Rust: Trait call dispatch in dataflow

Author: hvitved

rust/ql/.generated.list

@@ -404,10 +404,10 @@ module RustDataFlow implements InputSig<Location> {
 
   /** Gets a viable implementation of the target of the given `Call`. */
   DataFlowCallable viableCallable(DataFlowCall call) {
-    exists(Callable target | target = call.asCallCfgNode().getCall().getStaticTarget() |
-      target = result.asCfgScope()
+    exists(Call c | c = call.asCallCfgNode().getCall() |
+      result.asCfgScope() = c.getARuntimeTarget()
       or
-      target = result.asSummarizedCallable()
+      result.asSummarizedCallable() = c.getStaticTarget()
     )
   }
 

rust/ql/.gitattributes

@@ -1,4 +1,3 @@
-// generated by codegen, remove this comment if you wish to edit this file
 /**
  * This module provides a hand-modifiable wrapper around the generated class `AssocItem`.
  *
@@ -12,6 +11,10 @@ private import codeql.rust.elements.internal.generated.AssocItem
  * be referenced directly.
  */
 module Impl {
+  private import rust
+  private import codeql.rust.internal.PathResolution
+
+  // the following QLdoc is generated: if you need to edit it, do it in the schema file
   /**
    * An associated item in a `Trait` or `Impl`.
    *
@@ -21,5 +24,15 @@ module Impl {
    * //       ^^^^^^^^^^^^^
    * ```
    */
-  class AssocItem extends Generated::AssocItem { }
+  class AssocItem extends Generated::AssocItem {
+    /** Holds if this item implements trait item `other`. */
+    pragma[nomagic]
+    predicate implements(AssocItem other) {
+      exists(TraitItemNode t, ImplItemNode i, string name |
+        other = t.getAssocItem(pragma[only_bind_into](name)) and
+        t = i.resolveTraitTy() and
+        this = i.getAssocItem(pragma[only_bind_into](name))
+      )
+    }
+  }
 }

rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll

@@ -65,6 +65,17 @@ module Impl {
       not exists(TypeInference::resolveMethodCallTarget(this)) and
       result = this.(CallExpr).getStaticTarget()
     }
+
+    /** Gets a runtime target of this call, if any. */
+    pragma[nomagic]
+    Function getARuntimeTarget() {
+      result.hasImplementation() and
+      (
+        result = this.getStaticTarget()
+        or
+        result.implements(this.getStaticTarget())
+      )
+    }
   }
 
   /** Holds if the call expression dispatches to a trait method. */

rust/ql/lib/codeql/rust/elements/internal/AssocItemImpl.qll

@@ -540,6 +540,13 @@ abstract class ImplOrTraitItemNode extends ItemNode {
   /** Gets an associated item belonging to this trait or `impl` block. */
   abstract AssocItemNode getAnAssocItem();
 
+  /** Gets the associated item named `name` belonging to this trait or `impl` block. */
+  pragma[nomagic]
+  AssocItemNode getAssocItem(string name) {
+    result = this.getAnAssocItem() and
+    result.getName() = name
+  }
+
   /** Holds if this trait or `impl` block declares an associated item named `name`. */
   pragma[nomagic]
   predicate hasAssocItem(string name) { name = this.getAnAssocItem().getName() }

