Skip to content

Commit 9286596

Browse files
geoffw0geoffw0
authored
Merge pull request #18530 from geoffw0/sourcemodels2
Rust: Convert source models to models-as-data
2 parents e448bc6 + 24b35ed commit 9286596

File tree

10 files changed

+66
-80
lines changed

10 files changed

+66
-80
lines changed

‎rust/ql/lib/codeql/rust/Concepts.qll

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
private import codeql.rust.dataflow.DataFlow
88
private import codeql.threatmodels.ThreatModels
99
private import codeql.rust.Frameworks
10+
private import codeql.rust.dataflow.FlowSource
1011

1112
/**
1213
* A data flow source for a specific threat-model.
@@ -66,6 +67,13 @@ module CommandLineArgsSource {
6667
}
6768
}
6869

70+
/**
71+
* An externally modeled source for command line arguments.
72+
*/
73+
class ModeledCommandLineArgsSource extends CommandLineArgsSource::Range {
74+
ModeledCommandLineArgsSource() { sourceNode(this, "command-line-source") }
75+
}
76+
6977
/**
7078
* A data flow source corresponding to the program's environment.
7179
*/
@@ -85,6 +93,13 @@ module EnvironmentSource {
8593
}
8694
}
8795

96+
/**
97+
* An externally modeled source for data from the program's environment.
98+
*/
99+
class ModeledEnvironmentSource extends EnvironmentSource::Range {
100+
ModeledEnvironmentSource() { sourceNode(this, "environment-source") }
101+
}
102+
88103
/**
89104
* A data flow source for remote (network) data.
90105
*/
@@ -104,6 +119,13 @@ module RemoteSource {
104119
}
105120
}
106121

122+
/**
123+
* An externally modeled source for remote (network) data.
124+
*/
125+
class ModeledRemoteSource extends RemoteSource::Range {
126+
ModeledRemoteSource() { sourceNode(this, "remote") }
127+
}
128+
107129
/**
108130
* A data flow node that constructs a SQL statement (for later execution).
109131
*

‎rust/ql/lib/codeql/rust/Frameworks.qll

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,5 @@
22
* This file imports all models of frameworks and libraries.
33
*/
44

5-
private import codeql.rust.frameworks.Reqwest
65
private import codeql.rust.frameworks.rustcrypto.RustCrypto
7-
private import codeql.rust.frameworks.stdlib.Env
86
private import codeql.rust.frameworks.Sqlx

‎rust/ql/lib/codeql/rust/frameworks/Reqwest.qll

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎rust/ql/lib/codeql/rust/frameworks/reqwest.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
11
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sourceModel
5+
data:
6+
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "crate::get", "ReturnValue", "remote", "manual"]
7+
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "crate::blocking::get", "ReturnValue", "remote", "manual"]
28
- addsTo:
39
pack: codeql/rust-all
410
extensible: summaryModel

‎rust/ql/lib/codeql/rust/frameworks/stdlib/Env.qll

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎rust/ql/lib/codeql/rust/frameworks/stdlib/env.model.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sourceModel
5+
data:
6+
- ["lang:std", "crate::env::args", "ReturnValue", "command-line-source", "manual"]
7+
- ["lang:std", "crate::env::args_os", "ReturnValue", "command-line-source", "manual"]
8+
- ["lang:std", "crate::env::current_dir", "ReturnValue", "command-line-source", "manual"]
9+
- ["lang:std", "crate::env::current_exe", "ReturnValue", "command-line-source", "manual"]
10+
- ["lang:std", "crate::env::home_dir", "ReturnValue", "command-line-source", "manual"]
11+
- ["lang:std", "crate::env::var", "ReturnValue", "environment-source", "manual"]
12+
- ["lang:std", "crate::env::var_os", "ReturnValue", "environment-source", "manual"]
13+
- ["lang:std", "crate::env::vars", "ReturnValue", "environment-source", "manual"]
14+
- ["lang:std", "crate::env::vars_os", "ReturnValue", "environment-source", "manual"]

‎rust/ql/lib/codeql/rust/security/WeakSensitiveDataHashingExtensions.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,8 @@ module ComputationallyExpensiveHashFunction {
174174
}
175175

176176
/**
177-
* An externally modeled operation that hashes data, for example a call to `md5::Md5::digest(data)`.
177+
* An externally modeled operation that hashes data, for example a call to `md5::Md5::digest(data)`. The
178+
* model should identify the argument of a call that is the data to be hashed.
178179
*/
179180
class ModeledHashOperation extends Cryptography::CryptographicOperation::Range {
180181
DataFlow::Node input;

