Skip to content

Commit 5a73e0b

Browse files
geoffw0geoffw0
committed
Rust: Re-model std::env sources using models-as-data.
1 parent db4370d commit 5a73e0b

File tree

6 files changed

+60
-24
lines changed

6 files changed

+60
-24
lines changed

‎rust/ql/lib/codeql/rust/Concepts.qll

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
private import codeql.rust.dataflow.DataFlow
88
private import codeql.threatmodels.ThreatModels
99
private import codeql.rust.Frameworks
10+
private import codeql.rust.dataflow.FlowSource
1011

1112
/**
1213
* A data flow source for a specific threat-model.
@@ -66,6 +67,15 @@ module CommandLineArgsSource {
6667
}
6768
}
6869

70+
/**
71+
* An externally modeled source for command line arguments.
72+
*/
73+
class ModeledCommandLineArgsSource extends CommandLineArgsSource::Range {
74+
ModeledCommandLineArgsSource() {
75+
sourceNode(this, "command-line-source")
76+
}
77+
}
78+
6979
/**
7080
* A data flow source corresponding to the program's environment.
7181
*/
@@ -85,6 +95,15 @@ module EnvironmentSource {
8595
}
8696
}
8797

98+
/**
99+
* An externally modeled source for data from the program's environment.
100+
*/
101+
class ModeledEnvironmentSource extends EnvironmentSource::Range {
102+
ModeledEnvironmentSource() {
103+
sourceNode(this, "environment-source")
104+
}
105+
}
106+
88107
/**
89108
* A data flow source for remote (network) data.
90109
*/
@@ -104,6 +123,15 @@ module RemoteSource {
104123
}
105124
}
106125

126+
/**
127+
* An externally modeled source for remote (network) data.
128+
*/
129+
class ModeledRemoteSource extends RemoteSource::Range {
130+
ModeledRemoteSource() {
131+
sourceNode(this, "remote-source")
132+
}
133+
}
134+
107135
/**
108136
* A data flow node that constructs a SQL statement (for later execution).
109137
*

‎rust/ql/lib/codeql/rust/frameworks/stdlib/env.model.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sourceModel
5+
data:
6+
- ["lang:std", "crate::env::args", "ReturnValue", "command-line-source", "manual"]
7+
- ["lang:std", "crate::env::args_os", "ReturnValue", "command-line-source", "manual"]
8+
- ["lang:std", "crate::env::current_dir", "ReturnValue", "command-line-source", "manual"]
9+
- ["lang:std", "crate::env::current_exe", "ReturnValue", "command-line-source", "manual"]
10+
- ["lang:std", "crate::env::home_dir", "ReturnValue", "command-line-source", "manual"]
11+
- ["lang:std", "crate::env::var", "ReturnValue", "environment-source", "manual"]
12+
- ["lang:std", "crate::env::var_os", "ReturnValue", "environment-source", "manual"]
13+
- ["lang:std", "crate::env::vars", "ReturnValue", "environment-source", "manual"]
14+
- ["lang:std", "crate::env::vars_os", "ReturnValue", "environment-source", "manual"]

‎rust/ql/test/library-tests/dataflow/sources/InlineFlow.expected

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +0,0 @@
1-
| test.rs:8:34:8:84 | //... | Missing result: hasTaintFlow |
2-
| test.rs:9:37:9:87 | //... | Missing result: hasTaintFlow |
3-
| test.rs:41:20:41:36 | //... | Missing result: hasTaintFlow |
4-
| test.rs:45:20:45:36 | //... | Missing result: hasTaintFlow |

