Skip to content

Rust: Add neutral models (map, from) #21375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
geoffw0 wants to merge 11 commits into
base: main
Choose a base branch
from
+358 −139
Open

Rust: Add neutral models (map, from) #21375

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
1213369
Rust: Add test cases for log injection with map.
geoffw0 Jan 23, 2026
97f7a26
Rust: Add test cases for log injection + uncontrolled allocation size…
geoffw0 Feb 25, 2026
53e8863
Rust: Add a neutral model of Option::map (so that we don't use the ge…
geoffw0 Feb 3, 2026
5c108e5
Rust: Add a manual model for flow through Option::map.
geoffw0 Feb 3, 2026
75fea42
Rust: Add neutral models of From::from (corresponding with existing g…
geoffw0 Feb 26, 2026
75ffb5f
Rust: Change note.
geoffw0 Feb 26, 2026
78f855d
Rust: Make the manual model for Option::map more accurate.
geoffw0 Feb 26, 2026
96a06be
Rust: Accept consistency check changes.
geoffw0 Feb 26, 2026
ec0b90f
Rust: Simplify with the Copilot suggestions.
geoffw0 Feb 26, 2026
062fbf2
Rust: Accept consistency check changes from CI.
geoffw0 Feb 26, 2026
bb5bfda
Rust: Update the models.
geoffw0 Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions rust/ql/lib/change-notes/2026-02-26-neutral-models-map-from.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added neutral models to inhibit spurious generated sink models for `map` and `from`. This fixes some false positive query results.
13 changes: 13 additions & 0 deletions rust/ql/lib/codeql/rust/frameworks/stdlib/core.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,9 @@ extensions:
- ["<_ as core::iter::traits::iterator::Iterator>::chain", "Argument[self]", "ReturnValue", "taint", "manual"]
- ["<_ as core::iter::traits::iterator::Iterator>::chain", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["<_ as core::iter::traits::iterator::Iterator>::take", "Argument[self]", "ReturnValue", "taint", "manual"]
# Option
- ["<core::option::Option>::map", "Argument[self].Field[core::option::Option::Some(0)]", "Argument[0].Parameter[0]", "value", "manual"]
- ["<core::option::Option>::map", "Argument[0].ReturnValue", "ReturnValue.Field[core::option::Option::Some(0)]", "value", "manual"]
# Pin
- ["<core::pin::Pin>::new", "Argument[0]", "ReturnValue.Field[core::pin::Pin::pointer]", "value", "manual"]
# This model is not precise, but helps in cases where a `Pin` is implicitly dereferenced.
Expand Down Expand Up @@ -157,6 +160,16 @@ extensions:
- ["core::ptr::write_bytes", "Argument[0]", "pointer-access", "manual"]
- ["core::ptr::write_unaligned", "Argument[0]", "pointer-access", "manual"]
- ["core::ptr::write_volatile", "Argument[0]", "pointer-access", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: neutralModel
data:
- ["<core::option::Option>::map", "sink", "manual"]
- ["<alloc::vec::Vec as core::convert::From>::from", "sink", "manual"]
- ["<alloc::collections::vec_deque::VecDeque as core::convert::From>::from", "sink", "manual"]
- ["<std::io::error::Error as core::convert::From>::from", "sink", "manual"]
- ["<alloc::sync::Arc as core::convert::From>::from", "sink", "manual"]
- ["<alloc::rc::Rc as core::convert::From>::from", "sink", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: excludeFieldTaintStep
Expand Down
2 changes: 2 additions & 0 deletions rust/ql/test/query-tests/security/CWE-117/CONSISTENCY/PathResolutionConsistency.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
multipleResolvedTargets
| main.rs:123:28:123:48 | ...::from(...) |
129 changes: 125 additions & 4 deletions rust/ql/test/query-tests/security/CWE-117/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading