Skip to content

Commit 322ef4d

Browse files
paldepindpaldepind
committed
Rust: Account for trait visibility when resolving paths and methods
1 parent c1c7127 commit 322ef4d

File tree

11 files changed

+125
-45
lines changed

11 files changed

+125
-45
lines changed

‎rust/ql/lib/codeql/rust/internal/PathResolution.qll‎

Lines changed: 80 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ abstract class ItemNode extends Locatable {
216216
// items made available through `use` are available to nodes that contain the `use`
217217
exists(UseItemNode use |
218218
use = this.getASuccessor(_, _) and
219-
result = use.(ItemNode).getASuccessor(name, kind)
219+
result = use.getASuccessor(name, kind)
220220
)
221221
or
222222
exists(ExternCrateItemNode ec | result = ec.(ItemNode).getASuccessor(name, kind) |
@@ -240,12 +240,7 @@ abstract class ItemNode extends Locatable {
240240
)
241241
or
242242
// items made available by an implementation where `this` is the implementing type
243-
exists(ItemNode node |
244-
this = node.(ImplItemNodeImpl).resolveSelfTyCand() and
245-
result = node.getASuccessor(name, kind) and
246-
kind.isExternalOrBoth() and
247-
result instanceof AssocItemNode
248-
)
243+
typeImplEdge(this, _, name, kind, result)
249244
or
250245
// trait items with default implementations made available in an implementation
251246
exists(ImplItemNodeImpl impl, ItemNode trait |
@@ -1311,6 +1306,7 @@ private predicate declares(ItemNode item, Namespace ns, string name) {
13111306
class RelevantPath extends Path {
13121307
RelevantPath() { not this = any(VariableAccess va).(PathExpr).getPath() }
13131308

1309+
/** Holds if this is an unqualified path with the textual value `name`. */
13141310
pragma[nomagic]
13151311
predicate isUnqualified(string name) {
13161312
not exists(this.getQualifier()) and
@@ -1421,6 +1417,35 @@ private ItemNode unqualifiedPathLookup(RelevantPath p, Namespace ns, SuccessorKi
14211417
pragma[nomagic]
14221418
private predicate isUnqualifiedSelfPath(RelevantPath path) { path.isUnqualified("Self") }
14231419

1420+
/** Provides the input to `TraitIsVisible`. */
1421+
signature predicate relevantTraitVisibleSig(Element element, Trait trait);
1422+
1423+
/**
1424+
* Provides the `traitIsVisible` predicate for determining if a trait is visible
1425+
* at a given element.
1426+
*/
1427+
module TraitIsVisible<relevantTraitVisibleSig/2 relevantTraitVisible> {
1428+
/** Holds if the trait might be looked up in `encl`. */
1429+
private predicate traitLookup(ItemNode encl, Element element, Trait trait) {
1430+
// lookup in immediately enclosing item
1431+
relevantTraitVisible(element, trait) and
1432+
encl.getADescendant() = element
1433+
or
1434+
// lookup in an outer scope, but only if the trait is not declared in inner scope
1435+
exists(ItemNode mid |
1436+
traitLookup(mid, element, trait) and
1437+
not trait = mid.getASuccessor(_, _) and
1438+
encl = getOuterScope(mid)
1439+
)
1440+
}
1441+
1442+
/** Holds if the trait `trait` is visible at `element`. */
1443+
pragma[nomagic]
1444+
predicate traitIsVisible(Element element, Trait trait) {
1445+
exists(ItemNode encl | traitLookup(encl, element, trait) and trait = encl.getASuccessor(_, _))
1446+
}
1447+
}
1448+
14241449
pragma[nomagic]
14251450
private ItemNode resolvePathCand0(RelevantPath path, Namespace ns) {
14261451
exists(ItemNode res |
@@ -1446,6 +1471,10 @@ private ItemNode resolvePathCandQualifier(RelevantPath qualifier, RelevantPath p
14461471
name = path.getText()
14471472
}
14481473

