_tls::TlsConnector>::connect", "Argument[1]", "ReturnValue.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["<async_native_tls::connect::TlsConnector>::connect", "Argument[1]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
- ["async_native_tls::connect", "Argument[1]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]

@geoffw0 geoffw0 Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The original Copilot suggested model was async_native_tls::connect::connect, I looked at the crate and decided it probably should be just async_native_tls::connect. Given what you've stated above I'll add a test case to confirm with confidence which version is actually correct.

- ["<tokio_native_tls::TlsConnector>::connect", "Argument[1]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
Comment on lines +15 to +17

@geoffw0 geoffw0 Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't, in general, aim to test every single model individually.

I will add a test for the async_native_tls case as there's a legitimate question over the correct canonical path in that case.

@geoffw0 geoffw0 Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's true, but modelling of tokio_native_tls is rather minimal at the moment (literally just this one model). So I'd rather not claim coverage at this time.

1 change: 1 addition & 0 deletions rust/ql/test/library-tests/dataflow/sources/net/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

742 changes: 393 additions & 349 deletions rust/ql/test/library-tests/dataflow/sources/net/InlineFlow.expected
View file
Open in desktop

Large diffs are not rendered by default.

5 changes: 3 additions & 2 deletions rust/ql/test/library-tests/dataflow/sources/net/TaintSources.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,6 @@
| test.rs:224:28:224:66 | ...::connect(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
| test.rs:306:22:306:58 | ...::connect(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
| test.rs:332:22:332:75 | ...::new(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
| test.rs:373:19:373:41 | ...::connect(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
| test.rs:519:16:519:31 | ...::args(...) | Flow source 'CommandLineArgs' of type commandargs (DEFAULT). |
| test.rs:359:18:359:54 | ...::connect(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
| test.rs:396:19:396:41 | ...::connect(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
| test.rs:542:16:542:31 | ...::args(...) | Flow source 'CommandLineArgs' of type commandargs (DEFAULT). |
1 change: 1 addition & 0 deletions rust/ql/test/library-tests/dataflow/sources/net/options.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ qltest_dependencies:
- rustls = { version = "0.23.27" }
- futures-rustls = { version = "0.26.0" }
- async-std = { version = "1.13.1" }
- native-tls = { version = "0.2.14" }
29 changes: 29 additions & 0 deletions rust/ql/test/library-tests/dataflow/sources/net/test.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -354,6 +354,29 @@ fn test_rustls() -> std::io::Result<()> {
Ok(())
}

fn test_native_tls() -> Result<(), Box<dyn std::error::Error>> {
let address = "www.example.com:443";
let stream = std::net::TcpStream::connect(address)?; // $ Alert[rust/summary/taint-sources]
let connector = native_tls::TlsConnector::new()?;
let mut stream = connector.connect("www.example.com", stream)?;
sink(&stream); // $ hasTaintFlow=address

stream.write_all(b"GET / HTTP/1.1\r\nHost: www.example.com\r\nConnection: close\r\n\r\n")?;

let mut buffer = [0u8; 100];
let bytes_read = stream.read(&mut buffer)?;
println!("bytes_read = {}", bytes_read);
println!("buffer = {:?}", &buffer[..bytes_read]);
sink(&buffer[..bytes_read]); // $ hasTaintFlow=address

let mut response = String::new();
stream.read_to_string(&mut response)?;
println!("rest of response = '{}'", response);
sink(response); // $ hasTaintFlow=address

Ok(())
}

mod futures_rustls {
use async_std::net::TcpStream;
use async_std::sync::Arc;
Expand Down Expand Up @@ -548,6 +571,12 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
Err(e) => println!("error: {}", e),
}

println!("test_native_tls...");
match test_native_tls() {
Ok(_) => println!("complete"),
Err(e) => println!("error: {}", e),
}

println!("test_rustls...");
match test_rustls() {
Ok(_) => println!("complete"),
Expand Down
Loading