hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 08:43:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Rust: Apply same filtering of generated summaries as in C# and Java

Browse Source
This commit is contained in:
Tom Hvitved
2025-12-12 09:55:23 +01:00
parent c4a8e9df21
commit 0b81d44ec7
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
View File

@@ -60,7 +60,7 @@ private module DispatchImpl {
not ( not (
// Only use summarized callables with generated summaries in case // Only use summarized callables with generated summaries in case
// the static call target is not in the source code. // the static call target is not in the source code.
// Note that if applyGeneratedModel holds it implies that there doesn't // Note that if `applyGeneratedModel` holds it implies that there doesn't
// exist a manual model. // exist a manual model.
exists(Callable staticTarget | staticTarget = call.getCallee().getSourceDeclaration() | exists(Callable staticTarget | staticTarget = call.getCallee().getSourceDeclaration() |
staticTarget.fromSource() and not staticTarget.isStub() staticTarget.fromSource() and not staticTarget.isStub()

10
rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll
View File

@@ -445,7 +445,15 @@ module RustDataFlow implements InputSig<Location> {
or or
exists(SummarizedCallable sc, Function staticTarget | exists(SummarizedCallable sc, Function staticTarget |
staticTarget = getStaticTargetExt(c) and staticTarget = getStaticTargetExt(c) and
sc = result.asSummarizedCallable() sc = result.asSummarizedCallable() and
// Only use summarized callables with generated summaries in case
// the static call target is not in the source code.
// Note that if `applyGeneratedModel` holds it implies that there doesn't
// exist a manual model.
not (
staticTarget.fromSource() and
sc.applyGeneratedModel()
)
| |
sc = staticTarget sc = staticTarget
or or