v2

Author: hvitved

rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll

@@ -179,14 +179,7 @@ Expr getPostUpdateReverseStep(Expr e, boolean preservesValue) {
 
 module LocalFlow {
   predicate flowSummaryLocalStep(Node nodeFrom, Node nodeTo, string model) {
-    exists(FlowSummaryImpl::Public::SummarizedCallable c |
-      FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
-        nodeTo.(FlowSummaryNode).getSummaryNode(), true, model) and
-      c = nodeFrom.(FlowSummaryNode).getSummarizedCallable()
-    )
-    or
-    FlowSummaryImpl::Private::Steps::sourceLocalStep(nodeFrom.(FlowSummaryNode).getSummaryNode(),
-      nodeTo, model)
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true, model)
     or
     FlowSummaryImpl::Private::Steps::sinkLocalStep(nodeFrom,
       nodeTo.(FlowSummaryNode).getSummaryNode(), model)
@@ -650,10 +643,7 @@ module RustDataFlowGen<RustDataFlowInputSig Input> implements InputSig<Location>
    * variable.
    */
   predicate jumpStep(Node node1, Node node2) {
-    FlowSummaryImpl::Private::Steps::summaryJumpStep(node1.(FlowSummaryNode).getSummaryNode(),
-      node2.(FlowSummaryNode).getSummaryNode())
-    or
-    FlowSummaryImpl::Private::Steps::sourceJumpStep(node1.(FlowSummaryNode).getSummaryNode(), node2)
+    FlowSummaryImpl::Private::Steps::summaryJumpStep(node1, node2)
     or
     exists(Const c |
       node1.asExpr() = c.getBody() and
@@ -1302,7 +1292,7 @@ private module Cached {
       FlowSummaryImpl::Private::SummaryComponentStack stack
     |
       FlowSummaryImpl::Private::barrierSpec(b, stack, kind, model) and
-      exists(FlowSummaryImpl::getEntryElement(b, stack, _, n.asExpr()))
+      n.asExpr() = FlowSummaryImpl::getEntryElement(b, stack.headOfSingleton())
     )
     or
     ParameterizedBarrierGuard<TKindModelPair, barrierGuardChecks/4>::getABarrierNode(TMkPair(kind,

rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll

@@ -148,46 +148,23 @@ private Callable getCallable(Expr expr) {
   )
 }
 
-bindingset[f, s]
-bindingset[result, s]
-Input2::SourceSinkReportingElement getEntryElement(
-  Function f, Impl::Private::SummaryComponentStack s, boolean isArg,
-  Input2::SourceSinkReportingElement exit
-) {
-  s.headOfSingleton() = Impl::Private::SummaryComponent::return(_) and
-  result.(Call).getResolvedTarget() = f and
-  isArg = false and
-  exit = result
-  or
-  exists(RustDataFlow::ArgumentPosition pos |
-    s.head() = Impl::Private::SummaryComponent::parameter(pos)
-  |
-    exists(Call call, Expr arg |
-      call.getResolvedTarget() = f and
-      arg = getArg(call, s.tail().headOfSingleton()) and
-      exit = pos.getParameter(getCallable(arg)) and
-      result = call and
-      isArg = false
-    )
+Input2::SourceSinkReportingElement getEntryElement(Function f, Impl::Private::SummaryComponent sc) {
+  exists(Call call | call.getResolvedTarget() = f |
+    sc = Impl::Private::SummaryComponent::return(_) and
+    result = call
     or
+    result = getArg(call, sc)
+  )
+  or
+  exists(RustDataFlow::ArgumentPosition pos | sc = Impl::Private::SummaryComponent::parameter(pos) |
     exists(Function f0 |
       f0 = f
       or
       f0.implements(f)
     |
-      s.length() = 1 and
-      result = pos.getParameter(f0) and
-      exit = result and
-      isArg = false
+      result = pos.getParameter(f0)
     )
   )
-  or
-  exists(Call call |
-    call.getResolvedTarget() = f and
-    result = getArg(call, s.headOfSingleton()) and
-    exit = result and
-    isArg = true
-  )
 }
 
 Input2::SourceSinkReportingElement getExitElement(Function f, Impl::Private::SummaryComponent sc) {
@@ -198,26 +175,39 @@ Input2::SourceSinkReportingElement getExitElement(Function f, Impl::Private::Sum
 }
 
 private module Input2 implements Impl::Private::InputSig2 {
+  private import codeql.rust.controlflow.CfgNodes
+
   class SourceSinkReportingElement extends AstNode {
     DataFlowCallable getEnclosingCallable() { result.asCfgScope() = this.getEnclosingCfgScope() }
   }
 
