From 8bfce6b28475e178bad4914636d9a1a4e25c3028 Mon Sep 17 00:00:00 2001
From: Simon Friis Vindum <simonfv@gmail.com>
Date: Mon, 12 Jan 2026 10:21:27 +0100
Subject: [PATCH] Shared, rust: Add option to disable reads steps as taint
 steps in model generator

---
 rust/ql/src/utils/modelgenerator/internal/CaptureModels.qll   | 2 ++
 .../codeql/mad/modelgenerator/internal/ModelGeneratorImpl.qll | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/rust/ql/src/utils/modelgenerator/internal/CaptureModels.qll b/rust/ql/src/utils/modelgenerator/internal/CaptureModels.qll
index 02cd1d70d46..95cde0a8637 100644
--- a/rust/ql/src/utils/modelgenerator/internal/CaptureModels.qll
+++ b/rust/ql/src/utils/modelgenerator/internal/CaptureModels.qll
@@ -113,6 +113,8 @@ module ModelGeneratorCommonInput implements
     c.(SingletonContentSet).getContent() instanceof ElementContent
   }
 
+  predicate applyReadStepsAsTaintSteps() { none() }
+
   string partialModelRow(Callable api, int i) { i = 0 and result = api.getCanonicalPath() }
 
   string partialNeutralModelRow(Callable api, int i) { result = partialModelRow(api, i) }
diff --git a/shared/mad/codeql/mad/modelgenerator/internal/ModelGeneratorImpl.qll b/shared/mad/codeql/mad/modelgenerator/internal/ModelGeneratorImpl.qll
index 8abe4563580..ca60fb637c9 100644
--- a/shared/mad/codeql/mad/modelgenerator/internal/ModelGeneratorImpl.qll
+++ b/shared/mad/codeql/mad/modelgenerator/internal/ModelGeneratorImpl.qll
@@ -115,6 +115,9 @@ signature module ModelGeneratorCommonInputSig<LocationSig Location, InputSig<Loc
    */
   predicate containerContent(Lang::ContentSet c);
 
+  /** Holds if read steps should heuristically be applied as taint steps. */
+  default predicate applyReadStepsAsTaintSteps() { any() }
+
   /**
    * Gets the parameter position of the return kind, if any.
    */
@@ -1061,6 +1064,7 @@ module MakeModelGeneratorFactory<
   private predicate isRelevantTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
     exists(DataFlow::ContentSet f |
       DataFlow::readStep(node1, f, node2) and
+      applyReadStepsAsTaintSteps() and
       // Partially restrict the content types used for intermediate steps.
       (not exists(getUnderlyingContentType(f)) or isRelevantTypeInContent(f))
     )