Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rust: Avoid location-based variable analysis #18462

Merged
merged 3 commits into from
Jan 15, 2025

Conversation

hvitved
Copy link
Contributor

@hvitved hvitved commented Jan 9, 2025

Before this PR, we were relying on the source location of variable declarations and accesses for name-binding. However, this does not work for variables declared/accessed inside macros, where the original source locations are not available.

This PR consequently rewrites the logic to be purely AST based, by computing pre-order tree-traversal numbers for (relevant) AST nodes, and then using those numbers instead of source location start-line/columns.

This approach mostly works, except we are not able to respect the macro hygiene rules of Rust, since the extractor does not supply us with a syntax context. I originally noticed this in an earlier DCA run, where a new rust/unused-variable false-positive result was added, and I have consequently added this FP to our test suite.

Commit-by-commit review is suggested.

@github-actions github-actions bot added the Rust Pull requests that update Rust code label Jan 9, 2025
@hvitved hvitved force-pushed the rust/variable-without-location branch 2 times, most recently from 9da26a8 to 6c0cfb0 Compare January 10, 2025 08:36
@hvitved hvitved force-pushed the rust/variable-without-location branch from 6c0cfb0 to 4c83022 Compare January 13, 2025 09:55
@hvitved hvitved changed the title Rust: Avoid location based variable analysis Rust: Avoid location-based variable analysis Jan 13, 2025
@hvitved hvitved force-pushed the rust/variable-without-location branch from 4c83022 to 33e6d63 Compare January 13, 2025 10:08
@hvitved hvitved marked this pull request as ready for review January 13, 2025 13:27
@Copilot Copilot bot review requested due to automatic review settings January 13, 2025 13:27

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot reviewed 6 out of 10 changed files in this pull request and generated 1 comment.

Files not reviewed (4)
  • rust/ql/lib/codeql/rust/elements/internal/VariableImpl.qll: Language not supported
  • rust/ql/test/library-tests/dataflow/strings/inline-taint-flow.expected: Language not supported
  • rust/ql/test/library-tests/variables/variables.ql: Language not supported
  • rust/ql/test/query-tests/unusedentities/UnusedValue.expected: Language not supported

Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more

@hvitved hvitved requested a review from paldepind January 14, 2025 09:37
@github github deleted a comment from Copilot bot Jan 14, 2025
Copy link
Contributor

@paldepind paldepind left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks really great :)

sink(format!("{}", s1)); // $ MISSING: hasTaintFlow=34
sink(format!("{s1} and {s3}")); // $ MISSING: hasTaintFlow=34
sink(format!("{}", s1)); // $ hasTaintFlow=34
sink(format!("{s1} and {s3}")); // $ hasTaintFlow=34
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hurrah! 🎉

@hvitved hvitved merged commit 3ceec93 into github:main Jan 15, 2025
16 checks passed
@hvitved hvitved deleted the rust/variable-without-location branch January 15, 2025 08:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Rust Pull requests that update Rust code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants