Rust: Type inference for pattern matching

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/StructPatImpl.qll

@@ -33,13 +33,20 @@ module Impl {
       name = this.getStructPatFieldList().getAField().getFieldName()
     }
 
-    /** Gets the record field that matches the `name` pattern of this pattern. */
+    /** Gets the struct field that matches the `name` pattern of this pattern. */
     pragma[nomagic]
     StructField getStructField(string name) {
       exists(PathResolution::ItemNode i | i = this.getResolvedPath(name) |
         result.isStructField(i, name) or
         result.isVariantField(i, name)
       )
     }
+
+    /** Gets the struct pattern for the field `name`. */
+    pragma[nomagic]
+    StructPatField getPatField(string name) {
+      result = this.getStructPatFieldList().getAField() and
+      name = result.getFieldName()
+    }
   }
 }

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -260,7 +260,7 @@ private predicate typeEquality(AstNode n1, TypePath prefix1, AstNode n2, TypePat
   prefix2.isEmpty() and
   (
     exists(Variable v | n1 = v.getAnAccess() |
-      n2 = v.getPat()
+      n2 = v.getPat().getName()
       or
       n2 = v.getParameter().(SelfParam)
     )
@@ -276,6 +276,22 @@ private predicate typeEquality(AstNode n1, TypePath prefix1, AstNode n2, TypePat
     or
     n1 = n2.(MatchExpr).getAnArm().getExpr()
     or
+    exists(LetExpr let |
+      n1 = let.getScrutinee() and
+      n2 = let.getPat()
+    )
+    or
+    exists(MatchExpr me |
+      n1 = me.getScrutinee() and
+      n2 = me.getAnArm().getPat()
+    )
+    or
+    n1 = n2.(OrPat).getAPat()
+    or
+    n1 = n2.(ParenPat).getPat()
+    or
+    n1 = n2.(LiteralPat).getLiteral()
+    or
     exists(BreakExpr break |
       break.getExpr() = n1 and
       break.getTarget() = n2.(LoopExpr)
@@ -287,9 +303,21 @@ private predicate typeEquality(AstNode n1, TypePath prefix1, AstNode n2, TypePat
     )
     or
     n1 = n2.(MacroExpr).getMacroCall().getMacroCallExpansion()
+    or
+    n1 = n2.(MacroPat).getMacroCall().getMacroCallExpansion()
   )
   or
-  n1 = n2.(RefExpr).getExpr() and
+  n1 =
+    any(IdentPat ip |
+      n2 = ip.getName() and
+      prefix1.isEmpty() and
+      if ip.isRef() then prefix2 = TypePath::singleton(TRefTypeParameter()) else prefix2.isEmpty()
+    )
+  or
+  (
+    n1 = n2.(RefExpr).getExpr() or
+    n1 = n2.(RefPat).getPat()
+  ) and
   prefix1.isEmpty() and
   prefix2 = TypePath::singleton(TRefTypeParameter())
   or
@@ -478,7 +506,7 @@ private module StructExprMatchingInput implements MatchingInputSig {
     Type getInferredType(AccessPosition apos, TypePath path) {
       result = inferType(this.getNodeAt(apos), path)
       or
-      // The struct type is supplied explicitly as a type qualifier, e.g.
+      // The struct/enum type is supplied explicitly as a type qualifier, e.g.
       // `Foo<Bar>::Variant { ... }`.
       apos.isStructPos() and
       exists(Path p, TypeMention tm |
@@ -576,7 +604,7 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     }
   }
 
-  abstract private class TupleDeclaration extends Declaration {
+  abstract additional class TupleDeclaration extends Declaration {
     override Type getDeclaredType(DeclarationPosition dpos, TypePath path) {
       result = super.getDeclaredType(dpos, path)
       or
@@ -1032,9 +1060,18 @@ private Type inferFieldExprType(AstNode n, TypePath path) {
   )
 }
 
-/** Gets the root type of the reference expression `re`. */
+/** Gets the root type of the reference node `ref`. */
 pragma[nomagic]
-private Type inferRefExprType(RefExpr re) { exists(re) and result = TRefType() }
+private Type inferRefNodeType(AstNode ref) {
+  (
+    ref = any(IdentPat ip | ip.isRef()).getName()
+    or
+    ref instanceof RefExpr
+    or
+    ref instanceof RefPat
+  ) and
+  result = TRefType()
+}
 
 pragma[nomagic]
 private Type inferTryExprType(TryExpr te, TypePath path) {
@@ -1178,6 +1215,120 @@ private Type inferIndexExprType(IndexExpr ie, TypePath path) {
   )
 }
 
