Skip to content

Rust: Diff-informed queries: phase 3 (non-trivial locations) #20081

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Rust: Diff-informed queries: phase 3 (non-trivial locations) #20081

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
7358115
[DIFF-INFORMED] Rust: RegexInjection
d10c Jul 16, 2025
7601eea
[DIFF-INFORMED] Rust: TaintedPath
d10c Jul 16, 2025
277e3ce
[DIFF-INFORMED] Rust: SqlInjection
d10c Jul 16, 2025
e047cb2
[DIFF-INFORMED] Rust: CleartextTransmission
d10c Jul 16, 2025
8f8fe1d
[DIFF-INFORMED] Rust: CleartextLogging
d10c Jul 16, 2025
f103293
[DIFF-INFORMED] Rust: UncontrolledAllocationSize
d10c Jul 16, 2025
4c071cd
[DIFF-INFORMED] Rust: AccessAfterLifetime
d10c Jul 16, 2025
276effe
[DIFF-INFORMED] Rust: AccessInvalidPointer
d10c Jul 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions rust/ql/src/queries/security/CWE-020/RegexInjection.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ module RegexInjectionConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
any(AdditionalFlowStep s).step(nodeFrom, nodeTo)
}

predicate observeDiffInformedIncrementalMode() { any() }
}

/**
Expand Down
2 changes: 2 additions & 0 deletions rust/ql/src/queries/security/CWE-022/TaintedPath.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,8 @@ module TaintedPathConfig implements DataFlow::StateConfigSig {
stateFrom instanceof NotNormalized and
stateTo instanceof NormalizedUnchecked
}

predicate observeDiffInformedIncrementalMode() { any() }
}

module TaintedPathFlow = TaintTracking::GlobalWithState<TaintedPathConfig>;
Expand Down
2 changes: 2 additions & 0 deletions rust/ql/src/queries/security/CWE-089/SqlInjection.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node node) { node instanceof Sink }

predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }

predicate observeDiffInformedIncrementalMode() { any() }
}

module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;
Expand Down
2 changes: 2 additions & 0 deletions rust/ql/src/queries/security/CWE-311/CleartextTransmission.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,8 @@ module CleartextTransmissionConfig implements DataFlow::ConfigSig {
// make sources barriers so that we only report the closest instance
isSource(node)
}

predicate observeDiffInformedIncrementalMode() { any() }
}

module CleartextTransmissionFlow = TaintTracking::Global<CleartextTransmissionConfig>;
Expand Down
2 changes: 2 additions & 0 deletions rust/ql/src/queries/security/CWE-312/CleartextLogging.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@ module CleartextLoggingConfig implements DataFlow::ConfigSig {
isSink(node) and
c.getAReadContent() instanceof DataFlow::TuplePositionContent
}

predicate observeDiffInformedIncrementalMode() { any() }
}

module CleartextLoggingFlow = TaintTracking::Global<CleartextLoggingConfig>;
Expand Down
2 changes: 2 additions & 0 deletions rust/ql/src/queries/security/CWE-770/UncontrolledAllocationSize.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ module UncontrolledAllocationConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }

predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }

predicate observeDiffInformedIncrementalMode() { any() }
}

module UncontrolledAllocationFlow = TaintTracking::Global<UncontrolledAllocationConfig>;
Expand Down
9 changes: 9 additions & 0 deletions rust/ql/src/queries/security/CWE-825/AccessAfterLifetime.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,15 @@ module AccessAfterLifetimeConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node node) { node instanceof AccessAfterLifetime::Sink }

predicate isBarrier(DataFlow::Node barrier) { barrier instanceof AccessAfterLifetime::Barrier }

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) {
exists(Variable target, DataFlow::Node sink | result = target.getLocation() |
isSink(sink) and
AccessAfterLifetime::dereferenceAfterLifetime(source, sink, target)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this not check the flowPath exists as well?

I guess it may not be required for correctness actually ... but dereferenceAfterLifetime is bindingset[source, sink] for performance reasons, I'm a little bit concerned that not checking the flowPath here may greatly increase the amount we compute for it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, we can't check flowPath because that would lead to non-monotonic recursion (getASelected…Location is negated somewhere in flowPath).

DCA shows a slight (probably within noise range) increase in neon-empty-diff, so it's possible this has a negative impact.

Maybe an alternative is to include the rest of the clauses from the where, which might reduce the search space before calling dereferenceAfterLifetime.

)
}
}

module AccessAfterLifetimeFlow = TaintTracking::Global<AccessAfterLifetimeConfig>;
Expand Down
2 changes: 2 additions & 0 deletions rust/ql/src/queries/security/CWE-825/AccessInvalidPointer.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ module AccessInvalidPointerConfig implements DataFlow::ConfigSig {
// make sinks barriers so that we only report the closest instance
isSink(node)
}

predicate observeDiffInformedIncrementalMode() { any() }
}

module AccessInvalidPointerFlow = TaintTracking::Global<AccessInvalidPointerConfig>;
Expand Down