Rust: CFG for ImplicitVariableAccess

Author: aibaars

rust/ql/lib/codeql/rust/controlflow/internal/ControlFlowGraphImpl.qll

@@ -89,6 +89,31 @@ class ParamTree extends StandardPostOrderTree, Param {
   override AstNode getChildNode(int i) { i = 0 and result = this.getPat() }
 }
 
+class FormatArgsExprTree extends StandardPostOrderTree, FormatArgsExpr {
+  override AstNode getChildNode(int i) {
+    i = -1 and result = this.getTemplate()
+    or
+    result = this.getArg(i).getExpr()
+    or
+    result =
+      any(ImplicitVariableAccess v, Format f, int index, int kind |
+        f = this.getFormat(index) and
+        (
+          v.getArgument() = f.getArgumentRef() and kind = 0
+          or
+          v.getArgument() = f.getWidthArgument() and kind = 1
+          or
+          v.getArgument() = f.getPrecisionArgument() and kind = 2
+        ) and
+        i = this.getNumberOfArgs() + index * 3 + kind
+      |
+        v
+      )
+  }
+}
+
+class ImplictVariableAccessTree extends LeafTree, ImplicitVariableAccess { }
+
 class ItemTree extends LeafTree, Item {
   ItemTree() {
     not this instanceof MacroCall and

rust/ql/lib/rust.qll

@@ -6,3 +6,4 @@ import codeql.files.FileSystem
 import codeql.rust.elements.AssignmentOperation
 import codeql.rust.elements.LogicalOperation
 import codeql.rust.elements.Variable
+import codeql.rust.elements.FormatTemplate