1474+
/**
1475+
* Gets the item that `path` resolves to in `ns` when `qualifier` is the
1476+
* qualifier of `path` and `qualifier` resolves to `q`, if any.
1477+
*/
14491478
pragma[nomagic]
14501479
private ItemNode resolvePathCandQualified(
14511480
RelevantPath qualifier, ItemNode q, RelevantPath path, Namespace ns
@@ -1520,11 +1549,31 @@ private ItemNode resolvePathCand(RelevantPath path) {
15201549
)
15211550
}
15221551

1552+
/** Get a trait that should be visible when `path` resolves to `node`, if any. */
1553+
private Trait getResolvePathTraitUsed(RelevantPath path, AssocItemNode node) {
1554+
exists(TypeItemNode type, ImplItemNodeImpl impl |
1555+
node = resolvePathCandQualified(_, type, path, _) and
1556+
typeImplEdge(type, impl, _, _, node) and
1557+
result = impl.resolveTraitTyCand()
1558+
)
1559+
}
1560+
1561+
private predicate pathTraitUsed(Element path, Trait trait) {
1562+
trait = getResolvePathTraitUsed(path, _)
1563+
}
1564+
15231565
/** Gets the item that `path` resolves to, if any. */
15241566
cached
15251567
ItemNode resolvePath(RelevantPath path) {
15261568
result = resolvePathCand(path) and
1527-
not path = any(Path parent | exists(resolvePathCand(parent))).getQualifier()
1569+
not path = any(Path parent | exists(resolvePathCand(parent))).getQualifier() and
1570+
(
1571+
// When the result is an associated item of a trait implementation the
1572+
// implemented trait must be visible.
1573+
TraitIsVisible<pathTraitUsed/2>::traitIsVisible(path, getResolvePathTraitUsed(path, result))
1574+
or
1575+
not exists(getResolvePathTraitUsed(path, result))
1576+
)
15281577
or
15291578
// if `path` is the qualifier of a resolvable `parent`, then we should
15301579
// resolve `path` to something consistent with what `parent` resolves to
@@ -1606,8 +1655,16 @@ private predicate useImportEdge(Use use, string name, ItemNode item, SuccessorKi
16061655
not tree.hasRename() and
16071656
name = item.getName()
16081657
or
1609-
name = tree.getRename().getName().getText() and
1610-
name != "_"
1658+
exists(Rename rename | rename = tree.getRename() |
1659+
name = rename.getName().getText()
1660+
or
1661+
// When the rename doesn't have a name it's an underscore import. This
1662+
// makes the imported item visible but unnameable. We represent this
1663+
// by using the name `_` which can never occur in a path. See also:
1664+
// https://doc.rust-lang.org/reference/items/use-declarations.html#r-items.use.as-underscore
1665+
not rename.hasName() and
1666+
name = "_"
1667+
)
16111668
)
16121669
)
16131670
)
@@ -1629,6 +1686,18 @@ private predicate externCrateEdge(ExternCrateItemNode ec, string name, CrateItem
16291686
)
16301687
}
16311688

1689+
/**
1690+
* Holds if `typeItem` is the implementing type of `impl` and the implementation
1691+
* makes `assoc` available as `name` at `kind`.
1692+
*/
1693+
private predicate typeImplEdge(
1694+
TypeItemNode typeItem, ImplItemNodeImpl impl, string name, SuccessorKind kind, AssocItemNode assoc
1695+
) {
1696+
typeItem = impl.resolveSelfTyCand() and
1697+
assoc = impl.getASuccessor(name, kind) and
1698+
kind.isExternalOrBoth()
1699+
}
1700+
16321701
pragma[nomagic]
16331702
private predicate preludeItem(string name, ItemNode i) {
16341703
exists(Crate stdOrCore, ModuleLikeNode mod, ModuleItemNode prelude, ModuleItemNode rust |
@@ -1693,7 +1762,7 @@ private module Debug {
16931762
useImportEdge(use, name, item, kind)
16941763
}
16951764

