Rust: Source/sink/barrier MaD trait models apply to implementations - #22445
Draft
hvitved wants to merge 3 commits into
Draft
Rust: Source/sink/barrier MaD trait models apply to implementations#22445hvitved wants to merge 3 commits into
hvitved wants to merge 3 commits into
Conversation
hvitved
force-pushed
the
hvitved-add-source-sink-barrier-tests
branch
from
August 27, 2026 13:27
157403e to
3778964
Compare
hvitved
force-pushed
the
hvitved-add-source-sink-barrier-tests
branch
3 times, most recently
from
August 27, 2026 17:42
4305c61 to
42cbd6b
Compare
hvitved
force-pushed
the
hvitved-add-source-sink-barrier-tests
branch
from
August 31, 2026 12:33
42cbd6b to
7a8ac86
Compare
hvitved
force-pushed
the
hvitved-add-source-sink-barrier-tests
branch
from
August 31, 2026 15:52
7a8ac86 to
d94dc40
Compare
hvitved
force-pushed
the
hvitved-add-source-sink-barrier-tests
branch
from
August 31, 2026 17:52
d94dc40 to
4a7a072
Compare
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Concrete trait targets can produce duplicate endpoint models, and barrier coverage does not independently exercise all new paths.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 1
New issues introduced by this change (3)
| Severity | Finding |
|---|---|
 |
rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll — The inherited endpoint fallback is also applied to concrete <Type as Trait>::method functions.… |
 |
rust/ql/test/library-tests/dataflow/barrier/main.rs — sanitize3 is not tested independently: s has already passed through the sanitize2 barrier, so… |
|
rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll — The new barrierGuardModel inheritance path has no corresponding trait-implementation test, while… |
What changed in this PR
Extends Rust MaD source, sink, and barrier models to trait implementations, aligning them with summary-model inheritance.
Changes:
- Adds exactness-aware endpoint model selection and Rust trait resolution.
- Updates shared and language-specific dataflow adapters.
- Expands Rust cryptography and dataflow tests.
| File | Description |
|---|---|
shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll |
Adds exactness-aware endpoint selection. |
rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll |
Resolves models through trait implementations. |
rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll |
Integrates inherited Rust models. |
rust/ql/lib/codeql/rust/dataflow/FlowSource.qll |
Marks explicit sources exact. |
rust/ql/lib/codeql/rust/dataflow/FlowSink.qll |
Marks explicit sinks exact. |
rust/ql/lib/codeql/rust/dataflow/FlowBarrier.qll |
Marks explicit barriers and guards exact. |
rust/ql/lib/codeql/rust/internal/PathResolution.qll |
Adds call-target debugging support. |
rust/ql/test/library-tests/dataflow/models/models.ext.yml |
Adds trait source and sink models. |
rust/ql/test/library-tests/dataflow/models/main.rs |
Exercises modeled trait implementations. |
rust/ql/test/library-tests/dataflow/models/external_file.rs |
Adds external trait implementations. |
rust/ql/test/library-tests/dataflow/models/models.expected |
Updates generated model baseline. |
rust/ql/test/library-tests/dataflow/barrier/main.rs |
Adds trait barrier cases. |
rust/ql/test/library-tests/dataflow/barrier/external_file.rs |
Adds an external barrier trait. |
rust/ql/test/library-tests/dataflow/barrier/inline-flow.ext.yml |
Defines trait barrier models. |
rust/ql/test/query-tests/security/CWE-798/test_cipher.rs |
Enables newly detected expectations. |
rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected |
Updates generated query results. |
rust/ql/test/query-tests/security/CWE-327/WeakSensitiveDataHashing/test.rs |
Enables trait-based hashing expectations. |
rust/ql/test/query-tests/security/CWE-327/WeakSensitiveDataHashing/WeakSensitiveDataHashing.expected |
Updates generated hashing baseline. |
rust/ql/test/query-tests/security/CWE-327/WeakSensitiveDataHashing/CryptographicOperations.expected |
Updates generated operation baseline. |
cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll |
Adapts C++ to the shared contract. |
csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll |
Removes obsolete endpoint bases. |
go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll |
Removes obsolete endpoint bases. |
java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll |
Removes obsolete endpoint bases. |
javascript/ql/lib/semmle/javascript/dataflow/internal/FlowSummaryPrivate.qll |
Removes obsolete endpoint bases. |
python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll |
Removes obsolete endpoint bases. |
ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll |
Removes obsolete endpoint bases. |
swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll |
Removes obsolete endpoint bases. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+189
to
+193
| f.implements(f0) and | ||
| isExact = false and | ||
| // making inherited models generated means that source code definitions and | ||
| // exact generated models take precedence | ||
| p = "hq-generated" |
Comment on lines
+63
to
+67
| let s = source(2); | ||
| <()>::sanitize2(s); | ||
| sink(s); | ||
| <()>::sanitize3(s); | ||
| sink(s); |
Comment on lines
336
to
+338
| FlowBarrierGuardFromModel() { | ||
| barrierGuardModel(path, _, _, _, _, _) and | ||
| this.getCanonicalPath() = path | ||
| barrierGuardModel(path, _, _, _, orig, _) and | ||
| interpretPath(path, this, orig, p_, isExact_) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR applies the same inheritance logic to source/sink/barrier MaD models for trait functions as for summary models, that is, a model for
<Foo>::barapplies to any function implementing the trait functionfoo, unless an explicit model exists for that particular implementation.In order to ensure that the same prioritization rules apply as for summary models, this logic is defined in the shared library, but currently only Rust and C++ make use of it.
The updated test output shows that we fix some existing FNs, and DCA shows that we both remove some alerts (presumably because we now have more barriers) and we gain some alerts (presumably because we now have more sources and sinks).