From 975843889ad70a7e42cf5c87203d69894816933c Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 24 Feb 2026 16:49:12 +0000
Subject: [PATCH] Rust: Add a test case showing the lack of data flow on flag
 values.

---
 .../query-tests/security/CWE-611/Xxe.expected | 182 +++++++++---------
 .../test/query-tests/security/CWE-611/main.rs |   7 +
 2 files changed, 98 insertions(+), 91 deletions(-)

diff --git a/rust/ql/test/query-tests/security/CWE-611/Xxe.expected b/rust/ql/test/query-tests/security/CWE-611/Xxe.expected
index d86a2726b9c..ea26db0a077 100644
--- a/rust/ql/test/query-tests/security/CWE-611/Xxe.expected
+++ b/rust/ql/test/query-tests/security/CWE-611/Xxe.expected
@@ -1,14 +1,14 @@
 #select
-| main.rs:70:19:70:26 | user_xml | main.rs:144:20:144:33 | ...::args | main.rs:70:19:70:26 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:144:20:144:33 | ...::args | user-provided value |
-| main.rs:75:19:75:26 | user_xml | main.rs:144:20:144:33 | ...::args | main.rs:75:19:75:26 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:144:20:144:33 | ...::args | user-provided value |
-| main.rs:80:19:80:26 | user_xml | main.rs:144:20:144:33 | ...::args | main.rs:80:19:80:26 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:144:20:144:33 | ...::args | user-provided value |
-| main.rs:85:17:85:29 | user_filename | main.rs:145:25:145:38 | ...::args | main.rs:85:17:85:29 | user_filename | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:145:25:145:38 | ...::args | user-provided value |
-| main.rs:90:16:90:23 | user_xml | main.rs:144:20:144:33 | ...::args | main.rs:90:16:90:23 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:144:20:144:33 | ...::args | user-provided value |
-| main.rs:95:15:95:21 | user_fd | main.rs:146:21:146:39 | ...::open | main.rs:95:15:95:21 | user_fd | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:146:21:146:39 | ...::open | user-provided value |
-| main.rs:100:43:100:55 | user_filename | main.rs:145:25:145:38 | ...::args | main.rs:100:43:100:55 | user_filename | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:145:25:145:38 | ...::args | user-provided value |
-| main.rs:105:42:105:49 | user_xml | main.rs:144:20:144:33 | ...::args | main.rs:105:42:105:49 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:144:20:144:33 | ...::args | user-provided value |
-| main.rs:112:9:112:16 | user_xml | main.rs:144:20:144:33 | ...::args | main.rs:112:9:112:16 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:144:20:144:33 | ...::args | user-provided value |
-| main.rs:122:19:122:26 | user_xml | main.rs:144:20:144:33 | ...::args | main.rs:122:19:122:26 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:144:20:144:33 | ...::args | user-provided value |
+| main.rs:70:19:70:26 | user_xml | main.rs:150:20:150:33 | ...::args | main.rs:70:19:70:26 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:150:20:150:33 | ...::args | user-provided value |
+| main.rs:75:19:75:26 | user_xml | main.rs:150:20:150:33 | ...::args | main.rs:75:19:75:26 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:150:20:150:33 | ...::args | user-provided value |
+| main.rs:80:19:80:26 | user_xml | main.rs:150:20:150:33 | ...::args | main.rs:80:19:80:26 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:150:20:150:33 | ...::args | user-provided value |
