Rust: Add flow models for io.

geoffw0 · geoffw0 · commit 24bcd041b882 · 2025-04-14T14:20:45.000+01:00
diff --git a/rust/ql/lib/codeql/rust/frameworks/stdlib/io.model.yml b/rust/ql/lib/codeql/rust/frameworks/stdlib/io.model.yml
@@ -4,3 +4,35 @@ extensions:
       extensible: sourceModel
     data:
       - ["lang:std", "crate::io::stdio::stdin", "ReturnValue", "stdin", "manual"]
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: summaryModel
+    data:
+      - ["lang:std", "<crate::io::buffered::bufreader::BufReader>::new", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["lang:std", "<crate::io::buffered::bufreader::BufReader as crate::io::BufRead>::fill_buf", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
+      - ["lang:std", "<crate::io::buffered::bufreader::BufReader>::buffer", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["lang:std", "<crate::io::stdio::Stdin as crate::io::Read>::read", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "<crate::io::stdio::StdinLock as crate::io::Read>::read", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "<crate::fs::File as crate::io::Read>::read", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "crate::io::Read::read", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "<crate::io::stdio::Stdin as crate::io::Read>::read_to_string", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "<crate::io::stdio::StdinLock as crate::io::Read>::read_to_string", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "<crate::fs::File as crate::io::Read>::read_to_string", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "crate::io::Read::read_to_string", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", ":<crate::io::stdio::Stdin as crate::io::Read>::read_to_end", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", ":<crate::io::stdio::StdinLock as crate::io::Read>::read_to_end", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "<crate::fs::File as crate::io::Read>::read_to_end", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "crate::io::Read::read_to_end", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "<crate::io::stdio::Stdin as crate::io::Read>::read_exact", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "<crate::io::stdio::StdinLock as crate::io::Read>::read_exact", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "<crate::fs::File as crate::io::Read>::read_exact", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "crate::io::Read::read_exact", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "crate::io::BufRead::read_line", "Argument[self]", "Argument[0].Reference", "taint", "manual"]
+      - ["lang:std", "crate::io::BufRead::read_until", "Argument[self]", "Argument[1].Reference", "taint", "manual"]
+      - ["lang:std", "crate::io::BufRead::split", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["lang:std", "crate::io::BufRead::lines", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["lang:std", "crate::io::Read::bytes", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["lang:std", "crate::io::Read::chain", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["lang:std", "crate::io::Read::chain", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["lang:std", "crate::io::Read::take", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["lang:std", "<crate::io::stdio::Stdin>::lock", "Argument[self]", "ReturnValue", "taint", "manual"]
diff --git a/rust/ql/test/library-tests/dataflow/sources/test.rs b/rust/ql/test/library-tests/dataflow/sources/test.rs
@@ -241,7 +241,7 @@ fn test_io_fs() -> std::io::Result<()> {
     {
         let mut buffer = [0u8; 100];
         let _bytes = std::io::stdin().read(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow
     }
 
     {
@@ -253,17 +253,17 @@ fn test_io_fs() -> std::io::Result<()> {
     {
         let mut buffer = String::new();
         let _bytes = std::io::stdin().read_to_string(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow
     }
 
     {
         let mut buffer = [0; 100];
         std::io::stdin().read_exact(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow
     }
 
     for byte in std::io::stdin().bytes() { // $ Alert[rust/summary/taint-sources]
-        sink(byte); // $ MISSING: hasTaintFlow
+        sink(byte); // $ hasTaintFlow
     }
 
     // --- file ---
@@ -273,57 +273,57 @@ fn test_io_fs() -> std::io::Result<()> {
     {
         let mut buffer = [0u8; 100];
         let _bytes = file.read(&mut buffer)?;
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow="file.txt"
     }
 
     {
         let mut buffer = Vec::<u8>::new();
         let _bytes = file.read_to_end(&mut buffer)?;
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow="file.txt"
     }
 
     {
         let mut buffer = String::new();
         let _bytes = file.read_to_string(&mut buffer)?;
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow="file.txt"
     }
 
     {
         let mut buffer = [0; 100];
         file.read_exact(&mut buffer)?;
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow="file.txt"
     }
 
     for byte in file.bytes() {
-        sink(byte); // $ MISSING: hasTaintFlow
+        sink(byte); // $ hasTaintFlow="file.txt"
     }
 
