Rust: Add support for resolving methods from blanket implementations

paldepind · paldepind · commit 29ba0135803b · 2025-09-12T15:34:04.000+02:00
diff --git a/rust/ql/lib/codeql/rust/internal/PathResolution.qll b/rust/ql/lib/codeql/rust/internal/PathResolution.qll
@@ -1006,6 +1006,14 @@ final class TypeParamItemNode extends TypeItemNode instanceof TypeParam {
   Path getABoundPath() { result = this.getTypeBoundAt(_, _).getTypeRepr().(PathTypeRepr).getPath() }
 
   pragma[nomagic]
+  ItemNode resolveBound(int index) {
+    result =
+      rank[index + 1](int i, int j |
+        |
+        resolvePath(this.getTypeBoundAt(i, j).getTypeRepr().(PathTypeRepr).getPath()) order by i, j
+      )
+  }
+
   ItemNode resolveABound() { result = resolvePath(this.getABoundPath()) }
 
   /**
diff --git a/rust/ql/lib/codeql/rust/internal/TypeInference.qll b/rust/ql/lib/codeql/rust/internal/TypeInference.qll
@@ -1915,6 +1915,10 @@ private predicate methodCandidateTrait(Type type, Trait trait, string name, int
   methodCandidate(type, name, arity, impl)
 }
 
+/**
+ * Holds if `mc` has `rootType` as the root type of the reciever and the target
+ * method is named `name` and has arity `arity`
+ */
 pragma[nomagic]
 private predicate isMethodCall(MethodCall mc, Type rootType, string name, int arity) {
   rootType = mc.getTypeAt(TypePath::nil()) and
@@ -2153,6 +2157,155 @@ private predicate methodCallHasImplCandidate(MethodCall mc, Impl impl) {
   else any()
 }
 
