Rust: fix QL references for schema changes and add upgrade/downgrade scripts

- Fix Meta usage: Meta is now abstract with subtypes (PathMeta, KeyValueMeta, TokenTreeMeta, etc.)
- Fix FormatArgsArg: getName() replaced by getArgName() returning FormatArgsArgName
- Add upgrade script (old → new) and downgrade script (new → old)
- Update Definitions.qll, PathResolution.qll, BadCtorInitialization.ql, FormatTemplateVariableAccessConstructor.qll

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

rust/downgrades/109496fd2f20f28a35e50b110859e74882ee80d6/upgrade.properties

@@ -0,0 +1,29 @@
+description: Downgrade from rust-analyzer 0.0.328 to 0.0.301
+compatibility: partial
+
+format_args_arg_arg_names.rel: delete
+format_args_arg_names.rel: delete
+struct_field_default_vals.rel: delete
+variant_const_args.rel: delete
+try_block_modifiers.rel: delete
+try_block_modifier_is_try.rel: delete
+try_block_modifier_type_reprs.rel: delete
+cfg_atoms.rel: delete
+cfg_attr_meta.rel: delete
+cfg_attr_meta_cfg_predicates.rel: delete
+cfg_attr_meta_metas.rel: delete
+cfg_composites.rel: delete
+cfg_composite_cfg_predicates.rel: delete
+cfg_meta.rel: delete
+cfg_meta_cfg_predicates.rel: delete
+key_value_meta.rel: delete
+key_value_meta_exprs.rel: delete
+key_value_meta_paths.rel: delete
+path_meta.rel: delete
+path_meta_paths.rel: delete
+token_tree_meta.rel: delete
+token_tree_meta_paths.rel: delete
+token_tree_meta_token_trees.rel: delete
+unsafe_meta.rel: delete
+unsafe_meta_is_unsafe.rel: delete
+unsafe_meta_meta.rel: delete

rust/ql/lib/codeql/rust/elements/internal/FormatTemplateVariableAccessConstructor.qll

@@ -35,8 +35,8 @@ private predicate formatArgsHasArg(
 }
 
 pragma[nomagic]
-private predicate formatArgsHasArgName(Raw::FormatArgsExpr parent, string name) {
-  parent.getArg(_).getName().getText() = name
+private predicate formatArgsHasArgName(Raw::FormatArgsExpr parent) {
+  exists(parent.getArg(_).getArgName())
 }
 
 /**
@@ -48,6 +48,6 @@ predicate unboundNamedFormatArgument(
 ) {
   exists(string name |
     formatArgsHasArg(parent, arg, name, index, kind) and
-    not formatArgsHasArgName(parent, name)
+    not formatArgsHasArgName(parent)
   )
 }

rust/ql/lib/codeql/rust/elements/internal/MetaImpl.qll

@@ -1,4 +1,3 @@
-// generated by codegen, remove this comment if you wish to edit this file
 /**
  * This module provides a hand-modifiable wrapper around the generated class `Meta`.
  *

rust/ql/lib/codeql/rust/internal/Definitions.qll

@@ -8,6 +8,7 @@ private import codeql.rust.elements.Variable
 private import codeql.rust.elements.Locatable
 private import codeql.rust.elements.FormatArgsExpr
 private import codeql.rust.elements.FormatArgsArg
+private import codeql.rust.elements.FormatArgsArgName
 private import codeql.rust.elements.Format
 private import codeql.rust.elements.MacroCall
 private import codeql.rust.elements.NamedFormatArgument
@@ -33,7 +34,7 @@ private module Cached {
   cached
   newtype TDef =
     TVariable(Variable v) or
-    TFormatArgsArgName(Name name) { name = any(FormatArgsArg a).getName() } or
+    TFormatArgsArgDef(FormatArgsArgName name) { name = any(FormatArgsArg a).getArgName() } or
     TFormatArgsArgIndex(Expr e) { e = any(FormatArgsArg a).getExpr() } or
     TItemNode(ItemNode i)
 
@@ -58,7 +59,7 @@ class Definition extends Cached::TDef {
   /** Gets the location of this variable. */
   Location getLocation() {
     result = this.asVariable().getLocation() or
-    result = this.asName().getLocation() or
+    result = this.asFormatArgsArgName().getLocation() or
     result = this.asExpr().getLocation() or
     result = this.asItemNode().getLocation()
   }
@@ -66,8 +67,8 @@ class Definition extends Cached::TDef {
   /** Gets this definition as a `Variable` */
   Variable asVariable() { this = Cached::TVariable(result) }
 
-  /** Gets this definition as a `Name` */
-  Name asName() { this = Cached::TFormatArgsArgName(result) }
+  /** Gets this definition as a format argument name */
+  FormatArgsArgName asFormatArgsArgName() { this = Cached::TFormatArgsArgDef(result) }
 
   /** Gets this definition as an `Expr` */
   Expr asExpr() { this = Cached::TFormatArgsArgIndex(result) }
@@ -79,7 +80,7 @@ class Definition extends Cached::TDef {
   string toString() {
     result = this.asExpr().toString() or
     result = this.asVariable().toString() or
-    result = this.asName().getText() or
+    result = this.asFormatArgsArgName().toString() or
     result = this.asItemNode().toString()
   }
 }
@@ -95,17 +96,16 @@ private class LocalVariableUse extends Use instanceof VariableAccess {
 }
 
 private class NamedFormatArgumentUse extends Use instanceof NamedFormatArgument {
-  private Name def;
+  private FormatArgsArgName def;
 