-  bindingset[source, s]
   SourceSinkReportingElement getSourceEntryElement(
-    Impl::Public::SourceElement source, Impl::Private::SummaryComponentStack s
+    Impl::Public::SourceElement source, Impl::Private::SummaryComponent sc
   ) {
-    result = getEntryElement(source, s, _, _)
+    result = getEntryElement(source, sc)
   }
 
-  bindingset[e, s]
-  NodePublic getSourceExitNode(SourceSinkReportingElement e, Impl::Private::SummaryComponentStack s) {
-    exists(boolean isArg, SourceSinkReportingElement exit | e = getEntryElement(_, s, isArg, exit) |
-      isArg = false and
-      result.(Node).getAstNode() = exit
-      or
-      isArg = true and
-      result.(PostUpdateNode).getPreUpdateNode().(Node).getAstNode() = exit
+  SourceSinkReportingElement getNextElement(
+    SourceSinkReportingElement prev, Impl::Private::SummaryComponent sc
+  ) {
+    exists(RustDataFlow::ArgumentPosition pos |
+      sc = Impl::Private::SummaryComponent::parameter(pos) and
+      result = pos.getParameter(getCallable(prev))
     )
+    or
+    exists(Callable c |
+      sc = Impl::Private::SummaryComponent::return(_) and
+      c = getCallable(prev) and
+      result.getACfgNode().getASuccessor() instanceof AnnotatedExitCfgNode and
+      result.getEnclosingCfgScope() = c
+    )
+  }
+
+  bindingset[e, sc]
+  NodePublic getSourceExitNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) {
+    if sc = Impl::Private::SummaryComponent::argument(_)
+    then result.(PostUpdateNode).getPreUpdateNode().(Node).getAstNode() = e
+    else result.(Node).getAstNode() = e
   }
 
   SourceSinkReportingElement getSinkExitElement(

rust/ql/lib/codeql/rust/dataflow/internal/TaintTrackingImpl.qll

@@ -83,8 +83,7 @@ module RustTaintTrackingGen<DataFlowImpl::RustDataFlowInputSig I> implements
         pred.(Node::PostUpdateNode).getPreUpdateNode().asExpr(), _, succ, _)
     )
     or
-    FlowSummaryImpl::Private::Steps::summaryLocalStep(pred,
-      succ.(Node::FlowSummaryNode).getSummaryNode(), false, model)
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(pred, succ, false, model)
   }
 
   /**

rust/ql/lib/utils/test/InlineFlowTest.qll

@@ -29,6 +29,21 @@ private module FlowTestImpl implements InputSig<Location, RustDataFlow> {
     any(CallExpr call | callTargetName(call, "sink")).getASyntacticArgument() = sink.asExpr()
   }
 
+  private string getSummaryNodeArgString(AstNode n) {
+    exists(Call call |
+      n = call
+      or
+      not n instanceof Call and
+      n = call.getASyntacticArgument() // `n` is a callback
+    |
+      result = call.getPositionalArgument(0).toString()
+    )
+    or
+    result = n.(Call).getPositionalArgument(0).toString()
+    or
+    result = n.(Param).getPat().(IdentPat).getName().getText()
+  }
+
   private string getSourceArgString(DataFlow::Node src) {
     defaultSource(src) and
     exists(Expr arg | arg = src.asExpr().(Call).getPositionalArgument(0) |
@@ -42,12 +57,9 @@ private module FlowTestImpl implements InputSig<Location, RustDataFlow> {
       sourceNode(src, _) and
       n = src.(Node::FlowSummaryNode).getSummaryNode().getSourceSinkReportingElement()
     |
-      result = n.(Call).getPositionalArgument(0).toString()
+      result = getSummaryNodeArgString(n)
       or
-      result = n.(Param).getPat().(IdentPat).getName().getText()
-      or
-      not n instanceof Call and
-      not n instanceof Param and
+      not exists(getSummaryNodeArgString(n)) and
       result = n.toString()
     ) and
     // Don't use the result if it contains spaces

rust/ql/test/library-tests/dataflow/models/main.rs

@@ -323,7 +323,7 @@ mod sink_out_of_function {
     fn test_sink_out_of_function() {
         let s = source(5);
         let a = |a| source(1);
-        pass_sink(a); // $ MISSING: hasValueFlow=1
+        pass_sink(a); // $ hasValueFlow=1
     }
 }