hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 16:25:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Rust: Fill gaps in the tokio models.

Browse Source
This commit is contained in:
Geoffrey White
2025-08-21 11:00:46 +01:00
parent 29e7b6ad2c
commit 16e0de0cfb
3 changed files with 86 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
rust/ql/lib/codeql/rust/frameworks/tokio/fs.model.yml
View File

@@ -9,3 +9,42 @@ extensions:
- ["<tokio::fs::read_dir::DirEntry>::path", "ReturnValue", "file", "manual"]
- ["<tokio::fs::read_dir::DirEntry>::file_name", "ReturnValue", "file", "manual"]
- ["<tokio::fs::file::File>::open", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "file", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
data:
- ["tokio::fs::copy::copy", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::copy::copy", "Argument[1]", "path-injection", "manual"]
- ["tokio::fs::create_dir::create_dir", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::create_dir_all::create_dir_all", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::hard_link::hard_link", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::hard_link::hard_link", "Argument[1]", "path-injection", "manual"]
- ["tokio::fs::metadata::metadata", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::read::read", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::read_dir::read_dir", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::read_link::read_link", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::read_to_string::read_to_string", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::remove_dir::remove_dir", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::remove_dir_all::remove_dir_all", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::remove_file::remove_file", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::rename::rename", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::rename::rename", "Argument[1]", "path-injection", "manual"]
- ["tokio::fs::set_permissions::set_permissions", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::symlink::symlink", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::symlink::symlink", "Argument[1]", "path-injection", "manual"]
- ["tokio::fs::symlink_dir::symlink_dir", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::symlink_dir::symlink_dir", "Argument[1]", "path-injection", "manual"]
- ["tokio::fs::symlink_file::symlink_file", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::symlink_file::symlink_file", "Argument[1]", "path-injection", "manual"]
- ["tokio::fs::symlink_metadata::symlink_metadata", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::try_exists::try_exists", "Argument[0]", "path-injection", "manual"]
- ["tokio::fs::write::write", "Argument[0]", "path-injection", "manual"]
- ["<tokio::fs::dir_builder::DirBuilder>::create", "Argument[0]", "path-injection", "manual"]
- ["<tokio::fs::file::File>::create", "Argument[0]", "path-injection", "manual"]
- ["<tokio::fs::file::File>::create_new", "Argument[0]", "path-injection", "manual"]
- ["<tokio::fs::file::File>::open", "Argument[0]", "path-injection", "manual"]
- addsTo:
pack: codeql/rust-all
extensible: summaryModel
data:
- ["tokio::fs::canonicalize::canonicalize", "Argument[0]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]

63
rust/ql/test/query-tests/security/CWE-022/TaintedPath.expected
View File

@@ -2,48 +2,59 @@
| src/main.rs:11:5:11:22 | ...::read_to_string | src/main.rs:7:11:7:19 | file_name | src/main.rs:11:5:11:22 | ...::read_to_string | This path depends on a $@. | src/main.rs:7:11:7:19 | file_name | user-provided value |