rust/ql/lib/codeql/rust/elements/internal/CallImpl.qll

@@ -53,19 +53,31 @@ edges
 | main.rs:109:35:109:43 | source(...) | main.rs:108:30:110:5 | { ... } | provenance |  |
 | main.rs:112:27:112:32 | ...: i64 | main.rs:112:42:114:5 | { ... } | provenance |  |
 | main.rs:118:28:118:33 | ...: i64 | main.rs:119:14:119:14 | n | provenance |  |
+| main.rs:122:36:124:5 | { ... } | main.rs:132:13:132:30 | x.get_data_trait() | provenance |  |
 | main.rs:122:36:124:5 | { ... } | main.rs:142:13:142:31 | mn.get_data_trait() | provenance |  |
 | main.rs:123:35:123:44 | source(...) | main.rs:122:36:124:5 | { ... } | provenance |  |
 | main.rs:126:33:126:38 | ...: i64 | main.rs:126:48:128:5 | { ... } | provenance |  |
+| main.rs:132:9:132:9 | a | main.rs:133:10:133:10 | a | provenance |  |
+| main.rs:132:13:132:30 | x.get_data_trait() | main.rs:132:9:132:9 | a | provenance |  |
 | main.rs:138:9:138:9 | a | main.rs:139:10:139:10 | a | provenance |  |
 | main.rs:138:13:138:25 | mn.get_data() | main.rs:138:9:138:9 | a | provenance |  |
 | main.rs:142:9:142:9 | a | main.rs:143:10:143:10 | a | provenance |  |
 | main.rs:142:13:142:31 | mn.get_data_trait() | main.rs:142:9:142:9 | a | provenance |  |
+| main.rs:149:9:149:9 | a | main.rs:150:21:150:21 | a | provenance |  |
+| main.rs:149:13:149:22 | source(...) | main.rs:149:9:149:9 | a | provenance |  |
+| main.rs:150:21:150:21 | a | main.rs:118:28:118:33 | ...: i64 | provenance |  |
 | main.rs:155:9:155:9 | a | main.rs:156:16:156:16 | a | provenance |  |
 | main.rs:155:13:155:21 | source(...) | main.rs:155:9:155:9 | a | provenance |  |
 | main.rs:156:16:156:16 | a | main.rs:104:22:104:27 | ...: i64 | provenance |  |
 | main.rs:159:9:159:9 | a | main.rs:160:22:160:22 | a | provenance |  |
 | main.rs:159:13:159:22 | source(...) | main.rs:159:9:159:9 | a | provenance |  |
 | main.rs:160:22:160:22 | a | main.rs:118:28:118:33 | ...: i64 | provenance |  |
+| main.rs:166:9:166:9 | a | main.rs:167:34:167:34 | a | provenance |  |
+| main.rs:166:13:166:22 | source(...) | main.rs:166:9:166:9 | a | provenance |  |
+| main.rs:167:9:167:9 | b | main.rs:168:10:168:10 | b | provenance |  |
+| main.rs:167:13:167:35 | x.data_through_trait(...) | main.rs:167:9:167:9 | b | provenance |  |
+| main.rs:167:34:167:34 | a | main.rs:126:33:126:38 | ...: i64 | provenance |  |
+| main.rs:167:34:167:34 | a | main.rs:167:13:167:35 | x.data_through_trait(...) | provenance |  |
 | main.rs:173:9:173:9 | a | main.rs:174:29:174:29 | a | provenance |  |
 | main.rs:173:13:173:21 | source(...) | main.rs:173:9:173:9 | a | provenance |  |
 | main.rs:174:9:174:9 | b | main.rs:175:10:175:10 | b | provenance |  |
@@ -100,6 +112,11 @@ edges
 | main.rs:222:9:222:35 | MyInt {...} [MyInt] | main.rs:220:42:223:5 | { ... } [MyInt] | provenance |  |
 | main.rs:222:24:222:27 | self [MyInt] | main.rs:222:24:222:33 | self.value | provenance |  |
 | main.rs:222:24:222:33 | self.value | main.rs:222:9:222:35 | MyInt {...} [MyInt] | provenance |  |
+| main.rs:227:30:227:39 | ...: MyInt [MyInt] | main.rs:228:25:228:27 | rhs [MyInt] | provenance |  |
+| main.rs:228:10:228:14 | [post] * ... [MyInt] | main.rs:228:11:228:14 | [post] self [&ref, MyInt] | provenance |  |
+| main.rs:228:11:228:14 | [post] self [&ref, MyInt] | main.rs:227:19:227:27 | SelfParam [Return] [&ref, MyInt] | provenance |  |
+| main.rs:228:25:228:27 | rhs [MyInt] | main.rs:228:25:228:33 | rhs.value | provenance |  |
+| main.rs:228:25:228:33 | rhs.value | main.rs:228:10:228:14 | [post] * ... [MyInt] | provenance |  |