     // --- BufReader ---
 
     {
         let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
         let data = reader.fill_buf()?;
-        sink(&data); // $ MISSING: hasTaintFlow
+        sink(&data); // $ hasTaintFlow
     }
 
     {
         let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
         let data = reader.buffer();
-        sink(&data); // $ MISSING: hasTaintFlow
+        sink(&data); // $ hasTaintFlow
     }
 
     {
         let mut buffer = String::new();
         let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
         reader.read_line(&mut buffer)?;
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow
     }
 
     {
         let mut buffer = Vec::<u8>::new();
         let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
         reader.read_until(b',', &mut buffer)?;
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow
     }
 
     {
@@ -337,7 +337,7 @@ fn test_io_fs() -> std::io::Result<()> {
     {
         let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
         for line in reader.lines() {
-            sink(line); // $ MISSING: Alert[rust/summary/taint-sources]
+            sink(line); // $ hasTaintFlow
         }
     }
 
@@ -361,21 +361,21 @@ fn test_io_fs() -> std::io::Result<()> {
         let mut file2 = std::fs::File::open("another_file.txt")?; // $ Alert[rust/summary/taint-sources]
         let mut reader = file1.chain(file2);
         reader.read_to_string(&mut buffer)?;
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow="file.txt" hasTaintFlow="another_file.txt"
     }
 
     {
         let mut buffer = String::new();
         let mut file1 = std::fs::File::open("file.txt")?; // $ Alert[rust/summary/taint-sources]
         let mut reader = file1.take(100);
         reader.read_to_string(&mut buffer)?;
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow="file.txt"
     }
 
     {
         let mut buffer = String::new();
         let _bytes = std::io::stdin().lock().read_to_string(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
-        sink(&buffer); // $ MISSING: hasTaintFlow
+        sink(&buffer); // $ hasTaintFlow
     }
 
     Ok(())