‎rust/ql/test/library-tests/dataflow/sources/TaintSources.expected

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
1-
| test.rs:8:10:8:30 | ...::var(...) | Flow source 'EnvironmentSource' of type environment. |
2-
| test.rs:9:10:9:33 | ...::var_os(...) | Flow source 'EnvironmentSource' of type environment. |
3-
| test.rs:11:16:11:36 | ...::var(...) | Flow source 'EnvironmentSource' of type environment. |
4-
| test.rs:12:16:12:39 | ...::var_os(...) | Flow source 'EnvironmentSource' of type environment. |
5-
| test.rs:17:25:17:40 | ...::vars(...) | Flow source 'EnvironmentSource' of type environment. |
6-
| test.rs:22:25:22:43 | ...::vars_os(...) | Flow source 'EnvironmentSource' of type environment. |
7-
| test.rs:29:29:29:44 | ...::args(...) | Flow source 'CommandLineArgs' of type commandargs. |
8-
| test.rs:32:16:32:31 | ...::args(...) | Flow source 'CommandLineArgs' of type commandargs. |
9-
| test.rs:33:16:33:34 | ...::args_os(...) | Flow source 'CommandLineArgs' of type commandargs. |
10-
| test.rs:40:16:40:31 | ...::args(...) | Flow source 'CommandLineArgs' of type commandargs. |
11-
| test.rs:44:16:44:34 | ...::args_os(...) | Flow source 'CommandLineArgs' of type commandargs. |
12-
| test.rs:50:15:50:37 | ...::current_dir(...) | Flow source 'CommandLineArgs' of type commandargs. |
13-
| test.rs:51:15:51:37 | ...::current_exe(...) | Flow source 'CommandLineArgs' of type commandargs. |
14-
| test.rs:52:16:52:35 | ...::home_dir(...) | Flow source 'CommandLineArgs' of type commandargs. |
15-
| test.rs:60:26:60:70 | ...::get(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
16-
| test.rs:63:26:63:70 | ...::get(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
17-
| test.rs:66:26:66:60 | ...::get(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
1+
| test.rs:8:10:8:22 | ...::var | Flow source 'EnvironmentSource' of type environment. |
2+
| test.rs:9:10:9:25 | ...::var_os | Flow source 'EnvironmentSource' of type environment. |
3+
| test.rs:11:16:11:28 | ...::var | Flow source 'EnvironmentSource' of type environment. |
4+
| test.rs:12:16:12:31 | ...::var_os | Flow source 'EnvironmentSource' of type environment. |
5+
| test.rs:17:25:17:38 | ...::vars | Flow source 'EnvironmentSource' of type environment. |
6+
| test.rs:22:25:22:41 | ...::vars_os | Flow source 'EnvironmentSource' of type environment. |
7+
| test.rs:29:29:29:42 | ...::args | Flow source 'CommandLineArgs' of type commandargs. |
8+
| test.rs:32:16:32:29 | ...::args | Flow source 'CommandLineArgs' of type commandargs. |
9+
| test.rs:33:16:33:32 | ...::args_os | Flow source 'CommandLineArgs' of type commandargs. |
10+
| test.rs:40:16:40:29 | ...::args | Flow source 'CommandLineArgs' of type commandargs. |
11+
| test.rs:44:16:44:32 | ...::args_os | Flow source 'CommandLineArgs' of type commandargs. |
12+
| test.rs:50:15:50:35 | ...::current_dir | Flow source 'CommandLineArgs' of type commandargs. |
13+
| test.rs:51:15:51:35 | ...::current_exe | Flow source 'CommandLineArgs' of type commandargs. |
14+
| test.rs:52:16:52:33 | ...::home_dir | Flow source 'CommandLineArgs' of type commandargs. |
15+
| test.rs:60:26:60:47 | ...::get | Flow source 'RemoteSource' of type remote (DEFAULT). |
16+
| test.rs:63:26:63:47 | ...::get | Flow source 'RemoteSource' of type remote (DEFAULT). |
17+
| test.rs:66:26:66:37 | ...::get | Flow source 'RemoteSource' of type remote (DEFAULT). |

‎rust/ql/test/library-tests/dataflow/sources/test.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ fn sink<T>(_: T) { }
55
// --- tests ---
66

77
fn test_env_vars() {
8-
sink(std::env::var("HOME")); // $ Alert[rust/summary/taint-sources] hasTaintFlow
9-
sink(std::env::var_os("PATH")); // $ Alert[rust/summary/taint-sources] hasTaintFlow
8+
sink(std::env::var("HOME")); // $ Alert[rust/summary/taint-sources] hasTaintFlow="HOME"
9+
sink(std::env::var_os("PATH")); // $ Alert[rust/summary/taint-sources] hasTaintFlow="PATH"
1010

1111
let var1 = std::env::var("HOME").expect("HOME not set"); // $ Alert[rust/summary/taint-sources]
1212
let var2 = std::env::var_os("PATH").unwrap(); // $ Alert[rust/summary/taint-sources]

‎rust/ql/test/library-tests/dataflow/taint/TaintFlowStep.expected

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
| file://:0:0:0:0 | [summary param] 0 in lang:alloc::_::crate::fmt::format | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::crate::fmt::format | MaD:24 |
2-
| file://:0:0:0:0 | [summary param] self in lang:alloc::_::<crate::string::String>::as_str | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::<crate::string::String>::as_str | MaD:22 |
3-
| file://:0:0:0:0 | [summary param] self in repo:https://github.com/seanmonstar/reqwest:reqwest::_::<crate::blocking::response::Response>::text | file://:0:0:0:0 | [summary] to write: ReturnValue.Variant[crate::result::Result::Ok(0)] in repo:https://github.com/seanmonstar/reqwest:reqwest::_::<crate::blocking::response::Response>::text | MaD:10 |
1+
| file://:0:0:0:0 | [summary param] 0 in lang:alloc::_::crate::fmt::format | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::crate::fmt::format | MaD:35 |
2+
| file://:0:0:0:0 | [summary param] self in lang:alloc::_::<crate::string::String>::as_str | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::<crate::string::String>::as_str | MaD:33 |
3+
| file://:0:0:0:0 | [summary param] self in repo:https://github.com/seanmonstar/reqwest:reqwest::_::<crate::blocking::response::Response>::text | file://:0:0:0:0 | [summary] to write: ReturnValue.Variant[crate::result::Result::Ok(0)] in repo:https://github.com/seanmonstar/reqwest:reqwest::_::<crate::blocking::response::Response>::text | MaD:12 |
44
| main.rs:4:5:4:8 | 1000 | main.rs:4:5:4:12 | ... + ... | |
55
| main.rs:4:12:4:12 | i | main.rs:4:5:4:12 | ... + ... | |
66
| main.rs:8:20:8:20 | s | main.rs:8:14:8:20 | FormatArgsExpr | |

0 commit comments

Comments
 (0)