 | main.rs:242:9:242:9 | a [MyInt] | main.rs:244:13:244:13 | a [MyInt] | provenance |  |
 | main.rs:242:13:242:38 | MyInt {...} [MyInt] | main.rs:242:9:242:9 | a [MyInt] | provenance |  |
 | main.rs:242:28:242:36 | source(...) | main.rs:242:13:242:38 | MyInt {...} [MyInt] | provenance |  |
@@ -115,6 +132,14 @@ edges
 | main.rs:254:9:254:9 | d [MyInt] | main.rs:255:10:255:10 | d [MyInt] | provenance |  |
 | main.rs:254:13:254:20 | a.add(...) [MyInt] | main.rs:254:9:254:9 | d [MyInt] | provenance |  |
 | main.rs:255:10:255:10 | d [MyInt] | main.rs:255:10:255:16 | d.value | provenance |  |
+| main.rs:259:9:259:9 | b [MyInt] | main.rs:261:35:261:35 | b [MyInt] | provenance |  |
+| main.rs:259:13:259:39 | MyInt {...} [MyInt] | main.rs:259:9:259:9 | b [MyInt] | provenance |  |
+| main.rs:259:28:259:37 | source(...) | main.rs:259:13:259:39 | MyInt {...} [MyInt] | provenance |  |
+| main.rs:261:27:261:32 | [post] &mut a [&ref, MyInt] | main.rs:261:32:261:32 | [post] a [MyInt] | provenance |  |
+| main.rs:261:32:261:32 | [post] a [MyInt] | main.rs:262:10:262:10 | a [MyInt] | provenance |  |
+| main.rs:261:35:261:35 | b [MyInt] | main.rs:227:30:227:39 | ...: MyInt [MyInt] | provenance |  |
+| main.rs:261:35:261:35 | b [MyInt] | main.rs:261:27:261:32 | [post] &mut a [&ref, MyInt] | provenance |  |
+| main.rs:262:10:262:10 | a [MyInt] | main.rs:262:10:262:16 | a.value | provenance |  |
 | main.rs:289:18:289:21 | SelfParam [MyInt] | main.rs:289:48:291:5 | { ... } [MyInt] | provenance |  |
 | main.rs:293:26:293:37 | ...: MyInt [MyInt] | main.rs:293:49:295:5 | { ... } [MyInt] | provenance |  |
 | main.rs:299:9:299:9 | a [MyInt] | main.rs:301:50:301:50 | a [MyInt] | provenance |  |
@@ -206,18 +231,30 @@ nodes
 | main.rs:123:35:123:44 | source(...) | semmle.label | source(...) |
 | main.rs:126:33:126:38 | ...: i64 | semmle.label | ...: i64 |
 | main.rs:126:48:128:5 | { ... } | semmle.label | { ... } |
+| main.rs:132:9:132:9 | a | semmle.label | a |
+| main.rs:132:13:132:30 | x.get_data_trait() | semmle.label | x.get_data_trait() |
+| main.rs:133:10:133:10 | a | semmle.label | a |
 | main.rs:138:9:138:9 | a | semmle.label | a |
 | main.rs:138:13:138:25 | mn.get_data() | semmle.label | mn.get_data() |
 | main.rs:139:10:139:10 | a | semmle.label | a |
 | main.rs:142:9:142:9 | a | semmle.label | a |
 | main.rs:142:13:142:31 | mn.get_data_trait() | semmle.label | mn.get_data_trait() |
 | main.rs:143:10:143:10 | a | semmle.label | a |
+| main.rs:149:9:149:9 | a | semmle.label | a |
+| main.rs:149:13:149:22 | source(...) | semmle.label | source(...) |
+| main.rs:150:21:150:21 | a | semmle.label | a |
 | main.rs:155:9:155:9 | a | semmle.label | a |
 | main.rs:155:13:155:21 | source(...) | semmle.label | source(...) |
 | main.rs:156:16:156:16 | a | semmle.label | a |
 | main.rs:159:9:159:9 | a | semmle.label | a |
 | main.rs:159:13:159:22 | source(...) | semmle.label | source(...) |
 | main.rs:160:22:160:22 | a | semmle.label | a |
+| main.rs:166:9:166:9 | a | semmle.label | a |
+| main.rs:166:13:166:22 | source(...) | semmle.label | source(...) |
+| main.rs:167:9:167:9 | b | semmle.label | b |
+| main.rs:167:13:167:35 | x.data_through_trait(...) | semmle.label | x.data_through_trait(...) |
+| main.rs:167:34:167:34 | a | semmle.label | a |
+| main.rs:168:10:168:10 | b | semmle.label | b |
 | main.rs:173:9:173:9 | a | semmle.label | a |
 | main.rs:173:13:173:21 | source(...) | semmle.label | source(...) |
 | main.rs:174:9:174:9 | b | semmle.label | b |
@@ -254,6 +291,12 @@ nodes
 | main.rs:222:9:222:35 | MyInt {...} [MyInt] | semmle.label | MyInt {...} [MyInt] |