+/**
+ * A matching configuration for resolving types of struct patterns
+ * like `let Foo { bar } = ...`.
+ */
+private module StructPatMatchingInput implements MatchingInputSig {
+  class DeclarationPosition = StructExprMatchingInput::DeclarationPosition;
+
+  class Declaration = StructExprMatchingInput::Declaration;
+
+  class AccessPosition = DeclarationPosition;
+
+  class Access extends StructPat {
+    Type getTypeArgument(TypeArgumentPosition apos, TypePath path) { none() }
+
+    AstNode getNodeAt(AccessPosition apos) {
+      result = this.getPatField(apos.asFieldPos()).getPat()
+      or
+      result = this and
+      apos.isStructPos()
+    }
+
+    Type getInferredType(AccessPosition apos, TypePath path) {
+      result = inferType(this.getNodeAt(apos), path)
+      or
+      // The struct/enum type is supplied explicitly as a type qualifier, e.g.
+      // `let Foo<Bar>::Variant { ... } = ...`.
+      apos.isStructPos() and
+      exists(Path p, TypeMention tm |
+        p = this.getPath() and
+        if resolvePath(p) instanceof Variant then tm = p.getQualifier() else tm = p
+      |
+        result = tm.resolveTypeAt(path)
+      )
+    }
+
+    Declaration getTarget() { result = resolvePath(this.getPath()) }
+  }
+
+  predicate accessDeclarationPositionMatch(AccessPosition apos, DeclarationPosition dpos) {
+    apos = dpos
+  }
+}
+
+private module StructPatMatching = Matching<StructPatMatchingInput>;
+
+/**
+ * Gets the type of `n` at `path`, where `n` is either a struct pattern or
+ * a field pattern of a struct pattern.
+ */
+pragma[nomagic]
+private Type inferStructPatType(AstNode n, TypePath path) {
+  exists(StructPatMatchingInput::Access a, StructPatMatchingInput::AccessPosition apos |
+    n = a.getNodeAt(apos) and
+    result = StructPatMatching::inferAccessType(a, apos, path)
+  )
+}
+
+/**
+ * A matching configuration for resolving types of tuple struct patterns
+ * like `let Some(x) = ...`.
+ */
+private module TupleStructPatMatchingInput implements MatchingInputSig {
+  class DeclarationPosition = CallExprBaseMatchingInput::DeclarationPosition;
+
+  class Declaration = CallExprBaseMatchingInput::TupleDeclaration;
+
+  class AccessPosition = DeclarationPosition;
+
+  class Access extends TupleStructPat {
+    Type getTypeArgument(TypeArgumentPosition apos, TypePath path) { none() }
+
+    AstNode getNodeAt(AccessPosition apos) {
+      result = this.getField(apos.asPosition())
+      or
+      result = this and
+      apos.isSelf()
+    }
+
+    Type getInferredType(AccessPosition apos, TypePath path) {
+      result = inferType(this.getNodeAt(apos), path)
+      or
+      // The struct/enum type is supplied explicitly as a type qualifier, e.g.
+      // `let Option::<Foo>(x) = ...`.
+      apos.isSelf() and
+      exists(Path p, TypeMention tm |
+        p = this.getPath() and
+        if resolvePath(p) instanceof Variant then tm = p.getQualifier() else tm = p
+      |
+        result = tm.resolveTypeAt(path)
+      )
+    }
+
+    Declaration getTarget() { result = resolvePath(this.getPath()) }
+  }
+
+  predicate accessDeclarationPositionMatch(AccessPosition apos, DeclarationPosition dpos) {
+    apos = dpos
+  }
+}
+
+private module TupleStructPatMatching = Matching<TupleStructPatMatchingInput>;
+
+/**
+ * Gets the type of `n` at `path`, where `n` is either a tuple struct pattern or
+ * a positional pattern of a tuple struct pattern.
+ */
+pragma[nomagic]
+private Type inferTupleStructPatType(AstNode n, TypePath path) {
+  exists(TupleStructPatMatchingInput::Access a, TupleStructPatMatchingInput::AccessPosition apos |
+    n = a.getNodeAt(apos) and
+    result = TupleStructPatMatching::inferAccessType(a, apos, path)
+  )
+}
+
 final private class ForIterableExpr extends Expr {
   ForIterableExpr() { this = any(ForExpr fe).getIterable() }
 
@@ -1813,7 +1964,7 @@ private module Cached {
     or
     result = inferFieldExprType(n, path)
     or
-    result = inferRefExprType(n) and
+    result = inferRefNodeType(n) and
     path.isEmpty()
     or
     result = inferTryExprType(n, path)
@@ -1836,6 +1987,10 @@ private module Cached {
     result = inferForLoopExprType(n, path)
     or
     result = inferCastExprType(n, path)
+    or
+    result = inferStructPatType(n, path)
+    or
+    result = inferTupleStructPatType(n, path)
   }
 }
 

rust/ql/test/library-tests/dataflow/sources/CONSISTENCY/PathResolutionConsistency.expected