+private module BlanketImplementation {
+  /**
+   * Gets the type parameter for which `impl` is a blanket implementation, if
+   * any.
+   */
+  private TypeParamItemNode getBlanketImplementationTypeParam(Impl impl) {
+    result = impl.(ImplItemNode).resolveSelfTy() and
+    result = impl.getGenericParamList().getAGenericParam() and
+    // This impl block is not superseded by the expansion of an attribute macro.
+    not exists(impl.getAttributeMacroExpansion())
+  }
+
+  predicate isBlanketImplementation(Impl impl) { exists(getBlanketImplementationTypeParam(impl)) }
+
+  private Impl getPotentialDuplicated(string fileName, string traitName, int arity, string tpName) {
+    tpName = getBlanketImplementationTypeParam(result).getName() and
+    fileName = result.getLocation().getFile().getBaseName() and
+    traitName = result.(ImplItemNode).resolveTraitTy().getName() and
+    arity = result.(ImplItemNode).resolveTraitTy().(Trait).getNumberOfGenericParams()
+  }
+
+  /**
+   * Holds if `impl1` and `impl2` are duplicates and `impl2` is strictly more
+   * "canonical" than `impl1`.
+   *
+   * Libraries can often occur several times in the database for different
+   * library versions. This causes the same blanket implementations to exist
+   * multiple times, and these add no useful information.
+   *
+   * We detect these duplicates based on some simple heuristics (same trait
+   * name, file name, etc.). For these duplicates we select the one with the
+   * greatest file name (which usually is also the one with the greatest library
+   * version in the path)
+   */
+  predicate duplicatedImpl(Impl impl1, Impl impl2) {
+    exists(string fileName, string traitName, int arity, string tpName |
+      impl1 = getPotentialDuplicated(fileName, traitName, arity, tpName) and
+      impl2 = getPotentialDuplicated(fileName, traitName, arity, tpName) and
+      impl1.getLocation().getFile().getAbsolutePath() <
+        impl2.getLocation().getFile().getAbsolutePath()
+    )
+  }
+
+  predicate isCanonicalImpl(Impl impl) {
+    not duplicatedImpl(impl, _) and isBlanketImplementation(impl)
+  }
+
+  Impl getCanonicalImpl(Impl impl) {
+    result =
+      max(Impl impl0, Location l |
+        duplicatedImpl(impl, impl0) and l = impl0.getLocation()
+      |
+        impl0 order by l.getFile().getAbsolutePath(), l.getStartLine()
+      )
+    or
+    isCanonicalImpl(impl) and result = impl
+  }
+
+  predicate isCanonicalBlanketImplementation(Impl impl) { impl = getCanonicalImpl(impl) }
+
+  /**
+   * Holds if `impl` is a blanket implementation for a type parameter and the type
+   * parameter must implement `trait`.
+   */
+  private predicate blanketImplementationTraitBound(Impl impl, Trait t) {
+    t =
+      min(Trait trait, int i |
+        trait = getBlanketImplementationTypeParam(impl).resolveBound(i) and
+        // Exclude traits that are known to not narrow things down very much.
+        not trait.getName().getText() =
+          [
+            "Sized", "Clone",
+            // The auto traits
+            "Send", "Sync", "Unpin", "UnwindSafe", "RefUnwindSafe"
+          ]
+      |
+        trait order by i
+      )
+  }
+
+  /**
+   * Holds if `impl` is a relevant blanket implementation that requires the
+   * trait `trait` and provides `f`, a method with name `name` and arity
+   * `arity`.
+   */
+  private predicate blanketImplementationMethod(
+    ImplItemNode impl, Trait trait, string name, int arity, Function f
+  ) {
+    isCanonicalBlanketImplementation(impl) and
