Skip to content

Rust: Make current MaD predicates deprecated #19502

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 21 additions & 12 deletions rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ private import codeql.rust.dataflow.FlowSource
private import codeql.rust.dataflow.FlowSink

/**
* DEPRECATED: This predicate will be replaced by an alternative implementation
* in the future, which uses a slightly different format.
*
* Holds if in a call to the function with canonical path `path`, defined in the
* crate `crate`, the value referred to by `output` is a flow source of the given
* `kind`.
Expand All @@ -58,12 +61,15 @@ private import codeql.rust.dataflow.FlowSink
* For more information on the `kind` parameter, see
* https://github.com/github/codeql/blob/main/docs/codeql/reusables/threat-model-description.rst.
*/
extensible predicate sourceModel(
extensible predicate sourceModelDeprecated(
Copy link
Preview

Copilot AI May 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To preserve backward compatibility during the transition, consider leaving the original sourceModel (and its sink/summary counterparts) as wrapper predicates that forward to sourceModelDeprecated, so existing models won’t break immediately.

Copilot uses AI. Check for mistakes.

string crate, string path, string output, string kind, string provenance,
QlBuiltins::ExtensionId madId
);

/**
* DEPRECATED: This predicate will be replaced by an alternative implementation
* in the future, which uses a slightly different format.
*
* Holds if in a call to the function with canonical path `path`, defined in the
* crate `crate`, the value referred to by `input` is a flow sink of the given
* `kind`.
Expand All @@ -74,20 +80,23 @@ extensible predicate sourceModel(
*
* - `sql-injection`: a flow sink for SQL injection.
*/
extensible predicate sinkModel(
extensible predicate sinkModelDeprecated(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should probably explain what's going on in the qldoc here, i.e. that a new format is coming soon but is not available yet (usually we would link to replacing predicate, but I understand these don't yet exist).

string crate, string path, string input, string kind, string provenance,
QlBuiltins::ExtensionId madId
);

/**
* DEPRECATED: This predicate will be replaced by an alternative implementation
* in the future, which uses a slightly different format.
*
* Holds if in a call to the function with canonical path `path`, defined in the
* crate `crate`, the value referred to by `input` can flow to the value referred
* to by `output`.
*
* `kind` should be either `value` or `taint`, for value-preserving or taint-preserving
* steps, respectively.
*/
extensible predicate summaryModel(
extensible predicate summaryModelDeprecated(
string crate, string path, string input, string output, string kind, string provenance,
QlBuiltins::ExtensionId madId
);
Expand All @@ -99,17 +108,17 @@ extensible predicate summaryModel(
*/
predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
exists(string crate, string path, string output, string kind |
sourceModel(crate, path, kind, output, _, madId) and
sourceModelDeprecated(crate, path, kind, output, _, madId) and
model = "Source: " + crate + "; " + path + "; " + output + "; " + kind
)
or
exists(string crate, string path, string input, string kind |
sinkModel(crate, path, kind, input, _, madId) and
sinkModelDeprecated(crate, path, kind, input, _, madId) and
model = "Sink: " + crate + "; " + path + "; " + input + "; " + kind
)
or
exists(string type, string path, string input, string output, string kind |
summaryModel(type, path, input, output, kind, _, madId) and
summaryModelDeprecated(type, path, input, output, kind, _, madId) and
model = "Summary: " + type + "; " + path + "; " + input + "; " + output + "; " + kind
)
}
Expand All @@ -119,15 +128,15 @@ private class SummarizedCallableFromModel extends SummarizedCallable::Range {
private string path;

SummarizedCallableFromModel() {
summaryModel(crate, path, _, _, _, _, _) and
summaryModelDeprecated(crate, path, _, _, _, _, _) and
this = crate + "::_::" + path
}

override predicate propagatesFlow(
string input, string output, boolean preservesValue, string model
) {
exists(string kind, QlBuiltins::ExtensionId madId |
summaryModel(crate, path, input, output, kind, _, madId) and
summaryModelDeprecated(crate, path, input, output, kind, _, madId) and
model = "MaD:" + madId.toString()
|
kind = "value" and
Expand All @@ -144,13 +153,13 @@ private class FlowSourceFromModel extends FlowSource::Range {
private string path;

