Rust: Improve/add various models #21123
Open
+831
−580
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| private class ImplicitDerefOutNode extends ImplicitDerefNode, OutNode { | ||
| private DataFlowCall call; |
Check warning
Code scanning / CodeQL
Dead code Warning
| bindingset[derefChain, borrow, strippedTypePath, strippedType] | ||
| private predicate hasNoCompatibleNonBlanketLikeTargetCheck( | ||
| string derefChain, BorrowKind borrow, TypePath strippedTypePath, Type strippedType | ||
| DerefChain derefChain, BorrowKind borrow, TypePath strippedTypePath, Type strippedType |
Check warning
Code scanning / CodeQL
Missing QLDoc for parameter Warning
hvitved
force-pushed
the
rust/fix-path-models
branch
from
2acbb4d to
33a698e
Compare
hvitved
changed the title
fs.model.yml
hvitved
changed the title
hvitved
force-pushed
the
rust/fix-path-models
branch
from
d1a2295 to
9661b43
Compare
hvitved
force-pushed
the
rust/fix-path-models
branch
from
9661b43 to
f3d78a4
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves Rust dataflow models by fixing typos and adding missing models based on triaging MISSING tags in test expectations.
Changes:
- Fixes
Argument[Self]→Argument[self]typos in fs.model.yml - Removes incorrect manual models for
as_mut_os_stringandinto_os_string(relying on generated models instead) - Adds new models for HTTP response body accessors, stdin read_line, Path/OsStr methods, Vec/slice deref, and borrow::Cow::to_mut
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| rust/ql/lib/codeql/rust/frameworks/stdlib/io.model.yml | Adds stdin read_line taint model |
| rust/ql/lib/codeql/rust/frameworks/stdlib/fs.model.yml | Fixes Self→self typos, removes incorrect manual models, adds missing Path methods |
| rust/ql/lib/codeql/rust/frameworks/stdlib/ffi.model.yml | Adds OsStr to_str, to_string_lossy, as_encoded_bytes models |
| rust/ql/lib/codeql/rust/frameworks/stdlib/core.model.yml | Adds slice get model |
| rust/ql/lib/codeql/rust/frameworks/stdlib/alloc.model.yml | Adds Vec deref model, Cow::to_mut model |
| rust/ql/lib/codeql/rust/frameworks/http.model.yml | Adds Response body accessors |
| rust/ql/test/query-tests/security/CWE-295/* | Updates test expectations (auto-generated) |
| rust/ql/test/query-tests/security/CWE-117/* | Updates test expectations (auto-generated) |
| rust/ql/test/library-tests/dataflow/sources/net/* | Updates test expectations (auto-generated) |
| rust/ql/test/library-tests/dataflow/sources/file/* | Updates test expectations (auto-generated) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Based on triaging some
MISSINGtags:Argument[Self]->Argument[self]typos.as_mut_os_stringandinto_os_string; the generated models are accurate.DCA is fine.