| src/main.rs:104:13:104:31 | ...::open | src/main.rs:103:17:103:30 | ...::args | src/main.rs:104:13:104:31 | ...::open | This path depends on a $@. | src/main.rs:103:17:103:30 | ...::args | user-provided value |
| src/main.rs:107:13:107:31 | ...::open | src/main.rs:103:17:103:30 | ...::args | src/main.rs:107:13:107:31 | ...::open | This path depends on a $@. | src/main.rs:103:17:103:30 | ...::args | user-provided value |
| src/main.rs:110:13:110:33 | ...::open | src/main.rs:103:17:103:30 | ...::args | src/main.rs:110:13:110:33 | ...::open | This path depends on a $@. | src/main.rs:103:17:103:30 | ...::args | user-provided value |
| src/main.rs:113:13:113:37 | ...::open | src/main.rs:103:17:103:30 | ...::args | src/main.rs:113:13:113:37 | ...::open | This path depends on a $@. | src/main.rs:103:17:103:30 | ...::args | user-provided value |
edges
| src/main.rs:7:11:7:19 | file_name | src/main.rs:9:35:9:43 | file_name | provenance | |
| src/main.rs:9:9:9:17 | file_path | src/main.rs:11:24:11:32 | file_path | provenance | |
| src/main.rs:9:21:9:44 | ...::from(...) | src/main.rs:9:9:9:17 | file_path | provenance | |
| src/main.rs:9:35:9:43 | file_name | src/main.rs:9:21:9:44 | ...::from(...) | provenance | MaD:9 |
| src/main.rs:9:35:9:43 | file_name | src/main.rs:9:21:9:44 | ...::from(...) | provenance | MaD:9 |
| src/main.rs:11:24:11:32 | file_path | src/main.rs:11:5:11:22 | ...::read_to_string | provenance | MaD:3 Sink:MaD:3 |
| src/main.rs:9:35:9:43 | file_name | src/main.rs:9:21:9:44 | ...::from(...) | provenance | MaD:10 |
| src/main.rs:9:35:9:43 | file_name | src/main.rs:9:21:9:44 | ...::from(...) | provenance | MaD:10 |
| src/main.rs:11:24:11:32 | file_path | src/main.rs:11:5:11:22 | ...::read_to_string | provenance | MaD:4 Sink:MaD:4 |
| src/main.rs:103:9:103:13 | path1 | src/main.rs:104:33:104:37 | path1 | provenance | |
| src/main.rs:103:9:103:13 | path1 | src/main.rs:106:39:106:43 | path1 | provenance | |
| src/main.rs:103:9:103:13 | path1 | src/main.rs:109:41:109:45 | path1 | provenance | |
| src/main.rs:103:9:103:13 | path1 | src/main.rs:112:45:112:49 | path1 | provenance | |
| src/main.rs:103:17:103:30 | ...::args | src/main.rs:103:17:103:32 | ...::args(...) [element] | provenance | Src:MaD:4 |
| src/main.rs:103:17:103:32 | ...::args(...) [element] | src/main.rs:103:17:103:39 | ... .nth(...) [Some] | provenance | MaD:6 |
| src/main.rs:103:17:103:39 | ... .nth(...) [Some] | src/main.rs:103:17:103:48 | ... .unwrap() | provenance | MaD:7 |
| src/main.rs:103:17:103:30 | ...::args | src/main.rs:103:17:103:32 | ...::args(...) [element] | provenance | Src:MaD:5 |
| src/main.rs:103:17:103:32 | ...::args(...) [element] | src/main.rs:103:17:103:39 | ... .nth(...) [Some] | provenance | MaD:7 |
| src/main.rs:103:17:103:39 | ... .nth(...) [Some] | src/main.rs:103:17:103:48 | ... .unwrap() | provenance | MaD:8 |
| src/main.rs:103:17:103:48 | ... .unwrap() | src/main.rs:103:9:103:13 | path1 | provenance | |
| src/main.rs:104:33:104:37 | path1 | src/main.rs:104:33:104:45 | path1.clone() | provenance | MaD:5 |
| src/main.rs:104:33:104:37 | path1 | src/main.rs:104:33:104:45 | path1.clone() | provenance | MaD:6 |
| src/main.rs:104:33:104:45 | path1.clone() | src/main.rs:104:13:104:31 | ...::open | provenance | MaD:2 Sink:MaD:2 |
| src/main.rs:106:9:106:13 | path2 | src/main.rs:107:33:107:37 | path2 | provenance | |
| src/main.rs:106:17:106:52 | ...::canonicalize(...) [Ok] | src/main.rs:106:17:106:61 | ... .unwrap() | provenance | MaD:8 |
| src/main.rs:106:17:106:52 | ...::canonicalize(...) [Ok] | src/main.rs:106:17:106:61 | ... .unwrap() | provenance | MaD:9 |
| src/main.rs:106:17:106:61 | ... .unwrap() | src/main.rs:106:9:106:13 | path2 | provenance | |
| src/main.rs:106:39:106:43 | path1 | src/main.rs:106:39:106:51 | path1.clone() | provenance | MaD:5 |
| src/main.rs:106:39:106:51 | path1.clone() | src/main.rs:106:17:106:52 | ...::canonicalize(...) [Ok] | provenance | MaD:11 |
| src/main.rs:106:39:106:43 | path1 | src/main.rs:106:39:106:51 | path1.clone() | provenance | MaD:6 |
| src/main.rs:106:39:106:51 | path1.clone() | src/main.rs:106:17:106:52 | ...::canonicalize(...) [Ok] | provenance | MaD:12 |
| src/main.rs:107:33:107:37 | path2 | src/main.rs:107:13:107:31 | ...::open | provenance | MaD:2 Sink:MaD:2 |
| src/main.rs:109:9:109:13 | path3 | src/main.rs:110:35:110:39 | path3 | provenance | |
| src/main.rs:109:17:109:54 | ...::canonicalize(...) [future, Ok] | src/main.rs:109:17:109:60 | await ... [Ok] | provenance | |
| src/main.rs:109:17:109:60 | await ... [Ok] | src/main.rs:109:17:109:69 | ... .unwrap() | provenance | MaD:9 |
| src/main.rs:109:17:109:69 | ... .unwrap() | src/main.rs:109:9:109:13 | path3 | provenance | |
| src/main.rs:109:41:109:45 | path1 | src/main.rs:109:41:109:53 | path1.clone() | provenance | MaD:6 |
| src/main.rs:109:41:109:53 | path1.clone() | src/main.rs:109:17:109:54 | ...::canonicalize(...) [future, Ok] | provenance | MaD:13 |
| src/main.rs:110:35:110:39 | path3 | src/main.rs:110:13:110:33 | ...::open | provenance | MaD:3 Sink:MaD:3 |
| src/main.rs:112:9:112:13 | path4 | src/main.rs:113:39:113:43 | path4 | provenance | |
| src/main.rs:112:17:112:58 | ...::canonicalize(...) [future, Ok] | src/main.rs:112:17:112:64 | await ... [Ok] | provenance | |
| src/main.rs:112:17:112:64 | await ... [Ok] | src/main.rs:112:17:112:73 | ... .unwrap() | provenance | MaD:8 |
| src/main.rs:112:17:112:64 | await ... [Ok] | src/main.rs:112:17:112:73 | ... .unwrap() | provenance | MaD:9 |
| src/main.rs:112:17:112:73 | ... .unwrap() | src/main.rs:112:9:112:13 | path4 | provenance | |
| src/main.rs:112:45:112:49 | path1 | src/main.rs:112:45:112:57 | path1.clone() | provenance | MaD:5 |
| src/main.rs:112:45:112:57 | path1.clone() | src/main.rs:112:17:112:58 | ...::canonicalize(...) [future, Ok] | provenance | MaD:10 |
| src/main.rs:112:45:112:49 | path1 | src/main.rs:112:45:112:57 | path1.clone() | provenance | MaD:6 |
| src/main.rs:112:45:112:57 | path1.clone() | src/main.rs:112:17:112:58 | ...::canonicalize(...) [future, Ok] | provenance | MaD:11 |
| src/main.rs:113:39:113:43 | path4 | src/main.rs:113:13:113:37 | ...::open | provenance | MaD:1 Sink:MaD:1 |
models
| 1 | Sink: <async_std::fs::file::File>::open; Argument[0]; path-injection |
| 2 | Sink: <std::fs::File>::open; Argument[0]; path-injection |
| 3 | Sink: std::fs::read_to_string; Argument[0]; path-injection |
| 4 | Source: std::env::args; ReturnValue.Element; commandargs |
| 5 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
| 6 | Summary: <_ as core::iter::traits::iterator::Iterator>::nth; Argument[self].Element; ReturnValue.Field[core::option::Option::Some(0)]; value |
| 7 | Summary: <core::option::Option>::unwrap; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
| 8 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 9 | Summary: <std::path::PathBuf as core::convert::From>::from; Argument[0]; ReturnValue; taint |
| 10 | Summary: async_std::fs::canonicalize::canonicalize; Argument[0]; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
| 11 | Summary: std::fs::canonicalize; Argument[0]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
| 3 | Sink: <tokio::fs::file::File>::open; Argument[0]; path-injection |
| 4 | Sink: std::fs::read_to_string; Argument[0]; path-injection |
| 5 | Source: std::env::args; ReturnValue.Element; commandargs |
| 6 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