+| main.rs:85:17:85:29 | user_filename | main.rs:151:25:151:38 | ...::args | main.rs:85:17:85:29 | user_filename | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:151:25:151:38 | ...::args | user-provided value |
+| main.rs:90:16:90:23 | user_xml | main.rs:150:20:150:33 | ...::args | main.rs:90:16:90:23 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:150:20:150:33 | ...::args | user-provided value |
+| main.rs:95:15:95:21 | user_fd | main.rs:152:21:152:39 | ...::open | main.rs:95:15:95:21 | user_fd | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:152:21:152:39 | ...::open | user-provided value |
+| main.rs:100:43:100:55 | user_filename | main.rs:151:25:151:38 | ...::args | main.rs:100:43:100:55 | user_filename | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:151:25:151:38 | ...::args | user-provided value |
+| main.rs:105:42:105:49 | user_xml | main.rs:150:20:150:33 | ...::args | main.rs:105:42:105:49 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:150:20:150:33 | ...::args | user-provided value |
+| main.rs:112:9:112:16 | user_xml | main.rs:150:20:150:33 | ...::args | main.rs:112:9:112:16 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:150:20:150:33 | ...::args | user-provided value |
+| main.rs:122:19:122:26 | user_xml | main.rs:150:20:150:33 | ...::args | main.rs:122:19:122:26 | user_xml | XML parsing depends on a $@ without guarding against external entity expansion. | main.rs:150:20:150:33 | ...::args | user-provided value |
 edges
 | main.rs:68:25:68:38 | ...: ... [&ref] | main.rs:70:19:70:26 | user_xml | provenance |  |
 | main.rs:73:27:73:40 | ...: ... [&ref] | main.rs:75:19:75:26 | user_xml | provenance |  |
@@ -20,50 +20,50 @@ edges
 | main.rs:103:31:103:44 | ...: ... [&ref] | main.rs:105:42:105:49 | user_xml | provenance |  |
 | main.rs:108:34:108:47 | ...: ... [&ref] | main.rs:112:9:112:16 | user_xml | provenance |  |
 | main.rs:120:29:120:42 | ...: ... [&ref] | main.rs:122:19:122:26 | user_xml | provenance |  |
-| main.rs:144:9:144:16 | user_xml | main.rs:149:27:149:34 | user_xml | provenance |  |
-| main.rs:144:9:144:16 | user_xml | main.rs:150:29:150:36 | user_xml | provenance |  |
-| main.rs:144:9:144:16 | user_xml | main.rs:151:30:151:37 | user_xml | provenance |  |
-| main.rs:144:9:144:16 | user_xml | main.rs:153:28:153:35 | user_xml | provenance |  |
-| main.rs:144:9:144:16 | user_xml | main.rs:156:33:156:40 | user_xml | provenance |  |
-| main.rs:144:9:144:16 | user_xml | main.rs:157:36:157:43 | user_xml | provenance |  |
-| main.rs:144:9:144:16 | user_xml | main.rs:158:31:158:38 | user_xml | provenance |  |
-| main.rs:144:20:144:33 | ...::args | main.rs:144:20:144:35 | ...::args(...) [element] | provenance | Src:MaD:2  |
-| main.rs:144:20:144:35 | ...::args(...) [element] | main.rs:144:20:144:42 | ... .nth(...) [Some] | provenance | MaD:3 |
-| main.rs:144:20:144:42 | ... .nth(...) [Some] | main.rs:144:20:144:62 | ... .unwrap_or_default() | provenance | MaD:6 |
-| main.rs:144:20:144:62 | ... .unwrap_or_default() | main.rs:144:9:144:16 | user_xml | provenance |  |
-| main.rs:145:9:145:21 | user_filename | main.rs:152:29:152:41 | user_filename | provenance |  |
