Skip to content

Commit 1e656a4

Browse files
geoffw0geoffw0
committed
Rust: Rewrite the query to (1) include functions and (2) minimize output.
1 parent 4f08fdd commit 1e656a4

File tree

2 files changed

+61
-56
lines changed

2 files changed

+61
-56
lines changed

‎rust/ql/src/queries/security/CWE-696/BadCtorInitialization.ql

Lines changed: 33 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
import rust
1515

1616
/**
17-
* A `#[ctor]` or `#[dtor]` attribute.
17+
* A `#[ctor]` or `#[dtor]` attribute, that is, a source for this query.
1818
*/
1919
class CtorAttr extends Attr {
2020
string whichAttr;
@@ -28,7 +28,7 @@ class CtorAttr extends Attr {
2828
}
2929

3030
/**
31-
* A call into the Rust standard library.
31+
* A call into the Rust standard library, that is, a sink for this query.
3232
*/
3333
class StdCall extends Expr {
3434
StdCall() {
@@ -39,23 +39,38 @@ class StdCall extends Expr {
3939

4040
class PathElement = AstNode;
4141

42-
query predicate edges(PathElement pred, PathElement succ) {
43-
// starting edge (`#[ctor]` / `#[dtor]` attribute to call)
44-
exists(CtorAttr ctor, Function f |
45-
f.getAnAttr() = ctor and
46-
pred = ctor and
47-
succ.(CallExprBase).getEnclosingCallable() = f
48-
)
42+
/**
43+
* A candidate edge for the query that is reachable from
44+
* a source.
45+
*/
46+
predicate edgesFwd(PathElement pred, PathElement succ) {
47+
// attribute (source) -> callable
48+
pred.(CtorAttr) = succ.(Callable).getAnAttr()
49+
or
50+
// [forwards reachable] callable -> enclosed call
51+
edgesFwd(_, pred) and
52+
pred = succ.(CallExprBase).getEnclosingCallable()
4953
or
50-
// transitive edge (call to call)
51-
exists(Function f |
52-
edges(_, pred) and
53-
pred.(CallExprBase).getStaticTarget() = f and
54-
succ.(CallExprBase).getEnclosingCallable() = f
54+
// [forwards reachable] call -> target callable
55+
edgesFwd(_, pred) and
56+
pred.(CallExprBase).getStaticTarget() = succ
57+
}
58+
59+
/**
60+
* An edge for the query that is reachable from a source and backwards
61+
* reachable from a sink (adding the backwards reachability constraint
62+
* reduces the amount of output data produced).
63+
*/
64+
query predicate edges(PathElement pred, PathElement succ) {
65+
edgesFwd(pred, succ) and
66+
(
67+
succ instanceof StdCall // sink
68+
or
69+
edges(succ, _) // backwards reachable from a sink
5570
)
5671
}
5772

58-
from CtorAttr ctor, StdCall call
59-
where edges*(ctor, call)
60-
select call, ctor, call,
61-
"Call to " + call.toString() + " in a function with the " + ctor.getWhichAttr() + " attribute."
73+
from CtorAttr source, StdCall sink
74+
where edges*(source, sink)
75+
select sink, source, sink,
76+
"Call to " + sink.toString() + " in a function with the " + source.getWhichAttr() + " attribute."

