diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll b/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll index 2aa7b553b87..393095e80d9 100644 --- a/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll +++ b/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll @@ -428,6 +428,9 @@ module RustDataFlow implements InputSig { private Function getStaticTargetExt(Call c) { result = c.getStaticTarget() or + // If the static target of an overloaded operation cannot be resolved, we fall + // back to the trait method as the target. This ensures that the flow models + // still apply. not exists(c.getStaticTarget()) and exists(TraitItemNode t, string methodName | c.(Operation).isOverloaded(t, methodName, _) and diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/Node.qll b/rust/ql/lib/codeql/rust/dataflow/internal/Node.qll index e70d7d414d0..cc738d1dc86 100644 --- a/rust/ql/lib/codeql/rust/dataflow/internal/Node.qll +++ b/rust/ql/lib/codeql/rust/dataflow/internal/Node.qll @@ -554,6 +554,8 @@ newtype TNode = e.hasEnclosingCfgScope() and ( isArgumentForCall(e, _, _) and + // For compound assignments into variables like `x += y`, we do not want flow into + // `[post] x`, as that would create spurious flow when `x` is a parameter. not (e = any(CompoundAssignmentExpr cae).getLhs() and e instanceof VariableAccess) or lambdaCallExpr(_, _, e)