-| main.rs:145:9:145:21 | user_filename | main.rs:155:34:155:46 | user_filename | provenance |  |
-| main.rs:145:25:145:38 | ...::args | main.rs:145:25:145:40 | ...::args(...) [element] | provenance | Src:MaD:2  |
-| main.rs:145:25:145:40 | ...::args(...) [element] | main.rs:145:25:145:47 | ... .nth(...) [Some] | provenance | MaD:3 |
-| main.rs:145:25:145:47 | ... .nth(...) [Some] | main.rs:145:25:145:67 | ... .unwrap_or_default() | provenance | MaD:6 |
-| main.rs:145:25:145:67 | ... .unwrap_or_default() | main.rs:145:9:145:21 | user_filename | provenance |  |
-| main.rs:146:9:146:17 | user_file [Some] | main.rs:147:19:147:27 | user_file [Some] | provenance |  |
-| main.rs:146:21:146:39 | ...::open | main.rs:146:21:146:55 | ...::open(...) [Ok] | provenance | Src:MaD:1  |
-| main.rs:146:21:146:55 | ...::open(...) [Ok] | main.rs:146:21:146:60 | ... .ok() [Some] | provenance | MaD:7 |
-| main.rs:146:21:146:60 | ... .ok() [Some] | main.rs:146:9:146:17 | user_file [Some] | provenance |  |
-| main.rs:147:9:147:15 | user_fd [&ref] | main.rs:154:26:154:32 | user_fd [&ref] | provenance |  |
-| main.rs:147:19:147:27 | user_file [Some] | main.rs:147:19:147:36 | user_file.as_ref() [Some, &ref] | provenance | MaD:4 |
-| main.rs:147:19:147:36 | user_file.as_ref() [Some, &ref] | main.rs:147:19:147:72 | ... .map_or(...) [&ref] | provenance | MaD:5 |
-| main.rs:147:19:147:72 | ... .map_or(...) [&ref] | main.rs:147:9:147:15 | user_fd [&ref] | provenance |  |
-| main.rs:149:26:149:34 | &user_xml [&ref] | main.rs:68:25:68:38 | ...: ... [&ref] | provenance |  |
-| main.rs:149:27:149:34 | user_xml | main.rs:149:26:149:34 | &user_xml [&ref] | provenance |  |
-| main.rs:150:28:150:36 | &user_xml [&ref] | main.rs:73:27:73:40 | ...: ... [&ref] | provenance |  |
-| main.rs:150:29:150:36 | user_xml | main.rs:150:28:150:36 | &user_xml [&ref] | provenance |  |
-| main.rs:151:29:151:37 | &user_xml [&ref] | main.rs:78:28:78:41 | ...: ... [&ref] | provenance |  |
-| main.rs:151:30:151:37 | user_xml | main.rs:151:29:151:37 | &user_xml [&ref] | provenance |  |
-| main.rs:152:28:152:41 | &user_filename [&ref] | main.rs:83:27:83:45 | ...: ... [&ref] | provenance |  |
-| main.rs:152:29:152:41 | user_filename | main.rs:152:28:152:41 | &user_filename [&ref] | provenance |  |
-| main.rs:153:27:153:35 | &user_xml [&ref] | main.rs:88:26:88:39 | ...: ... [&ref] | provenance |  |
-| main.rs:153:28:153:35 | user_xml | main.rs:153:27:153:35 | &user_xml [&ref] | provenance |  |
-| main.rs:154:26:154:32 | user_fd [&ref] | main.rs:93:25:93:36 | ...: i32 [&ref] | provenance |  |
-| main.rs:155:33:155:46 | &user_filename [&ref] | main.rs:98:32:98:50 | ...: ... [&ref] | provenance |  |
-| main.rs:155:34:155:46 | user_filename | main.rs:155:33:155:46 | &user_filename [&ref] | provenance |  |
-| main.rs:156:32:156:40 | &user_xml [&ref] | main.rs:103:31:103:44 | ...: ... [&ref] | provenance |  |
-| main.rs:156:33:156:40 | user_xml | main.rs:156:32:156:40 | &user_xml [&ref] | provenance |  |
-| main.rs:157:35:157:43 | &user_xml [&ref] | main.rs:108:34:108:47 | ...: ... [&ref] | provenance |  |
-| main.rs:157:36:157:43 | user_xml | main.rs:157:35:157:43 | &user_xml [&ref] | provenance |  |