| 7 | Summary: <_ as core::iter::traits::iterator::Iterator>::nth; Argument[self].Element; ReturnValue.Field[core::option::Option::Some(0)]; value |
| 8 | Summary: <core::option::Option>::unwrap; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
| 9 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 10 | Summary: <std::path::PathBuf as core::convert::From>::from; Argument[0]; ReturnValue; taint |
| 11 | Summary: async_std::fs::canonicalize::canonicalize; Argument[0]; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
| 12 | Summary: std::fs::canonicalize; Argument[0]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
| 13 | Summary: tokio::fs::canonicalize::canonicalize; Argument[0]; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
nodes
| src/main.rs:7:11:7:19 | file_name | semmle.label | file_name |
| src/main.rs:9:9:9:17 | file_path | semmle.label | file_path |
@@ -66,6 +77,14 @@ nodes
| src/main.rs:106:39:106:51 | path1.clone() | semmle.label | path1.clone() |
| src/main.rs:107:13:107:31 | ...::open | semmle.label | ...::open |
| src/main.rs:107:33:107:37 | path2 | semmle.label | path2 |
| src/main.rs:109:9:109:13 | path3 | semmle.label | path3 |
| src/main.rs:109:17:109:54 | ...::canonicalize(...) [future, Ok] | semmle.label | ...::canonicalize(...) [future, Ok] |
| src/main.rs:109:17:109:60 | await ... [Ok] | semmle.label | await ... [Ok] |
| src/main.rs:109:17:109:69 | ... .unwrap() | semmle.label | ... .unwrap() |
| src/main.rs:109:41:109:45 | path1 | semmle.label | path1 |
| src/main.rs:109:41:109:53 | path1.clone() | semmle.label | path1.clone() |
| src/main.rs:110:13:110:33 | ...::open | semmle.label | ...::open |
| src/main.rs:110:35:110:39 | path3 | semmle.label | path3 |
| src/main.rs:112:9:112:13 | path4 | semmle.label | path4 |
| src/main.rs:112:17:112:58 | ...::canonicalize(...) [future, Ok] | semmle.label | ...::canonicalize(...) [future, Ok] |
| src/main.rs:112:17:112:64 | await ... [Ok] | semmle.label | await ... [Ok] |

12
rust/ql/test/query-tests/security/CWE-022/src/main.rs
View File

@@ -107,7 +107,7 @@ async fn more_simple_cases() {
let _ = std::fs::File::open(path2); // $ path-injection-sink Alert[rust/path-injection]=arg1
let path3 = tokio::fs::canonicalize(path1.clone()).await.unwrap();
let _ = tokio::fs::File::open(path3); // $ MISSING: path-injection-sink Alert[rust/path-injection]=arg1
let _ = tokio::fs::File::open(path3); // $ path-injection-sink Alert[rust/path-injection]=arg1
let path4 = async_std::fs::canonicalize(path1.clone()).await.unwrap();
let _ = async_std::fs::File::open(path4); // $ path-injection-sink Alert[rust/path-injection]=arg1
@@ -146,11 +146,11 @@ fn sinks(path1: &Path, path2: &Path) {
let _ = std::fs::DirBuilder::new().recursive(true).create(path1); // $ path-injection-sink
let _ = std::fs::OpenOptions::new().open(path1); // $ MISSING: path-injection-sink
let _ = tokio::fs::read(path1); // $ MISSING: path-injection-sink
let _ = tokio::fs::read_to_string(path1); // $ MISSING: path-injection-sink
let _ = tokio::fs::remove_file(path1); // $ MISSING: path-injection-sink
let _ = tokio::fs::DirBuilder::new().create(path1); // $ MISSING: path-injection-sink
let _ = tokio::fs::DirBuilder::new().recursive(true).create(path1); // $ MISSING: path-injection-sink
let _ = tokio::fs::read(path1); // $ path-injection-sink
let _ = tokio::fs::read_to_string(path1); // $ path-injection-sink
let _ = tokio::fs::remove_file(path1); // $ path-injection-sink
let _ = tokio::fs::DirBuilder::new().create(path1); // $ path-injection-sink
let _ = tokio::fs::DirBuilder::new().recursive(true).create(path1); // $ path-injection-sink
let _ = tokio::fs::OpenOptions::new().open(path1); // $ MISSING: path-injection-sink
let _ = async_std::fs::read(path1); // $ path-injection-sink