Rust: Apply MaD trait models to implementations

Author: hvitved

rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll

@@ -407,7 +407,17 @@ module RustDataFlow implements InputSig<Location> {
     exists(Call c | c = call.asCallCfgNode().getCall() |
       result.asCfgScope() = c.getARuntimeTarget()
       or
-      result.asSummarizedCallable() = c.getStaticTarget()
+      exists(SummarizedCallable sc, Function staticTarget |
+        staticTarget = c.getStaticTarget() and
+        sc = result.asSummarizedCallable()
+      |
+        sc = staticTarget
+        or
+        // only apply trait models to concrete implementations when they are not
+        // defined in source code
+        staticTarget.implements(sc) and
+        not staticTarget.fromSource()
+      )
     )
   }
 

rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll

@@ -32,6 +32,8 @@
  *     - `Field[t(i)]`: position `i` inside the variant/struct with canonical path `v`, for example
  *                      `Field[core::option::Option::Some(0)]`.
  *     - `Field[i]`: the `i`th element of a tuple.
+ *     - `Reference`: the referenced value.
+ *     - `Future`: the value being computed asynchronously.
  * 3. The `kind` column is a tag that can be referenced from QL to determine to
  *    which classes the interpreted elements should be added. For example, for
  *    sources `"remote"` indicates a default remote flow source, and for summaries
@@ -211,6 +213,10 @@ private class SummarizedCallableFromModel extends SummarizedCallable::Range {
     this.getCanonicalPath() = path
   }
 
+  override predicate hasProvenance(Provenance provenance) {
+    summaryModel(path, _, _, _, provenance, _)
+  }
+
   override predicate propagatesFlow(
     string input, string output, boolean preservesValue, string model
   ) {

rust/ql/test/library-tests/dataflow/models/main.rs

@@ -360,10 +360,10 @@ fn test_trait_model<T: Ord>(x: T) {
     sink(x4); // $ hasValueFlow=25
 
     let x5 = source(26).lt(&1);
-    sink(x5); // $ MISSING: hasTaintFlow=26
+    sink(x5); // $ hasTaintFlow=26
 
     let x6 = source(27) < 1;
-    sink(x6); // $ MISSING: hasTaintFlow=27
+    sink(x6); // $ hasTaintFlow=27
 }
 
 #[tokio::main]