1696-
ItemNode debuggetASuccessor(ItemNode i, string name, SuccessorKind kind) {
1765+
ItemNode debugGetASuccessor(ItemNode i, string name, SuccessorKind kind) {
16971766
i = getRelevantLocatable() and
16981767
result = i.getASuccessor(name, kind)
16991768
}

‎rust/ql/lib/codeql/rust/internal/TypeInference.qll‎

Lines changed: 39 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1891,7 +1891,7 @@ private predicate methodCandidate(Type type, string name, int arity, Impl impl)
18911891
*/
18921892
pragma[nomagic]
18931893
private predicate methodCandidateTrait(Type type, Trait trait, string name, int arity, Impl impl) {
1894-
trait = resolvePath(impl.(ImplItemNode).getTraitPath()) and
1894+
trait = impl.(ImplItemNode).resolveTraitTy() and
18951895
methodCandidate(type, name, arity, impl)
18961896
}
18971897

@@ -1903,19 +1903,53 @@ private predicate isMethodCall(MethodCall mc, Type rootType, string name, int ar
19031903
}
19041904

19051905
private module IsInstantiationOfInput implements IsInstantiationOfInputSig<MethodCall> {
1906+
/** Holds if `mc` specifies a trait and might target a method in `impl`. */
19061907
pragma[nomagic]
1907-
predicate potentialInstantiationOf(MethodCall mc, TypeAbstraction impl, TypeMention constraint) {
1908+
private predicate methodCallTraitCandidate(MethodCall mc, Impl impl) {
19081909
exists(Type rootType, string name, int arity |
19091910
isMethodCall(mc, rootType, name, arity) and
1910-
constraint = impl.(ImplTypeAbstraction).getSelfTy()
1911-
|
19121911
methodCandidateTrait(rootType, mc.getTrait(), name, arity, impl)
1913-
or
1912+
)
1913+
}
1914+
1915+
/** Holds if `mc` does not specify a trait and might target a method in `impl`. */
1916+
pragma[nomagic]
1917+
private predicate methodCallCandidate(MethodCall mc, Impl impl) {
1918+
exists(Type rootType, string name, int arity |
19141919
not exists(mc.getTrait()) and
1920+
isMethodCall(mc, rootType, name, arity) and
19151921
methodCandidate(rootType, name, arity, impl)
19161922
)
19171923
}
19181924

1925+
private predicate relevantTraitVisible(Element mc, Trait trait) {
1926+
trait = any(ImplItemNode impl | methodCallCandidate(mc, impl)).resolveTraitTy()
1927+
}
1928+
1929+
bindingset[impl]
1930+
pragma[inline_late]
1931+
private TypeRepr getImplSelfTy(Impl impl) { result = impl.getSelfTy() }
1932+
1933+
pragma[nomagic]
1934+
predicate potentialInstantiationOf(MethodCall mc, TypeAbstraction impl, TypeMention constraint) {
1935+
constraint = getImplSelfTy(impl) and
1936+
(
1937+
methodCallTraitCandidate(mc, impl)
1938+
or
1939+
methodCallCandidate(mc, impl) and
1940+
(
1941+
not exists(impl.(ImplItemNode).resolveTraitTy())
1942+
or
1943+
// If the `impl` block implements a trait, that trait must be visible in
1944+
// order for the `impl` to be valid.
1945+
exists(Trait trait |
1946+
pragma[only_bind_into](trait) = impl.(ImplItemNode).resolveTraitTy() and
1947+
TraitIsVisible<relevantTraitVisible/2>::traitIsVisible(mc, pragma[only_bind_into](trait))
1948+
)
1949+
)
1950+
)
1951+
}
1952+
19191953
predicate relevantTypeMention(TypeMention constraint) {
19201954
exists(Impl impl | methodCandidate(_, _, _, impl) and constraint = impl.getSelfTy())
19211955
}