FlowSourceFromModel() {
sourceModel(crate, path, _, _, _, _) and
sourceModelDeprecated(crate, path, _, _, _, _) and
this.callResolvesTo(crate, path)
}

override predicate isSource(string output, string kind, Provenance provenance, string model) {
exists(QlBuiltins::ExtensionId madId |
sourceModel(crate, path, output, kind, provenance, madId) and
sourceModelDeprecated(crate, path, output, kind, provenance, madId) and
model = "MaD:" + madId.toString()
)
}
Expand All @@ -161,13 +170,13 @@ private class FlowSinkFromModel extends FlowSink::Range {
private string path;

FlowSinkFromModel() {
sinkModel(crate, path, _, _, _, _) and
sinkModelDeprecated(crate, path, _, _, _, _) and
this.callResolvesTo(crate, path)
}

override predicate isSink(string input, string kind, Provenance provenance, string model) {
exists(QlBuiltins::ExtensionId madId |
sinkModel(crate, path, input, kind, provenance, madId) and
sinkModelDeprecated(crate, path, input, kind, provenance, madId) and
model = "MaD:" + madId.toString()
)
}
Expand Down
6 changes: 3 additions & 3 deletions rust/ql/lib/codeql/rust/dataflow/internal/empty.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,15 @@ extensions:
# to avoid errors about undefined extensionals.
- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data: []

- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data: []

- addsTo:
pack: codeql/rust-all
extensible: summaryModel
extensible: summaryModelDeprecated
data: []
2 changes: 1 addition & 1 deletion rust/ql/lib/codeql/rust/frameworks/futures.model.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
extensible: summaryModelDeprecated
data:
- ["repo:https://github.com/rust-lang/futures-rs:futures-executor", "crate::local_pool::block_on", "Argument[0]", "ReturnValue", "value", "manual"]
2 changes: 1 addition & 1 deletion rust/ql/lib/codeql/rust/frameworks/http.model.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http1::SendRequest>::send_request", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/hyperium/hyper:hyper", "<crate::client::conn::http2::SendRequest>::send_request", "ReturnValue.Future.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
Expand Down
4 changes: 2 additions & 2 deletions rust/ql/lib/codeql/rust/frameworks/libc.model.yml
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
- ["repo:https://github.com/rust-lang/libc:libc", "::free", "Argument[0]", "pointer-invalidate", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
- ["repo:https://github.com/rust-lang/libc:libc", "::malloc", "Argument[0]", "alloc-size", "manual"]
- ["repo:https://github.com/rust-lang/libc:libc", "::aligned_alloc", "Argument[1]", "alloc-size", "manual"]
Expand Down
2 changes: 1 addition & 1 deletion rust/ql/lib/codeql/rust/frameworks/log.model.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
- ["repo:https://github.com/rust-lang/log:log", "crate::__private_api::log", "Argument[0]", "log-injection", "manual"] # logger / args (pre v0.4.27)
- ["repo:https://github.com/rust-lang/log:log", "crate::__private_api::log", "Argument[1]", "log-injection", "manual"] # args / level (pre v0.4.27)
Expand Down
2 changes: 1 addition & 1 deletion rust/ql/lib/codeql/rust/frameworks/postgres.model.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
- ["repo:https://github.com/sfackler/rust-postgres:postgres", "<crate::client::Client>::execute", "Argument[0]", "sql-injection", "manual"]
- ["repo:https://github.com/sfackler/rust-postgres:postgres", "<crate::client::Client>::batch_execute", "Argument[0]", "sql-injection", "manual"]
Expand Down
2 changes: 1 addition & 1 deletion rust/ql/lib/codeql/rust/frameworks/regex.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
extensible: summaryModelDeprecated
data:
- ["repo:https://github.com/rust-lang/regex:regex", "crate::escape", "Argument[0].Reference", "ReturnValue", "taint", "manual"]
6 changes: 3 additions & 3 deletions rust/ql/lib/codeql/rust/frameworks/reqwest.model.yml
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "crate::get", "ReturnValue.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "crate::blocking::get", "ReturnValue.Field[crate::result::Result::Ok(0)]", "remote", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::async_impl::client::Client>::request", "Argument[1]", "transmission", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::blocking::client::Client>::request", "Argument[1]", "transmission", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
extensible: summaryModelDeprecated
data:
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::text", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::response::Response>::text_with_charset", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
Expand Down
4 changes: 2 additions & 2 deletions rust/ql/lib/codeql/rust/frameworks/rusqlite.model.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::Connection>::execute", "Argument[0]", "sql-injection", "manual"]
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::Connection>::execute_batch", "Argument[0]", "sql-injection", "manual"]
Expand All @@ -12,7 +12,7 @@ extensions:

- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::row::Row>::get", "ReturnValue.Field[crate::result::Result::Ok(0)]", "database", "manual"]
- ["repo:https://github.com/rusqlite/rusqlite:rusqlite", "<crate::row::Row>::get_unwrap", "ReturnValue", "database", "manual"]
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
- ["repo:https://github.com/RustCrypto/traits:digest", "<_ as crate::digest::Digest>::new_with_prefix", "Argument[0]", "hasher-input", "manual"]
- ["repo:https://github.com/RustCrypto/traits:digest", "<_ as crate::digest::Digest>::update", "Argument[0]", "hasher-input", "manual"]
Expand Down
2 changes: 1 addition & 1 deletion rust/ql/lib/codeql/rust/frameworks/stdlib/env.model.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
- ["lang:std", "crate::env::args", "ReturnValue.Element", "commandargs", "manual"]
- ["lang:std", "crate::env::args_os", "ReturnValue.Element", "commandargs", "manual"]
Expand Down
6 changes: 3 additions & 3 deletions rust/ql/lib/codeql/rust/frameworks/stdlib/fs.model.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
- ["lang:std", "crate::fs::read", "ReturnValue.Field[crate::result::Result::Ok(0)]", "file", "manual"]
- ["lang:std", "crate::fs::read_to_string", "ReturnValue.Field[crate::result::Result::Ok(0)]", "file", "manual"]
Expand All @@ -12,7 +12,7 @@ extensions:
- ["lang:std", "<crate::fs::File>::open_buffered", "ReturnValue.Field[crate::result::Result::Ok(0)]", "file", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
- ["lang:std", "crate::fs::copy", "Argument[0]", "path-injection", "manual"]
- ["lang:std", "crate::fs::copy", "Argument[1]", "path-injection", "manual"]
Expand Down Expand Up @@ -43,7 +43,7 @@ extensions:
- ["lang:std", "<crate::fs::File>::open_buffered", "Argument[0]", "path-injection", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
extensible: summaryModelDeprecated
data:
- ["lang:std", "<crate::path::PathBuf as crate::convert::From>::from", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["lang:std", "<crate::path::Path>::join", "Argument[self]", "ReturnValue", "taint", "manual"]
Expand Down
4 changes: 2 additions & 2 deletions rust/ql/lib/codeql/rust/frameworks/stdlib/io.model.yml
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
- ["lang:std", "crate::io::stdio::stdin", "ReturnValue", "stdin", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
extensible: summaryModelDeprecated
data:
- ["lang:std", "<crate::io::buffered::bufreader::BufReader>::new", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["lang:std", "<crate::io::buffered::bufreader::BufReader as crate::io::BufRead>::fill_buf", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
Expand Down
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
# Alloc
- ["lang:alloc", "crate::alloc::dealloc", "Argument[0]", "pointer-invalidate", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
# Alloc
- ["lang:alloc", "crate::alloc::alloc", "Argument[0]", "alloc-layout", "manual"]
Expand All @@ -27,7 +27,7 @@ extensions:
- ["lang:alloc", "<crate::alloc::Global as crate::alloc::Allocator>::grow_zeroed", "Argument[2]", "alloc-layout", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
extensible: summaryModelDeprecated
data:
# Fmt
- ["lang:alloc", "crate::fmt::format", "Argument[0]", "ReturnValue", "taint", "manual"]
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
extensible: summaryModelDeprecated
data:
# Iterator
- ["lang:core", "<[_]>::iter", "Argument[Self].Element", "ReturnValue.Element", "value", "manual"]
Expand Down Expand Up @@ -47,7 +47,7 @@ extensions:
- ["lang:core", "<str>::trim", "Argument[self]", "ReturnValue.Reference", "taint", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
# Ptr
- ["lang:core", "crate::ptr::drop_in_place", "Argument[0]", "pointer-invalidate", "manual"]
Expand All @@ -56,7 +56,7 @@ extensions:
- ["lang:core", "crate::ptr::null", "ReturnValue", "pointer-invalidate", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
# Ptr
- ["lang:core", "crate::ptr::read", "Argument[0]", "pointer-access", "manual"]
Expand Down
4 changes: 2 additions & 2 deletions rust/ql/lib/codeql/rust/frameworks/tokio-postgres.model.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
- ["repo:https://github.com/sfackler/rust-postgres:tokio-postgres", "<crate::client::Client>::execute", "Argument[0]", "sql-injection", "manual"]
- ["repo:https://github.com/sfackler/rust-postgres:tokio-postgres", "<crate::client::Client>::batch_execute", "Argument[0]", "sql-injection", "manual"]
Expand All @@ -18,7 +18,7 @@ extensions:

- addsTo:
pack: codeql/rust-all
extensible: sourceModel
extensible: sourceModelDeprecated
data:
- ["repo:https://github.com/sfackler/rust-postgres:tokio-postgres", "<crate::row::Row>::get", "ReturnValue", "database", "manual"]
- ["repo:https://github.com/sfackler/rust-postgres:tokio-postgres", "<crate::row::Row>::try_get", "ReturnValue.Field[crate::result::Result::Ok(0)]", "database", "manual"]
2 changes: 1 addition & 1 deletion rust/ql/lib/codeql/rust/frameworks/url.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@
extensions:
- addsTo:
pack: codeql/rust-all
Copy link
Preview

Copilot AI May 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Add a comment above this line (e.g. # Deprecated in favor of extractor-provided canonical paths) to clearly document that this model entry is deprecated and will be replaced in a future release.

Suggested change
pack: codeql/rust-all
pack: codeql/rust-all
# Deprecated in favor of extractor-provided canonical paths

Copilot uses AI. Check for mistakes.

extensible: summaryModel
extensible: summaryModelDeprecated
data:
- ["repo:https://github.com/servo/rust-url:url", "<crate::Url>::parse", "Argument[0].Reference", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
extensible: sinkModelDeprecated
data:
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::async_impl::client::Client>::delete", "Argument[0]", "transmission", "df-generated"]
- ["repo:https://github.com/seanmonstar/reqwest:reqwest", "<crate::async_impl::client::Client>::get", "Argument[0]", "transmission", "df-generated"]
Expand Down
2 changes: 1 addition & 1 deletion rust/ql/lib/ext/generated/rust/lang-alloc.model.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
extensible: summaryModelDeprecated
data:
- ["lang:alloc", "<&&str as crate::string::SpecToString>::spec_to_string", "Argument[self].Reference.Reference", "ReturnValue", "value", "dfc-generated"]
- ["lang:alloc", "<&crate::string::String as crate::str::pattern::Pattern>::as_utf8_pattern", "Argument[self]", "ReturnValue.Field[crate::option::Option::Some(0)].Field[crate::str::pattern::Utf8Pattern::StringPattern(0)]", "value", "dfc-generated"]
Expand Down
Loading