 | main.rs:222:24:222:27 | self [MyInt] | semmle.label | self [MyInt] |
 | main.rs:222:24:222:33 | self.value | semmle.label | self.value |
+| main.rs:227:19:227:27 | SelfParam [Return] [&ref, MyInt] | semmle.label | SelfParam [Return] [&ref, MyInt] |
+| main.rs:227:30:227:39 | ...: MyInt [MyInt] | semmle.label | ...: MyInt [MyInt] |
+| main.rs:228:10:228:14 | [post] * ... [MyInt] | semmle.label | [post] * ... [MyInt] |
+| main.rs:228:11:228:14 | [post] self [&ref, MyInt] | semmle.label | [post] self [&ref, MyInt] |
+| main.rs:228:25:228:27 | rhs [MyInt] | semmle.label | rhs [MyInt] |
+| main.rs:228:25:228:33 | rhs.value | semmle.label | rhs.value |
 | main.rs:242:9:242:9 | a [MyInt] | semmle.label | a [MyInt] |
 | main.rs:242:13:242:38 | MyInt {...} [MyInt] | semmle.label | MyInt {...} [MyInt] |
 | main.rs:242:28:242:36 | source(...) | semmle.label | source(...) |
@@ -269,6 +312,14 @@ nodes
 | main.rs:254:13:254:20 | a.add(...) [MyInt] | semmle.label | a.add(...) [MyInt] |
 | main.rs:255:10:255:10 | d [MyInt] | semmle.label | d [MyInt] |
 | main.rs:255:10:255:16 | d.value | semmle.label | d.value |
+| main.rs:259:9:259:9 | b [MyInt] | semmle.label | b [MyInt] |
+| main.rs:259:13:259:39 | MyInt {...} [MyInt] | semmle.label | MyInt {...} [MyInt] |
+| main.rs:259:28:259:37 | source(...) | semmle.label | source(...) |
+| main.rs:261:27:261:32 | [post] &mut a [&ref, MyInt] | semmle.label | [post] &mut a [&ref, MyInt] |
+| main.rs:261:32:261:32 | [post] a [MyInt] | semmle.label | [post] a [MyInt] |
+| main.rs:261:35:261:35 | b [MyInt] | semmle.label | b [MyInt] |
+| main.rs:262:10:262:10 | a [MyInt] | semmle.label | a [MyInt] |
+| main.rs:262:10:262:16 | a.value | semmle.label | a.value |
 | main.rs:289:18:289:21 | SelfParam [MyInt] | semmle.label | SelfParam [MyInt] |
 | main.rs:289:48:291:5 | { ... } [MyInt] | semmle.label | { ... } [MyInt] |
 | main.rs:293:26:293:37 | ...: MyInt [MyInt] | semmle.label | ...: MyInt [MyInt] |
@@ -308,12 +359,14 @@ subpaths
 | main.rs:67:26:67:26 | a | main.rs:61:17:61:22 | ...: i64 | main.rs:61:32:63:1 | { ... } | main.rs:67:13:67:27 | pass_through(...) |
 | main.rs:72:26:75:5 | { ... } | main.rs:61:17:61:22 | ...: i64 | main.rs:61:32:63:1 | { ... } | main.rs:72:13:75:6 | pass_through(...) |
 | main.rs:86:26:86:26 | a | main.rs:82:21:82:26 | ...: i64 | main.rs:82:36:84:5 | { ... } | main.rs:86:13:86:27 | pass_through(...) |
+| main.rs:167:34:167:34 | a | main.rs:126:33:126:38 | ...: i64 | main.rs:126:48:128:5 | { ... } | main.rs:167:13:167:35 | x.data_through_trait(...) |
 | main.rs:174:29:174:29 | a | main.rs:112:27:112:32 | ...: i64 | main.rs:112:42:114:5 | { ... } | main.rs:174:13:174:30 | mn.data_through(...) |
 | main.rs:179:35:179:35 | a | main.rs:126:33:126:38 | ...: i64 | main.rs:126:48:128:5 | { ... } | main.rs:179:13:179:36 | mn.data_through_trait(...) |
 | main.rs:194:38:194:38 | a | main.rs:112:27:112:32 | ...: i64 | main.rs:112:42:114:5 | { ... } | main.rs:194:13:194:39 | ...::data_through(...) |
 | main.rs:212:24:212:33 | source(...) | main.rs:206:12:206:17 | ...: i64 | main.rs:206:28:208:5 | { ... } [MyInt] | main.rs:212:13:212:34 | ...::new(...) [MyInt] |
 | main.rs:244:13:244:13 | a [MyInt] | main.rs:220:12:220:15 | SelfParam [MyInt] | main.rs:220:42:223:5 | { ... } [MyInt] | main.rs:244:13:244:17 | ... + ... [MyInt] |
 | main.rs:252:9:252:9 | a [MyInt] | main.rs:220:12:220:15 | SelfParam [MyInt] | main.rs:220:42:223:5 | { ... } [MyInt] | main.rs:254:13:254:20 | a.add(...) [MyInt] |