-| main.rs:158:30:158:38 | &user_xml [&ref] | main.rs:120:29:120:42 | ...: ... [&ref] | provenance |  |
-| main.rs:158:31:158:38 | user_xml | main.rs:158:30:158:38 | &user_xml [&ref] | provenance |  |
+| main.rs:150:9:150:16 | user_xml | main.rs:155:27:155:34 | user_xml | provenance |  |
+| main.rs:150:9:150:16 | user_xml | main.rs:156:29:156:36 | user_xml | provenance |  |
+| main.rs:150:9:150:16 | user_xml | main.rs:157:30:157:37 | user_xml | provenance |  |
+| main.rs:150:9:150:16 | user_xml | main.rs:159:28:159:35 | user_xml | provenance |  |
+| main.rs:150:9:150:16 | user_xml | main.rs:162:33:162:40 | user_xml | provenance |  |
+| main.rs:150:9:150:16 | user_xml | main.rs:163:36:163:43 | user_xml | provenance |  |
+| main.rs:150:9:150:16 | user_xml | main.rs:164:31:164:38 | user_xml | provenance |  |
+| main.rs:150:20:150:33 | ...::args | main.rs:150:20:150:35 | ...::args(...) [element] | provenance | Src:MaD:2  |
+| main.rs:150:20:150:35 | ...::args(...) [element] | main.rs:150:20:150:42 | ... .nth(...) [Some] | provenance | MaD:3 |
+| main.rs:150:20:150:42 | ... .nth(...) [Some] | main.rs:150:20:150:62 | ... .unwrap_or_default() | provenance | MaD:6 |
+| main.rs:150:20:150:62 | ... .unwrap_or_default() | main.rs:150:9:150:16 | user_xml | provenance |  |
+| main.rs:151:9:151:21 | user_filename | main.rs:158:29:158:41 | user_filename | provenance |  |
+| main.rs:151:9:151:21 | user_filename | main.rs:161:34:161:46 | user_filename | provenance |  |
+| main.rs:151:25:151:38 | ...::args | main.rs:151:25:151:40 | ...::args(...) [element] | provenance | Src:MaD:2  |
+| main.rs:151:25:151:40 | ...::args(...) [element] | main.rs:151:25:151:47 | ... .nth(...) [Some] | provenance | MaD:3 |
+| main.rs:151:25:151:47 | ... .nth(...) [Some] | main.rs:151:25:151:67 | ... .unwrap_or_default() | provenance | MaD:6 |
+| main.rs:151:25:151:67 | ... .unwrap_or_default() | main.rs:151:9:151:21 | user_filename | provenance |  |
+| main.rs:152:9:152:17 | user_file [Some] | main.rs:153:19:153:27 | user_file [Some] | provenance |  |
+| main.rs:152:21:152:39 | ...::open | main.rs:152:21:152:55 | ...::open(...) [Ok] | provenance | Src:MaD:1  |
+| main.rs:152:21:152:55 | ...::open(...) [Ok] | main.rs:152:21:152:60 | ... .ok() [Some] | provenance | MaD:7 |
+| main.rs:152:21:152:60 | ... .ok() [Some] | main.rs:152:9:152:17 | user_file [Some] | provenance |  |
+| main.rs:153:9:153:15 | user_fd [&ref] | main.rs:160:26:160:32 | user_fd [&ref] | provenance |  |
+| main.rs:153:19:153:27 | user_file [Some] | main.rs:153:19:153:36 | user_file.as_ref() [Some, &ref] | provenance | MaD:4 |
+| main.rs:153:19:153:36 | user_file.as_ref() [Some, &ref] | main.rs:153:19:153:72 | ... .map_or(...) [&ref] | provenance | MaD:5 |
+| main.rs:153:19:153:72 | ... .map_or(...) [&ref] | main.rs:153:9:153:15 | user_fd [&ref] | provenance |  |
+| main.rs:155:26:155:34 | &user_xml [&ref] | main.rs:68:25:68:38 | ...: ... [&ref] | provenance |  |
+| main.rs:155:27:155:34 | user_xml | main.rs:155:26:155:34 | &user_xml [&ref] | provenance |  |
+| main.rs:156:28:156:36 | &user_xml [&ref] | main.rs:73:27:73:40 | ...: ... [&ref] | provenance |  |
+| main.rs:156:29:156:36 | user_xml | main.rs:156:28:156:36 | &user_xml [&ref] | provenance |  |