Original file line number	Diff line number	Diff line change
`@@ -241,7 +241,7 @@ fn test_io_fs() -> std::io::Result<()> {`
`241`	`241`	`{`
`242`	`242`	`let mut buffer = [0u8; 100];`
`243`	`243`	`let _bytes = std::io::stdin().read(&mut buffer)?; // $ Alert[rust/summary/taint-sources]`
`244`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`244`	`+ sink(&buffer); // $ hasTaintFlow`
`245`	`245`	`}`
`246`	`246`
`247`	`247`	`{`
`@@ -253,17 +253,17 @@ fn test_io_fs() -> std::io::Result<()> {`
`253`	`253`	`{`
`254`	`254`	`let mut buffer = String::new();`
`255`	`255`	`let _bytes = std::io::stdin().read_to_string(&mut buffer)?; // $ Alert[rust/summary/taint-sources]`
`256`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`256`	`+ sink(&buffer); // $ hasTaintFlow`
`257`	`257`	`}`
`258`	`258`
`259`	`259`	`{`
`260`	`260`	`let mut buffer = [0; 100];`
`261`	`261`	`std::io::stdin().read_exact(&mut buffer)?; // $ Alert[rust/summary/taint-sources]`
`262`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`262`	`+ sink(&buffer); // $ hasTaintFlow`
`263`	`263`	`}`
`264`	`264`
`265`	`265`	`for byte in std::io::stdin().bytes() { // $ Alert[rust/summary/taint-sources]`
`266`		`- sink(byte); // $ MISSING: hasTaintFlow`
	`266`	`+ sink(byte); // $ hasTaintFlow`
`267`	`267`	`}`
`268`	`268`
`269`	`269`	`// --- file ---`
`@@ -273,57 +273,57 @@ fn test_io_fs() -> std::io::Result<()> {`
`273`	`273`	`{`
`274`	`274`	`let mut buffer = [0u8; 100];`
`275`	`275`	`let _bytes = file.read(&mut buffer)?;`
`276`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`276`	`+ sink(&buffer); // $ hasTaintFlow="file.txt"`
`277`	`277`	`}`
`278`	`278`
`279`	`279`	`{`
`280`	`280`	`let mut buffer = Vec::<u8>::new();`
`281`	`281`	`let _bytes = file.read_to_end(&mut buffer)?;`
`282`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`282`	`+ sink(&buffer); // $ hasTaintFlow="file.txt"`
`283`	`283`	`}`
`284`	`284`
`285`	`285`	`{`
`286`	`286`	`let mut buffer = String::new();`
`287`	`287`	`let _bytes = file.read_to_string(&mut buffer)?;`
`288`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`288`	`+ sink(&buffer); // $ hasTaintFlow="file.txt"`
`289`	`289`	`}`
`290`	`290`
`291`	`291`	`{`
`292`	`292`	`let mut buffer = [0; 100];`
`293`	`293`	`file.read_exact(&mut buffer)?;`
`294`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`294`	`+ sink(&buffer); // $ hasTaintFlow="file.txt"`
`295`	`295`	`}`
`296`	`296`
`297`	`297`	`for byte in file.bytes() {`
`298`		`- sink(byte); // $ MISSING: hasTaintFlow`
	`298`	`+ sink(byte); // $ hasTaintFlow="file.txt"`
`299`	`299`	`}`
`300`	`300`
`301`	`301`	`// --- BufReader ---`
`302`	`302`
`303`	`303`	`{`
`304`	`304`	`let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]`
`305`	`305`	`let data = reader.fill_buf()?;`
`306`		`- sink(&data); // $ MISSING: hasTaintFlow`
	`306`	`+ sink(&data); // $ hasTaintFlow`
`307`	`307`	`}`
`308`	`308`
`309`	`309`	`{`
`310`	`310`	`let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]`
`311`	`311`	`let data = reader.buffer();`
`312`		`- sink(&data); // $ MISSING: hasTaintFlow`
	`312`	`+ sink(&data); // $ hasTaintFlow`
`313`	`313`	`}`
`314`	`314`
`315`	`315`	`{`
`316`	`316`	`let mut buffer = String::new();`
`317`	`317`	`let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]`
`318`	`318`	`reader.read_line(&mut buffer)?;`
`319`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`319`	`+ sink(&buffer); // $ hasTaintFlow`
`320`	`320`	`}`
`321`	`321`
`322`	`322`	`{`
`323`	`323`	`let mut buffer = Vec::<u8>::new();`
`324`	`324`	`let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]`
`325`	`325`	`reader.read_until(b',', &mut buffer)?;`
`326`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`326`	`+ sink(&buffer); // $ hasTaintFlow`
`327`	`327`	`}`
`328`	`328`
`329`	`329`	`{`
`@@ -337,7 +337,7 @@ fn test_io_fs() -> std::io::Result<()> {`
`337`	`337`	`{`
`338`	`338`	`let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]`
`339`	`339`	`for line in reader.lines() {`
`340`		`- sink(line); // $ MISSING: Alert[rust/summary/taint-sources]`
	`340`	`+ sink(line); // $ hasTaintFlow`
`341`	`341`	`}`
`342`	`342`	`}`
`343`	`343`
`@@ -361,21 +361,21 @@ fn test_io_fs() -> std::io::Result<()> {`
`361`	`361`	`let mut file2 = std::fs::File::open("another_file.txt")?; // $ Alert[rust/summary/taint-sources]`
`362`	`362`	`let mut reader = file1.chain(file2);`
`363`	`363`	`reader.read_to_string(&mut buffer)?;`
`364`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`364`	`+ sink(&buffer); // $ hasTaintFlow="file.txt" hasTaintFlow="another_file.txt"`
`365`	`365`	`}`
`366`	`366`
`367`	`367`	`{`
`368`	`368`	`let mut buffer = String::new();`
`369`	`369`	`let mut file1 = std::fs::File::open("file.txt")?; // $ Alert[rust/summary/taint-sources]`
`370`	`370`	`let mut reader = file1.take(100);`
`371`	`371`	`reader.read_to_string(&mut buffer)?;`
`372`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`372`	`+ sink(&buffer); // $ hasTaintFlow="file.txt"`
`373`	`373`	`}`
`374`	`374`
`375`	`375`	`{`
`376`	`376`	`let mut buffer = String::new();`
`377`	`377`	`let _bytes = std::io::stdin().lock().read_to_string(&mut buffer)?; // $ Alert[rust/summary/taint-sources]`
`378`		`- sink(&buffer); // $ MISSING: hasTaintFlow`
	`378`	`+ sink(&buffer); // $ hasTaintFlow`
`379`	`379`	`}`
`380`	`380`
`381`	`381`	`Ok(())`