+| main.rs:261:35:261:35 | b [MyInt] | main.rs:227:30:227:39 | ...: MyInt [MyInt] | main.rs:227:19:227:27 | SelfParam [Return] [&ref, MyInt] | main.rs:261:27:261:32 | [post] &mut a [&ref, MyInt] |
 | main.rs:301:50:301:50 | a [MyInt] | main.rs:289:18:289:21 | SelfParam [MyInt] | main.rs:289:48:291:5 | { ... } [MyInt] | main.rs:301:30:301:54 | ...::take_self(...) [MyInt] |
 | main.rs:306:55:306:55 | b [MyInt] | main.rs:293:26:293:37 | ...: MyInt [MyInt] | main.rs:293:49:295:5 | { ... } [MyInt] | main.rs:306:30:306:56 | ...::take_second(...) [MyInt] |
 testFailures
@@ -327,15 +380,19 @@ testFailures
 | main.rs:87:10:87:10 | b | main.rs:80:13:80:22 | source(...) | main.rs:87:10:87:10 | b | $@ | main.rs:80:13:80:22 | source(...) | source(...) |
 | main.rs:105:14:105:14 | n | main.rs:155:13:155:21 | source(...) | main.rs:105:14:105:14 | n | $@ | main.rs:155:13:155:21 | source(...) | source(...) |
 | main.rs:105:14:105:14 | n | main.rs:187:13:187:21 | source(...) | main.rs:105:14:105:14 | n | $@ | main.rs:187:13:187:21 | source(...) | source(...) |
+| main.rs:119:14:119:14 | n | main.rs:149:13:149:22 | source(...) | main.rs:119:14:119:14 | n | $@ | main.rs:149:13:149:22 | source(...) | source(...) |
 | main.rs:119:14:119:14 | n | main.rs:159:13:159:22 | source(...) | main.rs:119:14:119:14 | n | $@ | main.rs:159:13:159:22 | source(...) | source(...) |
+| main.rs:133:10:133:10 | a | main.rs:123:35:123:44 | source(...) | main.rs:133:10:133:10 | a | $@ | main.rs:123:35:123:44 | source(...) | source(...) |
 | main.rs:139:10:139:10 | a | main.rs:109:35:109:43 | source(...) | main.rs:139:10:139:10 | a | $@ | main.rs:109:35:109:43 | source(...) | source(...) |
 | main.rs:143:10:143:10 | a | main.rs:123:35:123:44 | source(...) | main.rs:143:10:143:10 | a | $@ | main.rs:123:35:123:44 | source(...) | source(...) |
+| main.rs:168:10:168:10 | b | main.rs:166:13:166:22 | source(...) | main.rs:168:10:168:10 | b | $@ | main.rs:166:13:166:22 | source(...) | source(...) |
 | main.rs:175:10:175:10 | b | main.rs:173:13:173:21 | source(...) | main.rs:175:10:175:10 | b | $@ | main.rs:173:13:173:21 | source(...) | source(...) |
 | main.rs:180:10:180:10 | b | main.rs:178:13:178:22 | source(...) | main.rs:180:10:180:10 | b | $@ | main.rs:178:13:178:22 | source(...) | source(...) |
 | main.rs:195:10:195:10 | b | main.rs:193:13:193:22 | source(...) | main.rs:195:10:195:10 | b | $@ | main.rs:193:13:193:22 | source(...) | source(...) |
 | main.rs:214:10:214:10 | m | main.rs:212:24:212:33 | source(...) | main.rs:214:10:214:10 | m | $@ | main.rs:212:24:212:33 | source(...) | source(...) |
 | main.rs:245:10:245:16 | c.value | main.rs:242:28:242:36 | source(...) | main.rs:245:10:245:16 | c.value | $@ | main.rs:242:28:242:36 | source(...) | source(...) |
 | main.rs:255:10:255:16 | d.value | main.rs:252:28:252:36 | source(...) | main.rs:255:10:255:16 | d.value | $@ | main.rs:252:28:252:36 | source(...) | source(...) |
+| main.rs:262:10:262:16 | a.value | main.rs:259:28:259:37 | source(...) | main.rs:262:10:262:16 | a.value | $@ | main.rs:259:28:259:37 | source(...) | source(...) |
 | main.rs:302:10:302:10 | c | main.rs:299:28:299:36 | source(...) | main.rs:302:10:302:10 | c | $@ | main.rs:299:28:299:36 | source(...) | source(...) |
 | main.rs:307:10:307:10 | c | main.rs:305:28:305:37 | source(...) | main.rs:307:10:307:10 | c | $@ | main.rs:305:28:305:37 | source(...) | source(...) |
 | main.rs:317:10:317:10 | a | main.rs:316:13:316:21 | source(...) | main.rs:317:10:317:10 | a | $@ | main.rs:316:13:316:21 | source(...) | source(...) |