+    blanketImplementationTraitBound(impl, trait) and
+    f.getParamList().hasSelfParam() and
+    arity = f.getParamList().getNumberOfParams() and
+    (
+      f = impl.getAssocItem(name)
+      or
+      // If the trait has a method with a default implementation, then that
+      // target is interesting as well.
+      not exists(impl.getAssocItem(name)) and
+      f = impl.resolveTraitTy().getAssocItem(name)
+    ) and
+    // If the method is already available through one of the trait bounds on the
+    // type parameter (because they share a common ancestor trait) then ignore
+    // it.
+    not getBlanketImplementationTypeParam(impl).resolveABound().(TraitItemNode).getASuccessor(name) =
+      f
+  }
+
+  predicate methodCallMatchesBlanketImpl(MethodCall mc, Type t, Impl impl, Trait trait, Function f) {
+    // Only check method calls where we have ruled out inherent method targets.
+    // Ideally we would also check if non-blanket method targets have been ruled
+    // out.
+    methodCallHasNoInherentTarget(mc) and
+    exists(string name, int arity |
+      isMethodCall(mc, t, name, arity) and
+      blanketImplementationMethod(impl, trait, name, arity, f)
+    )
+  }
+
+  private predicate relevantTraitVisible(Element mc, Trait trait) {
+    exists(ImplItemNode impl |
+      methodCallMatchesBlanketImpl(mc, _, impl, _, _) and
+      trait = impl.resolveTraitTy()
+    )
+  }
+
+  module SatisfiesConstraintInput implements SatisfiesConstraintInputSig<MethodCall> {
+    pragma[nomagic]
+    predicate relevantConstraint(MethodCall mc, Type constraint) {
+      exists(Trait trait, Trait trait2, ImplItemNode impl |
+        methodCallMatchesBlanketImpl(mc, _, impl, trait, _) and
+        TraitIsVisible<relevantTraitVisible/2>::traitIsVisible(mc, pragma[only_bind_into](trait2)) and
+        trait2 = pragma[only_bind_into](impl.resolveTraitTy()) and
+        trait = constraint.(TraitType).getTrait()
+      )
+    }
+
+    predicate useUniversalConditions() { none() }
+  }
+
+  predicate hasBlanketImpl(MethodCall mc, Type t, Impl impl, Trait trait, Function f) {
+    SatisfiesConstraint<MethodCall, SatisfiesConstraintInput>::satisfiesConstraintType(mc,
+      TTrait(trait), _, _) and
+    methodCallMatchesBlanketImpl(mc, t, impl, trait, f)
+  }
+
+  pragma[nomagic]
+  Function getMethodFromBlanketImpl(MethodCall mc) { hasBlanketImpl(mc, _, _, _, result) }
+}
+
 /** Gets a method from an `impl` block that matches the method call `mc`. */
 pragma[nomagic]
 private Function getMethodFromImpl(MethodCall mc) {
@@ -2188,6 +2341,8 @@ private Function resolveMethodCallTarget(MethodCall mc) {
   // The method comes from an `impl` block targeting the type of the receiver.
   result = getMethodFromImpl(mc)
   or
+  result = BlanketImplementation::getMethodFromBlanketImpl(mc)
+  or
   // The type of the receiver is a type parameter and the method comes from a
   // trait bound on the type parameter.
   result = getTypeParameterMethod(mc.getTypeAt(TypePath::nil()), mc.getMethodName())
diff --git a/rust/ql/test/library-tests/type-inference/blanket_impl.rs b/rust/ql/test/library-tests/type-inference/blanket_impl.rs
@@ -32,7 +32,7 @@ mod basic_blanket_impl {
     pub fn test_basic_blanket() {
         let x = S1.clone1(); // $ target=S1::clone1
         println!("{x:?}");
-        let y = S1.duplicate(); // $ MISSING: target=Clone1duplicate
+        let y = S1.duplicate(); // $ target=Clone1duplicate
         println!("{y:?}");
     }
 }
@@ -109,7 +109,7 @@ mod extension_trait_blanket_impl {
 