   NamedFormatArgumentUse() {
     exists(FormatArgsExpr parent |
       parent = this.getParent().getParent() and
-      parent.getAnArg().getName() = def and
-      this.getName() = def.getText()
+      parent.getAnArg().getArgName() = def
     )
   }
 
-  override Definition getDefinition() { result.asName() = def }
+  override Definition getDefinition() { result.asFormatArgsArgName() = def }
 
   override string getUseType() { result = "format argument" }
 }

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -49,6 +49,20 @@ private import codeql.rust.internal.CachedStages
 private import codeql.rust.frameworks.stdlib.Builtins as Builtins
 private import codeql.util.Option
 
+/** Gets the path of a `Meta` node, regardless of its concrete subtype. */
+pragma[nomagic]
+private Path getMetaPath(Meta m) {
+  result = m.(PathMeta).getPath()
+  or
+  result = m.(KeyValueMeta).getPath()
+  or
+  result = m.(TokenTreeMeta).getPath()
+}
+
+/** Gets the expression of a `Meta` node, regardless of its concrete subtype. */
+pragma[nomagic]
+private Expr getMetaExpr(Meta m) { result = m.(KeyValueMeta).getExpr() }
+
 private newtype TNamespace =
   TTypeNamespace() or
   TValueNamespace() or
@@ -263,7 +277,7 @@ abstract class ItemNode extends Locatable {
   pragma[nomagic]
   final Attr getAttr(string name) {
     result = this.getAnAttr() and
-    result.getMeta().getPath().(PathExt).isUnqualified(name)
+    getMetaPath(result.getMeta()).(PathExt).isUnqualified(name)
   }
 
   final predicate hasAttr(string name) { exists(this.getAttr(name)) }
@@ -1348,7 +1362,7 @@ private predicate fileModuleInlineLate(SourceFile f, string name, Folder folder)
  */
 private Meta getPathAttrMeta(Module m) {
   result = m.getAnAttr().getMeta() and
-  result.getPath().getText() = "path"
+  getMetaPath(result).getText() = "path"
 }
 
 /**
@@ -1412,7 +1426,7 @@ private predicate pathAttrImport(Folder f, Module m, string relativePath) {
   exists(Meta meta |
     f = m.getFile().getParentContainer() and
     meta = getPathAttrMeta(m) and
-    relativePath = meta.getExpr().(LiteralExpr).getTextValue().regexpCapture("\"(.+)\"", 1)
+    relativePath = getMetaExpr(meta).(LiteralExpr).getTextValue().regexpCapture("\"(.+)\"", 1)
   )
 }
 
@@ -1793,7 +1807,7 @@ private module DollarCrateResolution {
     or
     exists(ItemNode type |
       expansion = type.(TypeItem).getDeriveMacroExpansion(_) and
-      macroDefPath = type.getAttr("derive").getMeta().getPath()
+      macroDefPath = getMetaPath(type.getAttr("derive").getMeta())
     )
   }
 
@@ -1952,7 +1966,7 @@ private predicate pathUsesNamespace(PathExt p, Namespace n) {
   (
     p = any(MacroCall mc).getPath()
     or
-    p = any(Meta m).getPath()
+    p = getMetaPath(any(Meta m))
   )
 }
 

rust/ql/lib/upgrades/66a489863649185f4a9770f894505803059a1312/upgrade.properties

@@ -0,0 +1,19 @@
+description: Upgrade from rust-analyzer 0.0.301 to 0.0.328
+compatibility: partial
+
+block_expr_is_try.rel: delete
+meta.rel: delete
+meta_exprs.rel: delete
+meta_is_unsafe.rel: delete
+meta_paths.rel: delete
+meta_token_trees.rel: delete
+format_args_arg_names.rel: delete
+struct_field_defaults.rel: delete
+variant_discriminants.rel: delete
+trait_aliases.rel: delete
+trait_alias_attrs.rel: delete
+trait_alias_generic_param_lists.rel: delete
+trait_alias_names.rel: delete
+trait_alias_type_bound_lists.rel: delete
+trait_alias_visibilities.rel: delete
+trait_alias_where_clauses.rel: delete

rust/ql/src/queries/security/CWE-696/BadCtorInitialization.ql

@@ -12,6 +12,17 @@
  */
 
 import rust
+private import codeql.rust.elements.PathMeta
+private import codeql.rust.elements.KeyValueMeta
+private import codeql.rust.elements.TokenTreeMeta
+
+private Path getMetaPath(Meta m) {
+  result = m.(PathMeta).getPath()
+  or
+  result = m.(KeyValueMeta).getPath()
+  or
+  result = m.(TokenTreeMeta).getPath()
+}
 
 /**
  * A `#[ctor]` or `#[dtor]` attribute, that is, a source for this query.
@@ -20,7 +31,7 @@ class CtorAttr extends Attr {
   string whichAttr;
 
   CtorAttr() {
-    whichAttr = this.getMeta().getPath().getText() and
+    whichAttr = getMetaPath(this.getMeta()).getText() and
     whichAttr = ["ctor", "dtor"]
   }