+| main.rs:157:29:157:37 | &user_xml [&ref] | main.rs:78:28:78:41 | ...: ... [&ref] | provenance |  |
+| main.rs:157:30:157:37 | user_xml | main.rs:157:29:157:37 | &user_xml [&ref] | provenance |  |
+| main.rs:158:28:158:41 | &user_filename [&ref] | main.rs:83:27:83:45 | ...: ... [&ref] | provenance |  |
+| main.rs:158:29:158:41 | user_filename | main.rs:158:28:158:41 | &user_filename [&ref] | provenance |  |
+| main.rs:159:27:159:35 | &user_xml [&ref] | main.rs:88:26:88:39 | ...: ... [&ref] | provenance |  |
+| main.rs:159:28:159:35 | user_xml | main.rs:159:27:159:35 | &user_xml [&ref] | provenance |  |
+| main.rs:160:26:160:32 | user_fd [&ref] | main.rs:93:25:93:36 | ...: i32 [&ref] | provenance |  |
+| main.rs:161:33:161:46 | &user_filename [&ref] | main.rs:98:32:98:50 | ...: ... [&ref] | provenance |  |
+| main.rs:161:34:161:46 | user_filename | main.rs:161:33:161:46 | &user_filename [&ref] | provenance |  |
+| main.rs:162:32:162:40 | &user_xml [&ref] | main.rs:103:31:103:44 | ...: ... [&ref] | provenance |  |
+| main.rs:162:33:162:40 | user_xml | main.rs:162:32:162:40 | &user_xml [&ref] | provenance |  |
+| main.rs:163:35:163:43 | &user_xml [&ref] | main.rs:108:34:108:47 | ...: ... [&ref] | provenance |  |
+| main.rs:163:36:163:43 | user_xml | main.rs:163:35:163:43 | &user_xml [&ref] | provenance |  |
+| main.rs:164:30:164:38 | &user_xml [&ref] | main.rs:120:29:120:42 | ...: ... [&ref] | provenance |  |
+| main.rs:164:31:164:38 | user_xml | main.rs:164:30:164:38 | &user_xml [&ref] | provenance |  |
 models
 | 1 | Source: <std::fs::File>::open; ReturnValue.Field[core::result::Result::Ok(0)]; file |
 | 2 | Source: std::env::args; ReturnValue.Element; commandargs |
@@ -93,41 +93,41 @@ nodes
 | main.rs:112:9:112:16 | user_xml | semmle.label | user_xml |
 | main.rs:120:29:120:42 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
 | main.rs:122:19:122:26 | user_xml | semmle.label | user_xml |
-| main.rs:144:9:144:16 | user_xml | semmle.label | user_xml |
-| main.rs:144:20:144:33 | ...::args | semmle.label | ...::args |
-| main.rs:144:20:144:35 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
-| main.rs:144:20:144:42 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
-| main.rs:144:20:144:62 | ... .unwrap_or_default() | semmle.label | ... .unwrap_or_default() |
-| main.rs:145:9:145:21 | user_filename | semmle.label | user_filename |
-| main.rs:145:25:145:38 | ...::args | semmle.label | ...::args |
-| main.rs:145:25:145:40 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
-| main.rs:145:25:145:47 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
-| main.rs:145:25:145:67 | ... .unwrap_or_default() | semmle.label | ... .unwrap_or_default() |
-| main.rs:146:9:146:17 | user_file [Some] | semmle.label | user_file [Some] |
-| main.rs:146:21:146:39 | ...::open | semmle.label | ...::open |
-| main.rs:146:21:146:55 | ...::open(...) [Ok] | semmle.label | ...::open(...) [Ok] |
-| main.rs:146:21:146:60 | ... .ok() [Some] | semmle.label | ... .ok() [Some] |
-| main.rs:147:9:147:15 | user_fd [&ref] | semmle.label | user_fd [&ref] |
-| main.rs:147:19:147:27 | user_file [Some] | semmle.label | user_file [Some] |
-| main.rs:147:19:147:36 | user_file.as_ref() [Some, &ref] | semmle.label | user_file.as_ref() [Some, &ref] |