‎rust/ql/test/query-tests/security/CWE-696/BadCTorInitialization.expected

Lines changed: 28 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -14,41 +14,31 @@
1414
| test.rs:126:9:126:44 | ... .write_all(...) | test.rs:145:1:145:7 | Attr | test.rs:126:9:126:44 | ... .write_all(...) | Call to ... .write_all(...) in a function with the ctor attribute. |
1515
| test.rs:171:5:171:15 | ...::stdout(...) | test.rs:169:1:169:7 | Attr | test.rs:171:5:171:15 | ...::stdout(...) | Call to ...::stdout(...) in a function with the ctor attribute. |
1616
edges
17-
| test.rs:29:1:29:13 | Attr | test.rs:31:9:31:25 | ...::stdout(...) |
18-
| test.rs:29:1:29:13 | Attr | test.rs:31:9:31:49 | ... .write(...) |
19-
| test.rs:34:1:34:13 | Attr | test.rs:36:9:36:25 | ...::stdout(...) |
20-
| test.rs:34:1:34:13 | Attr | test.rs:36:9:36:49 | ... .write(...) |
21-
| test.rs:40:1:40:13 | Attr | test.rs:43:9:43:25 | ...::stdout(...) |
22-
| test.rs:40:1:40:13 | Attr | test.rs:43:9:43:49 | ... .write(...) |
23-
| test.rs:51:1:51:7 | Attr | test.rs:53:9:53:16 | stdout(...) |
24-
| test.rs:51:1:51:7 | Attr | test.rs:53:9:53:40 | ... .write(...) |
25-
| test.rs:56:1:56:7 | Attr | test.rs:58:9:58:16 | stderr(...) |
26-
| test.rs:56:1:56:7 | Attr | test.rs:58:9:58:44 | ... .write_all(...) |
27-
| test.rs:61:1:61:7 | Attr | test.rs:63:14:63:28 | ...::_print(...) |
28-
| test.rs:66:1:66:7 | Attr | test.rs:68:20:68:32 | ...::new(...) |
29-
| test.rs:66:1:66:7 | Attr | test.rs:69:9:69:24 | ...::stdin(...) |
30-
| test.rs:66:1:66:7 | Attr | test.rs:69:9:69:45 | ... .read_line(...) |
31-
| test.rs:74:1:74:7 | Attr | test.rs:76:17:76:45 | ...::create(...) |
32-
| test.rs:74:1:74:7 | Attr | test.rs:76:17:76:54 | ... .unwrap(...) |
33-
| test.rs:79:1:79:7 | Attr | test.rs:81:14:81:38 | ...::now(...) |
34-
| test.rs:88:1:88:7 | Attr | test.rs:90:5:90:35 | ...::sleep(...) |
35-
| test.rs:95:1:95:7 | Attr | test.rs:97:5:97:23 | ...::exit(...) |
36-
| test.rs:100:1:100:13 | Attr | test.rs:102:5:102:46 | ... .write_nl(...) |
37-
| test.rs:100:1:100:13 | Attr | test.rs:102:5:102:46 | ...::new(...) |
38-
| test.rs:100:1:100:13 | Attr | test.rs:102:31:102:45 | ... .write_fmt(...) |
39-
| test.rs:105:1:105:13 | Attr | test.rs:107:5:107:23 | panic_cold_explicit(...) |
40-
| test.rs:113:1:113:13 | Attr | test.rs:115:18:115:37 | ...::new::<...>(...) |
41-
| test.rs:113:1:113:13 | Attr | test.rs:116:15:116:27 | alloc(...) |
42-
| test.rs:113:1:113:13 | Attr | test.rs:118:9:118:21 | ... .is_null(...) |
43-
| test.rs:113:1:113:13 | Attr | test.rs:119:9:119:28 | dealloc(...) |
44-
| test.rs:129:1:129:7 | Attr | test.rs:131:5:131:20 | call_target3_1(...) |
45-
| test.rs:131:5:131:20 | call_target3_1(...) | test.rs:126:9:126:16 | stderr(...) |
46-
| test.rs:131:5:131:20 | call_target3_1(...) | test.rs:126:9:126:44 | ... .write_all(...) |
