Rust: make MacroStmts expressions

[aibaars]

This pull request adds a dataflow step for the expression of a MacroStmts block. MacroStmts nodes are inserted when a macro is expanded inside a block: for example:

    let unsafe_query_4 = if remote_string == "*" {
        "SELECT * FROM people".to_string()
    } else {
        format!("SELECT * FROM people WHERE firstname='{remote_string}'")
    };

This pull request changes the control and data flow of MacroStmts to match that of ExprBlock.

Thanks to @coadaflorin for spotting this case.

[Copilot]

Pull Request Overview

This pull request refactors the handling of MacroStmts by updating its annotation to inherit dataflow behavior from ExprBlock and adjusts related test queries accordingly.

• Updated the MacroStmts annotation to include replace_bases and cfg parameters.
• Modified the formatting of the doc string in annotations.py.
• Revised the unsafe_query_4 definition in the MySQL test to use a conditional expression for query generation.

Reviewed Changes

Copilot reviewed 13 out of 25 changed files in this pull request and generated no comments.

File	Description
rust/schema/annotations.py	Updated MacroStmts annotation and adjusted doc string formatting.
rust/ql/test/query-tests/security/CWE-089/sqlx.rs	Revised unsafe_query_4 to conditionally generate the query.

Files not reviewed (12)

• rust/downgrades/48a13c5eec3663c32ae89bb0aad8a03f52ad68c3/upgrade.properties: Language not supported
• rust/ql/.generated.list: Language not supported
• rust/ql/lib/codeql/rust/controlflow/internal/ControlFlowGraphImpl.qll: Language not supported
• rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll: Language not supported
• rust/ql/lib/codeql/rust/elements/MacroStmts.qll: Language not supported
• rust/ql/lib/rust.dbscheme: Language not supported
• rust/ql/lib/upgrades/e8707b675dc574aca9863eabcc09ac76f15bb9c2/upgrade.properties: Language not supported
• rust/ql/test/library-tests/controlflow/BasicBlocks.expected: Language not supported
• rust/ql/test/library-tests/controlflow/Cfg.expected: Language not supported
• rust/ql/test/library-tests/dataflow/local/DataFlowStep.expected: Language not supported
• rust/ql/test/library-tests/variables/Cfg.expected: Language not supported
• rust/ql/test/query-tests/security/CWE-089/SqlInjection.expected: Language not supported

[paldepind]

Nice! Seems like an important thing to get fixed as macros are often used as expressions.

I think we should also rename accordingly for clarity and consistency. MacroStmts doesn't sound like an expression (which might be why it wasn't made one in the first place?) and with this change is the only thing in @expr that doesn't have expr in the name.

If I understand correctly MacroStmts is very much like a block expression. So what about naming it MacroBlockExpr? In addition we could rename its getExpr predicate to getTailExpr to make that clearer as well?

[paldepind]

It would have been nice if the test was added as a first commit and not the last. Then changes to the annotations/expected file would have shown the effect of the fix.