Skip to content

Commit 26aa938

Browse files
paldepindpaldepind
authored
Merge pull request #20452 from paldepind/rust/mad-source-parameter
Rust, shared: Support `Parameter` in source MaD models
2 parents 2e8091f + 1183e50 commit 26aa938

File tree

23 files changed

+998
-684
lines changed

23 files changed

+998
-684
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,9 @@ private module StepsInput implements Impl::Private::StepsInputSig {
104104
result.getStaticCallTarget().getUnderlyingCallable() = sc
105105
}
106106

107-
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
107+
DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
108+
109+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
108110

109111
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
110112
}

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ private module TypesInput implements Impl::Private::TypesInputSig {
183183
)
184184
}
185185

186-
DataFlowType getSourceType(Input::SourceBase source, Impl::Private::SummaryComponent sc) {
186+
DataFlowType getSourceType(Input::SourceBase source, Impl::Private::SummaryComponentStack s) {
187187
none()
188188
}
189189

@@ -195,7 +195,9 @@ private module StepsInput implements Impl::Private::StepsInputSig {
195195
sc = viableCallable(result).asSummarizedCallable()
196196
}
197197

198-
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
198+
DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
199+
200+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
199201

200202
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
201203
}

‎go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,9 @@ private module StepsInput implements Impl::Private::StepsInputSig {
117117
)
118118
}
119119

120-
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
120+
DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
121+
122+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
121123

122124
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
123125
}

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ private module TypesInput implements Impl::Private::TypesInputSig {
132132
exists(rk)
133133
}
134134

135-
DataFlowType getSourceType(Input::SourceBase source, Impl::Private::SummaryComponent sc) {
135+
DataFlowType getSourceType(Input::SourceBase source, Impl::Private::SummaryComponentStack s) {
136136
none()
137137
}
138138

@@ -144,7 +144,9 @@ private module StepsInput implements Impl::Private::StepsInputSig {
144144
sc = viableCallable(result).asSummarizedCallable()
145145
}
146146

147-
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
147+
DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
148+
149+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
148150

149151
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
150152
}

‎javascript/ql/lib/semmle/javascript/dataflow/internal/FlowSummaryPrivate.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,9 @@ private module FlowSummaryStepInput implements Private::StepsInputSig {
150150
)
151151
}
152152

153-
DataFlow::Node getSourceNode(SourceBase source, Private::SummaryComponent sc) { none() }
153+
DataFlowCallable getSourceNodeEnclosingCallable(SourceBase source) { none() }
154+
155+
DataFlow::Node getSourceNode(SourceBase source, Private::SummaryComponentStack s) { none() }
154156

155157
DataFlow::Node getSinkNode(SinkBase sink, Private::SummaryComponent sc) { none() }
156158
}

‎python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,9 @@ private module StepsInput implements Impl::Private::StepsInputSig {
105105
])
106106
}
107107

108-
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
108+
DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
109+
110+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
109111

110112
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
111113
}

‎ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,9 @@ private module StepsInput implements Impl::Private::StepsInputSig {
161161
result.asCall().getAstNode() = sc.(LibraryCallable).getACallSimple()
162162
}
163163

164-
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) { none() }
164+
DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
165+
166+
Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
165167

166168
Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
167169
}

‎rust/ql/lib/change-notes/2025-09-19-parameter-mad.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
category: feature
3+
---
4+
* The models-as-data format for sources now supports access paths of the form
5+
`Argument[i].Parameter[j]`. This denotes that the source passes tainted data to
6+
the `j`th parameter of its `i`th argument (which must be a function or a
7+
closure).

‎rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -508,7 +508,8 @@ module RustDataFlow implements InputSig<Location> {
508508
*/
509509
predicate jumpStep(Node node1, Node node2) {
510510
FlowSummaryImpl::Private::Steps::summaryJumpStep(node1.(FlowSummaryNode).getSummaryNode(),
511-
node2.(FlowSummaryNode).getSummaryNode())
511+
node2.(FlowSummaryNode).getSummaryNode()) or
512+
FlowSummaryImpl::Private::Steps::sourceJumpStep(node1.(FlowSummaryNode).getSummaryNode(), node2)
512513
}
513514

514515
pragma[nomagic]

‎rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll‎

Lines changed: 38 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,10 @@ private import rust
66
private import codeql.dataflow.internal.FlowSummaryImpl
77
private import codeql.dataflow.internal.AccessPathSyntax as AccessPath
88
private import codeql.rust.dataflow.internal.DataFlowImpl
9+
private import codeql.rust.internal.PathResolution
910
private import codeql.rust.dataflow.FlowSummary
11+
private import codeql.rust.dataflow.Ssa
12+
private import codeql.rust.controlflow.CfgNodes
1013
private import Content
1114

1215
module Input implements InputSig<Location, RustDataFlow> {
@@ -133,16 +136,44 @@ private module StepsInput implements Impl::Private::StepsInputSig {
133136
result.asCallCfgNode().getCall().getStaticTarget() = sc
134137
}
135138

136-
RustDataFlow::Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponent sc) {
137-
sc = Impl::Private::SummaryComponent::return(_) and
139+
/** Gets the argument of `source` described by `sc`, if any. */
140+
private Expr getSourceNodeArgument(Input::SourceBase source, Impl::Private::SummaryComponent sc) {
141+
exists(ArgumentPosition pos |
142+
sc = Impl::Private::SummaryComponent::argument(pos) and
143+
result = pos.getArgument(source.getCall())
144+
)
145+
}
146+
147+
/** Get the callable that `expr` refers to. */
148+
private Callable getCallable(Expr expr) {
149+
result = resolvePath(expr.(PathExpr).getPath()).(Function)
150+
or
151+
result = expr.(ClosureExpr)
152+
or
153+
// The expression is an SSA read of an assignment of a closure
154+
exists(Ssa::Definition def, ExprCfgNode value |
155+
def.getARead().getAstNode() = expr and
156+
def.getAnUltimateDefinition().(Ssa::WriteDefinition).assigns(value) and
157+
result = value.getExpr().(ClosureExpr)
158+
)
159+
}
160+
161+
RustDataFlow::DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) {
162+
result.asCfgScope() = source.getEnclosingCfgScope()
163+
}
164+
165+
RustDataFlow::Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) {
166+
s.head() = Impl::Private::SummaryComponent::return(_) and
138167
result.asExpr().getExpr() = source.getCall()
139168
or
140-
exists(CallExprBase call, Expr arg, ArgumentPosition pos |
141-
result.(RustDataFlow::PostUpdateNode).getPreUpdateNode().asExpr().getExpr() = arg and
142-
sc = Impl::Private::SummaryComponent::argument(pos) and
143-
call = source.getCall() and
144-
arg = pos.getArgument(call)
169+
exists(ArgumentPosition pos, Expr arg |
170+
s.head() = Impl::Private::SummaryComponent::parameter(pos) and
171+
arg = getSourceNodeArgument(source, s.tail().headOfSingleton()) and
172+
result.asParameter() = getCallable(arg).getParam(pos.getPosition())
145173
)
174+
or
175+
result.(RustDataFlow::PostUpdateNode).getPreUpdateNode().asExpr().getExpr() =
176+
getSourceNodeArgument(source, s.headOfSingleton())
146177
}
147178

148179
RustDataFlow::Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) {

0 commit comments

Comments
 (0)