@@ -79,5 +79,11 @@ multipleCallTargets
 | test_futures_io.rs:93:26:93:63 | pinned.poll_read(...) |
 | test_futures_io.rs:116:22:116:50 | pinned.poll_fill_buf(...) |
 | test_futures_io.rs:145:26:145:49 | ...::with_capacity(...) |
+| web_frameworks.rs:13:14:13:22 | a.as_str() |
+| web_frameworks.rs:13:14:13:23 | a.as_str() |
+| web_frameworks.rs:14:14:14:24 | a.as_bytes() |
+| web_frameworks.rs:14:14:14:25 | a.as_bytes() |
 | web_frameworks.rs:101:14:101:23 | a.as_str() |
 | web_frameworks.rs:102:14:102:25 | a.as_bytes() |
+| web_frameworks.rs:158:14:158:23 | a.as_str() |
+| web_frameworks.rs:159:14:159:25 | a.as_bytes() |

rust/ql/test/library-tests/dataflow/sources/web_frameworks.rs

@@ -10,8 +10,8 @@ mod poem_test {
     #[handler]
     fn my_poem_handler_1(Path(a): Path<String>, // $ Alert[rust/summary/taint-sources]
     ) -> String {
-        sink(a.as_str()); // $ MISSING: hasTaintFlow -- no type inference for patterns
-        sink(a.as_bytes()); // $ MISSING: hasTaintFlow -- no type inference for patterns
+        sink(a.as_str()); // $ hasTaintFlow
+        sink(a.as_bytes()); // $ hasTaintFlow
         sink(a); // $ hasTaintFlow
 
         "".to_string()

rust/ql/test/library-tests/sensitivedata/CONSISTENCY/PathResolutionConsistency.expected

@@ -24,4 +24,6 @@ multipleCallTargets
 | test.rs:302:7:302:48 | ... .as_str() |
 | test.rs:303:7:303:35 | ... .as_str() |
 | test.rs:304:7:304:35 | ... .as_str() |
+| test.rs:313:8:313:19 | num.as_str() |
+| test.rs:324:8:324:19 | num.as_str() |
 | test.rs:343:7:343:39 | ... .as_str() |

rust/ql/test/library-tests/type-inference/main.rs

@@ -2362,12 +2362,12 @@ pub mod pattern_matching {
     pub fn f() -> Option<()> {
         let value = Some(42);
         if let Some(mesg) = value {
-            let mesg = mesg; // $ MISSING: type=mesg:i32
+            let mesg = mesg; // $ type=mesg:i32
             println!("{mesg}");
         }
         match value {
             Some(mesg) => {
-                let mesg = mesg; // $ MISSING: type=mesg:i32
+                let mesg = mesg; // $ type=mesg:i32
                 println!("{mesg}");
             }
             None => (),
@@ -2380,39 +2380,39 @@ pub mod pattern_matching {
 
         let value2 = &Some(42);
         if let &Some(mesg) = value2 {
-            let mesg = mesg; // $ MISSING: type=mesg:i32
+            let mesg = mesg; // $ type=mesg:i32
             println!("{mesg}");
         }
 
         let value3 = 42;
         if let ref mesg = value3 {
-            let mesg = mesg; // $ MISSING: type=mesg:&T.i32
+            let mesg = mesg; // $ type=mesg:&T.i32
             println!("{mesg}");
         }
 
         let value4 = Some(42);
         if let Some(ref mesg) = value4 {
-            let mesg = mesg; // $ MISSING: type=mesg:&T.i32
+            let mesg = mesg; // $ type=mesg:&T.i32
             println!("{mesg}");
         }
 
         let ref value5 = 42;
-        let x = value5; // $ MISSING: type=x:&T.i32
+        let x = value5; // $ type=x:&T.i32
 
         let my_record_struct = MyRecordStruct {
             value1: 42,
             value2: false,
         };
         if let MyRecordStruct { value1, value2 } = my_record_struct {
-            let x = value1; // $ MISSING: type=x:i32
-            let y = value2; // $ MISSING: type=y:bool
+            let x = value1; // $ type=x:i32
+            let y = value2; // $ type=y:bool
             ();
         }
 
         let my_tuple_struct = MyTupleStruct(42, false);
         if let MyTupleStruct(value1, value2) = my_tuple_struct {
-            let x = value1; // $ MISSING: type=x:i32
-            let y = value2; // $ MISSING: type=y:bool
+            let x = value1; // $ type=x:i32
+            let y = value2; // $ type=y:bool
             ();
         }
 
@@ -2422,13 +2422,13 @@ pub mod pattern_matching {
         };
         match my_enum1 {
             MyEnum::Variant1 { value1, value2 } => {
-                let x = value1; // $ MISSING: type=x:i32
-                let y = value2; // $ MISSING: type=y:bool
+                let x = value1; // $ type=x:i32
+                let y = value2; // $ type=y:bool
                 ();
             }
             MyEnum::Variant2(value1, value2) => {
-                let x = value1; // $ MISSING: type=x:bool
-                let y = value2; // $ MISSING: type=y:i32
+                let x = value1; // $ type=x:bool
+                let y = value2; // $ type=y:i32
                 ();
             }
         }
@@ -2449,9 +2449,9 @@ pub mod pattern_matching {
                     value2: y,
                 },
             ) => {
-                let a = value1; // $ MISSING: type=a:bool
-                let b = x; // $ MISSING: type=b:i32
-                let c = y; // $ MISSING: type=c:&T.str
+                let a = value1; // $ type=a:bool
+                let b = x; // $ type=b:i32
+                let c = y; // $ type=c:&T.str
                 ();
             }
             _ => (),