‎rust/ql/test/library-tests/dataflow/sources/CONSISTENCY/PathResolutionConsistency.expected‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,8 @@ multipleCallTargets
1111
| test.rs:179:30:179:68 | ...::_print(...) |
1212
| test.rs:188:26:188:105 | ...::_print(...) |
1313
| test.rs:229:22:229:72 | ... .read_to_string(...) |
14-
| test.rs:513:22:513:50 | file.read_to_end(...) |
15-
| test.rs:519:22:519:53 | file.read_to_string(...) |
1614
| test.rs:697:18:697:38 | ...::_print(...) |
1715
| test.rs:702:18:702:45 | ...::_print(...) |
18-
| test.rs:706:25:706:49 | address.to_socket_addrs() |
1916
| test.rs:720:38:720:42 | ...::_print(...) |
2017
| test.rs:724:38:724:54 | ...::_print(...) |
2118
| test.rs:729:38:729:51 | ...::_print(...) |
@@ -76,12 +73,6 @@ multipleCallTargets
7673
| test.rs:977:14:977:29 | ...::_print(...) |
7774
| test.rs:979:27:979:36 | ...::_print(...) |
7875
| test.rs:980:28:980:41 | ...::_print(...) |
79-
| test_futures_io.rs:35:26:35:63 | pinned.poll_read(...) |
80-
| test_futures_io.rs:62:22:62:50 | pinned.poll_fill_buf(...) |
81-
| test_futures_io.rs:69:23:69:67 | ... .poll_fill_buf(...) |
82-
| test_futures_io.rs:93:26:93:63 | pinned.poll_read(...) |
83-
| test_futures_io.rs:116:22:116:50 | pinned.poll_fill_buf(...) |
84-
| test_futures_io.rs:145:26:145:49 | ...::with_capacity(...) |
8576
| web_frameworks.rs:13:14:13:22 | a.as_str() |
8677
| web_frameworks.rs:13:14:13:23 | a.as_str() |
8778
| web_frameworks.rs:14:14:14:24 | a.as_bytes() |

‎rust/ql/test/library-tests/path-resolution/CONSISTENCY/PathResolutionConsistency.expected‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
11
multipleCallTargets
22
| main.rs:118:9:118:11 | f(...) |
3-
| main.rs:494:13:494:27 | ...::a_method(...) |
4-
| main.rs:498:13:498:27 | ...::a_method(...) |
5-
| main.rs:502:13:502:27 | ...::a_method(...) |
63
| proc_macro.rs:9:5:9:10 | ...::new(...) |

‎rust/ql/test/library-tests/path-resolution/main.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -492,17 +492,17 @@ mod trait_visibility {
492492
{
493493
// Only the `Foo` trait is visible
494494
use m::Foo; // $ item=Foo
495-
X::a_method(&x); // $ item=X_Foo::a_method SPURIOUS: item=X_Bar::a_method
495+
X::a_method(&x); // $ item=X_Foo::a_method
496496
}
497497
{
498498
// Only the `Bar` trait is visible
499499
use m::Bar; // $ item=Bar
500-
X::a_method(&x); // $ item=X_Bar::a_method SPURIOUS: item=X_Foo::a_method
500+
X::a_method(&x); // $ item=X_Bar::a_method
501501
}
502502
{
503503
// Only the `Bar` trait is visible (but unnameable)
504504
use m::Bar as _; // $ item=Bar
505-
X::a_method(&x); // $ item=X_Bar::a_method SPURIOUS: item=X_Foo::a_method
505+
X::a_method(&x); // $ item=X_Bar::a_method
506506
}
507507
{
508508
// The `Bar` trait is not visible, but we can refer to its method