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -116,7 +116,7 @@ impl MyFlag {
 
 impl MyTrait for MyFlag {
     fn data_in_trait(self, n: i64) {
-        sink(n); // $ hasValueFlow=22 $ MISSING: hasValueFlow=31
+        sink(n); // $ hasValueFlow=22 $ hasValueFlow=31
     }
 
     fn get_data_trait(self) -> i64 {
@@ -130,7 +130,7 @@ impl MyTrait for MyFlag {
 
 fn data_out_of_method_trait_dispatch<T: MyTrait>(x: T) {
     let a = x.get_data_trait();
-    sink(a); // $ MISSING: hasValueFlow=21
+    sink(a); // $ hasValueFlow=21
 }
 
 fn data_out_of_method() {
@@ -165,7 +165,7 @@ fn data_in_to_method_call() {
 fn data_through_method_trait_dispatch<T: MyTrait>(x: T) {
     let a = source(34);
     let b = x.data_through_trait(a);
-    sink(b); // $ MISSING: hasValueFlow=34
+    sink(b); // $ hasValueFlow=34
 }
 
 fn data_through_method() {
@@ -259,7 +259,7 @@ fn test_operator_overloading() {
     let b = MyInt { value: source(34) };
     // The line below is what `*=` desugars to.
     MulAssign::mul_assign(&mut a, b);
-    sink(a.value); // $ MISSING: hasValueFlow=34
+    sink(a.value); // $ hasValueFlow=34
 
     let mut a = MyInt { value: 0 };
     let b = MyInt { value: source(35) };