     fn test() {
         let my_try_flag = MyTryFlag { flag: true };
-        let result = my_try_flag.try_read_flag_twice(); // $ MISSING: target=TryFlagExt::try_read_flag_twice
+        let result = my_try_flag.try_read_flag_twice(); // $ target=TryFlagExt::try_read_flag_twice
 
         let my_flag = MyFlag { flag: true };
         // Here `TryFlagExt::try_read_flag_twice` is since there is a blanket
@@ -150,11 +150,11 @@ pub mod sql_exec {
     pub fn f() {
         let c = MySqlConnection {}; // $ certainType=c:MySqlConnection
 
-        c.execute1(); // $ MISSING: target=execute1
+        c.execute1(); // $ target=execute1
         MySqlConnection::execute1(&c); // $ MISSING: target=execute1
 
-        c.execute2("SELECT * FROM users"); // $ MISSING: target=execute2
-        c.execute2::<&str>("SELECT * FROM users"); // $ MISSING: target=execute2
+        c.execute2("SELECT * FROM users"); // $ target=execute2
+        c.execute2::<&str>("SELECT * FROM users"); // $ target=execute2
         MySqlConnection::execute2(&c, "SELECT * FROM users"); // $ MISSING: target=execute2
         MySqlConnection::execute2::<&str>(&c, "SELECT * FROM users"); // $ MISSING: target=execute2
     }
diff --git a/rust/ql/test/library-tests/type-inference/dyn_type.rs b/rust/ql/test/library-tests/type-inference/dyn_type.rs
@@ -101,7 +101,7 @@ fn test_assoc_type(obj: &dyn AssocTrait<i64, AP = bool>) {
 pub fn test() {
     test_basic_dyn_trait(&MyStruct { value: 42 }); // $ target=test_basic_dyn_trait
     test_generic_dyn_trait(&GenStruct {
-        value: "".to_string(),
+        value: "".to_string(), // $ target=to_string
     }); // $ target=test_generic_dyn_trait
     test_poly_dyn_trait(); // $ target=test_poly_dyn_trait
     test_assoc_type(&GenStruct { value: 100 }); // $ target=test_assoc_type
diff --git a/rust/ql/test/library-tests/type-inference/main.rs b/rust/ql/test/library-tests/type-inference/main.rs
@@ -365,7 +365,7 @@ mod method_non_parametric_trait_impl {
 