‎rust/ql/test/library-tests/path-resolution/path-resolution.expected‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -236,16 +236,13 @@ resolvePath
236236
| main.rs:494:17:494:22 | ...::Foo | main.rs:465:9:467:9 | trait Foo |
237237
| main.rs:495:13:495:13 | X | main.rs:473:9:473:21 | struct X |
238238
| main.rs:495:13:495:23 | ...::a_method | main.rs:475:26:478:13 | fn a_method |
239-
| main.rs:495:13:495:23 | ...::a_method | main.rs:481:26:484:13 | fn a_method |
240239
| main.rs:499:17:499:17 | m | main.rs:464:5:486:5 | mod m |
241240
| main.rs:499:17:499:22 | ...::Bar | main.rs:469:9:471:9 | trait Bar |
242241
| main.rs:500:13:500:13 | X | main.rs:473:9:473:21 | struct X |
243-
| main.rs:500:13:500:23 | ...::a_method | main.rs:475:26:478:13 | fn a_method |
244242
| main.rs:500:13:500:23 | ...::a_method | main.rs:481:26:484:13 | fn a_method |
245243
| main.rs:504:17:504:17 | m | main.rs:464:5:486:5 | mod m |
246244
| main.rs:504:17:504:22 | ...::Bar | main.rs:469:9:471:9 | trait Bar |
247245
| main.rs:505:13:505:13 | X | main.rs:473:9:473:21 | struct X |
248-
| main.rs:505:13:505:23 | ...::a_method | main.rs:475:26:478:13 | fn a_method |
249246
| main.rs:505:13:505:23 | ...::a_method | main.rs:481:26:484:13 | fn a_method |
250247
| main.rs:510:13:510:13 | m | main.rs:464:5:486:5 | mod m |
251248
| main.rs:510:13:510:18 | ...::Bar | main.rs:469:9:471:9 | trait Bar |

‎rust/ql/test/library-tests/type-inference/CONSISTENCY/PathResolutionConsistency.expected‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
multipleCallTargets
22
| dereference.rs:61:15:61:24 | e1.deref() |
3-
| main.rs:153:13:153:24 | x.a_method() |
4-
| main.rs:157:13:157:24 | x.a_method() |
5-
| main.rs:161:13:161:24 | x.a_method() |
63
| main.rs:2357:13:2357:31 | ...::from(...) |
74
| main.rs:2358:13:2358:31 | ...::from(...) |
85
| main.rs:2359:13:2359:31 | ...::from(...) |

‎rust/ql/test/library-tests/type-inference/main.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -150,15 +150,15 @@ mod trait_visibility {
150150
let x = X;
151151
{
152152
use m::Foo;
153-
x.a_method(); // $ target=Foo::a_method SPURIOUS: target=Bar::a_method
153+
x.a_method(); // $ target=Foo::a_method
154154
}
155155
{
156156
use m::Bar;
157-
x.a_method(); // $ target=Bar::a_method SPURIOUS: target=Foo::a_method
157+
x.a_method(); // $ target=Bar::a_method
158158
}
159159
{
160160
use m::Bar as _;
161-
x.a_method(); // $ target=Bar::a_method SPURIOUS: target=Foo::a_method
161+
x.a_method(); // $ target=Bar::a_method
162162
}
163163
{
164164
use m::Bar;

‎rust/ql/test/query-tests/security/CWE-117/CONSISTENCY/PathResolutionConsistency.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,2 @@
11
multipleCallTargets
22
| main.rs:9:43:9:63 | ...::from(...) |
3-
| main.rs:44:19:44:32 | username.len() |

‎rust/ql/test/query-tests/security/CWE-312/CONSISTENCY/PathResolutionConsistency.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,6 @@ multipleCallTargets
7272
| test_logging.rs:195:15:195:38 | ...::_eprint(...) |
7373
| test_logging.rs:229:30:229:71 | ... .as_str() |
7474
| test_logging.rs:242:16:242:61 | ... .as_bytes() |
75-
| test_logging.rs:243:5:245:66 | ... .write_all(...) |
7675
| test_logging.rs:245:20:245:65 | ... .as_bytes() |
7776
| test_logging.rs:248:15:248:60 | ... .as_bytes() |
7877
| test_logging.rs:251:15:251:60 | ... .as_bytes() |

0 commit comments

Comments
 (0)