‎rust/ql/test/library-tests/dataflow/sources/TaintSources.expected

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,17 @@
1-
#select
1+
| test.rs:8:10:8:22 | ...::var | Flow source 'EnvironmentSource' of type environment. |
2+
| test.rs:9:10:9:25 | ...::var_os | Flow source 'EnvironmentSource' of type environment. |
3+
| test.rs:11:16:11:28 | ...::var | Flow source 'EnvironmentSource' of type environment. |
4+
| test.rs:12:16:12:31 | ...::var_os | Flow source 'EnvironmentSource' of type environment. |
5+
| test.rs:17:25:17:38 | ...::vars | Flow source 'EnvironmentSource' of type environment. |
6+
| test.rs:22:25:22:41 | ...::vars_os | Flow source 'EnvironmentSource' of type environment. |
7+
| test.rs:29:29:29:42 | ...::args | Flow source 'CommandLineArgs' of type commandargs. |
8+
| test.rs:32:16:32:29 | ...::args | Flow source 'CommandLineArgs' of type commandargs. |
9+
| test.rs:33:16:33:32 | ...::args_os | Flow source 'CommandLineArgs' of type commandargs. |
10+
| test.rs:40:16:40:29 | ...::args | Flow source 'CommandLineArgs' of type commandargs. |
11+
| test.rs:44:16:44:32 | ...::args_os | Flow source 'CommandLineArgs' of type commandargs. |
12+
| test.rs:50:15:50:35 | ...::current_dir | Flow source 'CommandLineArgs' of type commandargs. |
13+
| test.rs:51:15:51:35 | ...::current_exe | Flow source 'CommandLineArgs' of type commandargs. |
14+
| test.rs:52:16:52:33 | ...::home_dir | Flow source 'CommandLineArgs' of type commandargs. |
215
| test.rs:60:26:60:70 | ...::get(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
316
| test.rs:63:26:63:70 | ...::get(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
417
| test.rs:66:26:66:60 | ...::get(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
5-
testFailures
6-
| test.rs:8:34:8:84 | //... | Missing result: Alert[rust/summary/taint-sources] |
7-
| test.rs:9:37:9:87 | //... | Missing result: Alert[rust/summary/taint-sources] |
8-
| test.rs:11:62:11:99 | //... | Missing result: Alert[rust/summary/taint-sources] |
9-
| test.rs:12:51:12:88 | //... | Missing result: Alert[rust/summary/taint-sources] |
10-
| test.rs:17:44:17:81 | //... | Missing result: Alert[rust/summary/taint-sources] |
11-
| test.rs:22:47:22:84 | //... | Missing result: Alert[rust/summary/taint-sources] |
12-
| test.rs:29:57:29:94 | //... | Missing result: Alert[rust/summary/taint-sources] |
13-
| test.rs:32:50:32:87 | //... | Missing result: Alert[rust/summary/taint-sources] |
14-
| test.rs:33:53:33:90 | //... | Missing result: Alert[rust/summary/taint-sources] |
15-
| test.rs:40:35:40:72 | //... | Missing result: Alert[rust/summary/taint-sources] |
16-
| test.rs:44:38:44:75 | //... | Missing result: Alert[rust/summary/taint-sources] |
17-
| test.rs:50:57:50:94 | //... | Missing result: Alert[rust/summary/taint-sources] |
18-
| test.rs:51:57:51:94 | //... | Missing result: Alert[rust/summary/taint-sources] |
19-
| test.rs:52:55:52:92 | //... | Missing result: Alert[rust/summary/taint-sources] |

‎rust/ql/test/library-tests/dataflow/sources/test.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ fn sink<T>(_: T) { }
55
// --- tests ---
66

77
fn test_env_vars() {
8-
sink(std::env::var("HOME")); // $ Alert[rust/summary/taint-sources] hasTaintFlow
9-
sink(std::env::var_os("PATH")); // $ Alert[rust/summary/taint-sources] hasTaintFlow
8+
sink(std::env::var("HOME")); // $ Alert[rust/summary/taint-sources] hasTaintFlow="HOME"
9+
sink(std::env::var_os("PATH")); // $ Alert[rust/summary/taint-sources] hasTaintFlow="PATH"
1010

1111
let var1 = std::env::var("HOME").expect("HOME not set"); // $ Alert[rust/summary/taint-sources]
1212
let var2 = std::env::var_os("PATH").unwrap(); // $ Alert[rust/summary/taint-sources]

‎rust/ql/test/library-tests/dataflow/taint/TaintFlowStep.expected

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
| file://:0:0:0:0 | [summary param] 0 in lang:alloc::_::crate::fmt::format | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::crate::fmt::format | MaD:14 |
2-
| file://:0:0:0:0 | [summary param] self in lang:alloc::_::<crate::string::String>::as_str | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::<crate::string::String>::as_str | MaD:12 |
1+
| file://:0:0:0:0 | [summary param] 0 in lang:alloc::_::crate::fmt::format | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::crate::fmt::format | MaD:23 |
2+
| file://:0:0:0:0 | [summary param] self in lang:alloc::_::<crate::string::String>::as_str | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::<crate::string::String>::as_str | MaD:21 |
33
| file://:0:0:0:0 | [summary param] self in repo:https://github.com/seanmonstar/reqwest:reqwest::_::<crate::blocking::response::Response>::text | file://:0:0:0:0 | [summary] to write: ReturnValue.Variant[crate::result::Result::Ok(0)] in repo:https://github.com/seanmonstar/reqwest:reqwest::_::<crate::blocking::response::Response>::text | MaD:0 |
44
| main.rs:4:5:4:8 | 1000 | main.rs:4:5:4:12 | ... + ... | |
55
| main.rs:4:12:4:12 | i | main.rs:4:5:4:12 | ... + ... | |

0 commit comments

Comments
 (0)