     fn type_bound_type_parameter_impl<TP: MyTrait<S1>>(thing: TP) -> S1 {
         // The trait bound on `TP` makes the implementation of `ConvertTo` valid
-        thing.convert_to() // $ MISSING: target=T::convert_to
+        thing.convert_to() // $ target=T::convert_to
     }
 
     pub fn f() {
@@ -437,7 +437,7 @@ mod method_non_parametric_trait_impl {
         let x = get_snd_fst(c); // $ type=x:S1 target=get_snd_fst
 
         let thing = MyThing { a: S1 };
-        let i = thing.convert_to(); // $ MISSING: type=i:S1 target=T::convert_to
+        let i = thing.convert_to(); // $ type=i:S1 target=T::convert_to
         let j = convert_to(thing); // $ type=j:S1 target=convert_to
     }
 }
@@ -1376,7 +1376,7 @@ mod method_call_type_conversion {
         let t = x7.m1(); // $ target=m1 type=t:& type=t:&T.S2
         println!("{:?}", x7);
 
-        let x9: String = "Hello".to_string(); // $ certainType=x9:String
+        let x9: String = "Hello".to_string(); // $ certainType=x9:String target=to_string
 
         // Implicit `String` -> `str` conversion happens via the `Deref` trait:
         // https://doc.rust-lang.org/std/string/struct.String.html#deref.
diff --git a/rust/ql/test/library-tests/type-inference/type-inference.expected b/rust/ql/test/library-tests/type-inference/type-inference.expected
@@ -23,11 +23,14 @@ inferType
 | blanket_impl.rs:34:18:34:24 | FormatArgsExpr |  | {EXTERNAL LOCATION} | Arguments |
 | blanket_impl.rs:34:18:34:24 | MacroExpr |  | {EXTERNAL LOCATION} | Arguments |
 | blanket_impl.rs:34:20:34:20 | x |  | blanket_impl.rs:4:5:5:14 | S1 |
+| blanket_impl.rs:35:13:35:13 | y |  | blanket_impl.rs:4:5:5:14 | S1 |
 | blanket_impl.rs:35:17:35:18 | S1 |  | blanket_impl.rs:4:5:5:14 | S1 |
+| blanket_impl.rs:35:17:35:30 | S1.duplicate() |  | blanket_impl.rs:4:5:5:14 | S1 |
 | blanket_impl.rs:36:18:36:24 | "{y:?}\\n" |  | file://:0:0:0:0 | & |
 | blanket_impl.rs:36:18:36:24 | "{y:?}\\n" | &T | {EXTERNAL LOCATION} | str |
 | blanket_impl.rs:36:18:36:24 | FormatArgsExpr |  | {EXTERNAL LOCATION} | Arguments |
 | blanket_impl.rs:36:18:36:24 | MacroExpr |  | {EXTERNAL LOCATION} | Arguments |
+| blanket_impl.rs:36:20:36:20 | y |  | blanket_impl.rs:4:5:5:14 | S1 |
 | blanket_impl.rs:47:22:47:26 | SelfParam |  | file://:0:0:0:0 | & |
 | blanket_impl.rs:47:22:47:26 | SelfParam | &T | blanket_impl.rs:46:5:48:5 | Self [trait Flag] |
 | blanket_impl.rs:51:26:51:30 | SelfParam |  | file://:0:0:0:0 | & |
@@ -78,7 +81,11 @@ inferType
 | blanket_impl.rs:111:13:111:23 | my_try_flag |  | blanket_impl.rs:77:5:79:5 | MyTryFlag |
 | blanket_impl.rs:111:27:111:50 | MyTryFlag {...} |  | blanket_impl.rs:77:5:79:5 | MyTryFlag |
 | blanket_impl.rs:111:45:111:48 | true |  | {EXTERNAL LOCATION} | bool |
+| blanket_impl.rs:112:13:112:18 | result |  | {EXTERNAL LOCATION} | Option |
+| blanket_impl.rs:112:13:112:18 | result | T | {EXTERNAL LOCATION} | bool |
 | blanket_impl.rs:112:22:112:32 | my_try_flag |  | blanket_impl.rs:77:5:79:5 | MyTryFlag |
+| blanket_impl.rs:112:22:112:54 | my_try_flag.try_read_flag_twice() |  | {EXTERNAL LOCATION} | Option |
+| blanket_impl.rs:112:22:112:54 | my_try_flag.try_read_flag_twice() | T | {EXTERNAL LOCATION} | bool |
 | blanket_impl.rs:114:13:114:19 | my_flag |  | blanket_impl.rs:88:5:90:5 | MyFlag |
 | blanket_impl.rs:114:23:114:43 | MyFlag {...} |  | blanket_impl.rs:88:5:90:5 | MyFlag |
 | blanket_impl.rs:114:38:114:41 | true |  | {EXTERNAL LOCATION} | bool |
@@ -756,10 +763,13 @@ inferType
 | dyn_type.rs:103:28:105:5 | &... |  | file://:0:0:0:0 | & |
 | dyn_type.rs:103:28:105:5 | &... | &T | dyn_type.rs:10:1:13:1 | dyn GenericGet |
 | dyn_type.rs:103:28:105:5 | &... | &T | dyn_type.rs:33:1:36:1 | GenStruct |
+| dyn_type.rs:103:28:105:5 | &... | &T.A | {EXTERNAL LOCATION} | String |
 | dyn_type.rs:103:28:105:5 | &... | &T.dyn(A) | {EXTERNAL LOCATION} | String |
 | dyn_type.rs:103:29:105:5 | GenStruct {...} |  | dyn_type.rs:33:1:36:1 | GenStruct |
+| dyn_type.rs:103:29:105:5 | GenStruct {...} | A | {EXTERNAL LOCATION} | String |
 | dyn_type.rs:104:16:104:17 | "" |  | file://:0:0:0:0 | & |
 | dyn_type.rs:104:16:104:17 | "" | &T | {EXTERNAL LOCATION} | str |
+| dyn_type.rs:104:16:104:29 | "".to_string() |  | {EXTERNAL LOCATION} | String |
 | dyn_type.rs:107:21:107:45 | &... |  | file://:0:0:0:0 | & |
 | dyn_type.rs:107:21:107:45 | &... | &T | dyn_type.rs:15:1:19:1 | dyn AssocTrait |
 | dyn_type.rs:107:21:107:45 | &... | &T | dyn_type.rs:33:1:36:1 | GenStruct |
@@ -1392,8 +1402,10 @@ inferType
 | main.rs:439:21:439:37 | MyThing {...} |  | main.rs:224:5:227:5 | MyThing |
 | main.rs:439:21:439:37 | MyThing {...} | A | main.rs:235:5:236:14 | S1 |
 | main.rs:439:34:439:35 | S1 |  | main.rs:235:5:236:14 | S1 |