47-
| test.rs:140:1:140:7 | Attr | test.rs:142:5:142:20 | call_target3_2(...) |
48-
| test.rs:145:1:145:7 | Attr | test.rs:147:5:147:20 | call_target3_1(...) |
49-
| test.rs:145:1:145:7 | Attr | test.rs:148:5:148:20 | call_target3_2(...) |
50-
| test.rs:147:5:147:20 | call_target3_1(...) | test.rs:126:9:126:16 | stderr(...) |
51-
| test.rs:147:5:147:20 | call_target3_1(...) | test.rs:126:9:126:44 | ... .write_all(...) |
52-
| test.rs:151:1:151:7 | Attr | test.rs:153:5:153:12 | bad3_3(...) |
53-
| test.rs:169:1:169:7 | Attr | test.rs:171:5:171:15 | ... .write(...) |
54-
| test.rs:169:1:169:7 | Attr | test.rs:171:5:171:15 | ...::stdout(...) |
17+
| test.rs:29:1:29:13 | Attr | test.rs:29:1:32:1 | fn bad1_1 |
18+
| test.rs:29:1:32:1 | fn bad1_1 | test.rs:31:9:31:25 | ...::stdout(...) |
19+
| test.rs:34:1:34:13 | Attr | test.rs:34:1:37:1 | fn bad1_2 |
20+
| test.rs:34:1:37:1 | fn bad1_2 | test.rs:36:9:36:25 | ...::stdout(...) |
21+
| test.rs:39:1:44:1 | fn bad1_3 | test.rs:43:9:43:25 | ...::stdout(...) |
22+
| test.rs:40:1:40:13 | Attr | test.rs:39:1:44:1 | fn bad1_3 |
23+
| test.rs:51:1:51:7 | Attr | test.rs:51:1:54:1 | fn bad2_1 |
24+
| test.rs:51:1:54:1 | fn bad2_1 | test.rs:53:9:53:16 | stdout(...) |
25+
| test.rs:56:1:56:7 | Attr | test.rs:56:1:59:1 | fn bad2_2 |
26+
| test.rs:56:1:59:1 | fn bad2_2 | test.rs:58:9:58:16 | stderr(...) |
27+
| test.rs:61:1:61:7 | Attr | test.rs:61:1:64:1 | fn bad2_3 |
28+
| test.rs:61:1:64:1 | fn bad2_3 | test.rs:63:14:63:28 | ...::_print(...) |
29+
| test.rs:66:1:66:7 | Attr | test.rs:66:1:70:1 | fn bad2_4 |
30+
| test.rs:66:1:70:1 | fn bad2_4 | test.rs:69:9:69:24 | ...::stdin(...) |
31+
| test.rs:88:1:88:7 | Attr | test.rs:88:1:91:1 | fn bad2_7 |
32+
| test.rs:88:1:91:1 | fn bad2_7 | test.rs:90:5:90:35 | ...::sleep(...) |
33+
| test.rs:95:1:95:7 | Attr | test.rs:95:1:98:1 | fn bad2_8 |
34+
| test.rs:95:1:98:1 | fn bad2_8 | test.rs:97:5:97:23 | ...::exit(...) |
35+
| test.rs:125:1:127:1 | fn call_target3_1 | test.rs:126:9:126:16 | stderr(...) |
36+
| test.rs:125:1:127:1 | fn call_target3_1 | test.rs:126:9:126:44 | ... .write_all(...) |
37+
| test.rs:129:1:129:7 | Attr | test.rs:129:1:132:1 | fn bad3_1 |
38+
| test.rs:129:1:132:1 | fn bad3_1 | test.rs:131:5:131:20 | call_target3_1(...) |
39+
| test.rs:131:5:131:20 | call_target3_1(...) | test.rs:125:1:127:1 | fn call_target3_1 |
40+
| test.rs:145:1:145:7 | Attr | test.rs:145:1:149:1 | fn bad3_3 |
41+
| test.rs:145:1:149:1 | fn bad3_3 | test.rs:147:5:147:20 | call_target3_1(...) |
42+
| test.rs:147:5:147:20 | call_target3_1(...) | test.rs:125:1:127:1 | fn call_target3_1 |
43+
| test.rs:169:1:169:7 | Attr | test.rs:169:1:172:1 | fn bad4_1 |
44+
| test.rs:169:1:172:1 | fn bad4_1 | test.rs:171:5:171:15 | ...::stdout(...) |

0 commit comments

Comments
 (0)