+| main.rs:440:13:440:13 | i |  | main.rs:235:5:236:14 | S1 |
 | main.rs:440:17:440:21 | thing |  | main.rs:224:5:227:5 | MyThing |
 | main.rs:440:17:440:21 | thing | A | main.rs:235:5:236:14 | S1 |
+| main.rs:440:17:440:34 | thing.convert_to() |  | main.rs:235:5:236:14 | S1 |
 | main.rs:441:13:441:13 | j |  | main.rs:235:5:236:14 | S1 |
 | main.rs:441:17:441:33 | convert_to(...) |  | main.rs:235:5:236:14 | S1 |
 | main.rs:441:28:441:32 | thing |  | main.rs:224:5:227:5 | MyThing |
@@ -3319,14 +3331,22 @@ inferType
 | main.rs:1706:13:1709:13 | Vec2 {...} |  | main.rs:1586:5:1591:5 | Vec2 |
 | main.rs:1707:20:1707:23 | self |  | main.rs:1586:5:1591:5 | Vec2 |
 | main.rs:1707:20:1707:25 | self.x |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1707:20:1707:33 | ... \| ... |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1707:20:1707:33 | ... \| ... |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1707:20:1707:33 | ... \| ... | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1707:29:1707:31 | rhs |  | main.rs:1586:5:1591:5 | Vec2 |
+| main.rs:1707:29:1707:33 | rhs.x |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1707:29:1707:33 | rhs.x |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1707:29:1707:33 | rhs.x | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1708:20:1708:23 | self |  | main.rs:1586:5:1591:5 | Vec2 |
 | main.rs:1708:20:1708:25 | self.y |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1708:20:1708:33 | ... \| ... |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1708:20:1708:33 | ... \| ... |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1708:20:1708:33 | ... \| ... | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1708:29:1708:31 | rhs |  | main.rs:1586:5:1591:5 | Vec2 |
+| main.rs:1708:29:1708:33 | rhs.y |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1708:29:1708:33 | rhs.y |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1708:29:1708:33 | rhs.y | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1714:25:1714:33 | SelfParam |  | file://:0:0:0:0 | & |
 | main.rs:1714:25:1714:33 | SelfParam | &T | main.rs:1586:5:1591:5 | Vec2 |
 | main.rs:1714:36:1714:38 | rhs |  | main.rs:1586:5:1591:5 | Vec2 |
@@ -3664,9 +3684,13 @@ inferType
 | main.rs:1857:26:1857:30 | 33i64 |  | {EXTERNAL LOCATION} | i64 |
 | main.rs:1857:26:1857:38 | ... & ... |  | {EXTERNAL LOCATION} | i64 |
 | main.rs:1857:34:1857:38 | 34i64 |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1858:13:1858:21 | i64_bitor |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1858:13:1858:21 | i64_bitor |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1858:13:1858:21 | i64_bitor | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1858:25:1858:29 | 35i64 |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1858:25:1858:37 | ... \| ... |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1858:25:1858:37 | ... \| ... |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1858:25:1858:37 | ... \| ... | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1858:33:1858:37 | 36i64 |  | {EXTERNAL LOCATION} | i64 |
 | main.rs:1859:13:1859:22 | i64_bitxor |  | {EXTERNAL LOCATION} | i64 |
 | main.rs:1859:26:1859:30 | 37i64 |  | {EXTERNAL LOCATION} | i64 |
diff --git a/shared/typeinference/codeql/typeinference/internal/TypeInference.qll b/shared/typeinference/codeql/typeinference/internal/TypeInference.qll
@@ -919,6 +919,15 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
     signature module SatisfiesConstraintInputSig<HasTypeTreeSig HasTypeTree> {
       /** Holds if it is relevant to know if `term` satisfies `constraint`. */
       predicate relevantConstraint(HasTypeTree term, Type constraint);
+
+      /**
+       * Holds if constraints that are satisfied through conditions that are
+       * universally quantified type parameters should be used. Such type
+       * parameters might have type parameter constraints, and these are _not_
+       * checked. Hence using these represent a trade-off between too many
+       * constraints and too few constraints being satisfied.
+       */
+      default predicate useUniversalConditions() { any() }
     }
 
     module SatisfiesConstraint<
@@ -961,6 +970,7 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
         TypeMention constraintMention
       ) {
         exists(Type type | hasTypeConstraint(tt, type, constraint) |
+          useUniversalConditions() and
           not exists(countConstraintImplementations(type, constraint)) and
           conditionSatisfiesConstraintTypeAt(abs, condition, constraintMention, _, _) and
           resolveTypeMentionRoot(condition) = abs.getATypeParameter() and