-| main.rs:147:19:147:72 | ... .map_or(...) [&ref] | semmle.label | ... .map_or(...) [&ref] |
-| main.rs:149:26:149:34 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
-| main.rs:149:27:149:34 | user_xml | semmle.label | user_xml |
-| main.rs:150:28:150:36 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
-| main.rs:150:29:150:36 | user_xml | semmle.label | user_xml |
-| main.rs:151:29:151:37 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
-| main.rs:151:30:151:37 | user_xml | semmle.label | user_xml |
-| main.rs:152:28:152:41 | &user_filename [&ref] | semmle.label | &user_filename [&ref] |
-| main.rs:152:29:152:41 | user_filename | semmle.label | user_filename |
-| main.rs:153:27:153:35 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
-| main.rs:153:28:153:35 | user_xml | semmle.label | user_xml |
-| main.rs:154:26:154:32 | user_fd [&ref] | semmle.label | user_fd [&ref] |
-| main.rs:155:33:155:46 | &user_filename [&ref] | semmle.label | &user_filename [&ref] |
-| main.rs:155:34:155:46 | user_filename | semmle.label | user_filename |
-| main.rs:156:32:156:40 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
-| main.rs:156:33:156:40 | user_xml | semmle.label | user_xml |
-| main.rs:157:35:157:43 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
-| main.rs:157:36:157:43 | user_xml | semmle.label | user_xml |
-| main.rs:158:30:158:38 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
-| main.rs:158:31:158:38 | user_xml | semmle.label | user_xml |
+| main.rs:150:9:150:16 | user_xml | semmle.label | user_xml |
+| main.rs:150:20:150:33 | ...::args | semmle.label | ...::args |
+| main.rs:150:20:150:35 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
+| main.rs:150:20:150:42 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
+| main.rs:150:20:150:62 | ... .unwrap_or_default() | semmle.label | ... .unwrap_or_default() |
+| main.rs:151:9:151:21 | user_filename | semmle.label | user_filename |
+| main.rs:151:25:151:38 | ...::args | semmle.label | ...::args |
+| main.rs:151:25:151:40 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
+| main.rs:151:25:151:47 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
+| main.rs:151:25:151:67 | ... .unwrap_or_default() | semmle.label | ... .unwrap_or_default() |
+| main.rs:152:9:152:17 | user_file [Some] | semmle.label | user_file [Some] |
+| main.rs:152:21:152:39 | ...::open | semmle.label | ...::open |
+| main.rs:152:21:152:55 | ...::open(...) [Ok] | semmle.label | ...::open(...) [Ok] |
+| main.rs:152:21:152:60 | ... .ok() [Some] | semmle.label | ... .ok() [Some] |
+| main.rs:153:9:153:15 | user_fd [&ref] | semmle.label | user_fd [&ref] |
+| main.rs:153:19:153:27 | user_file [Some] | semmle.label | user_file [Some] |
+| main.rs:153:19:153:36 | user_file.as_ref() [Some, &ref] | semmle.label | user_file.as_ref() [Some, &ref] |
+| main.rs:153:19:153:72 | ... .map_or(...) [&ref] | semmle.label | ... .map_or(...) [&ref] |
+| main.rs:155:26:155:34 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
+| main.rs:155:27:155:34 | user_xml | semmle.label | user_xml |
+| main.rs:156:28:156:36 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
+| main.rs:156:29:156:36 | user_xml | semmle.label | user_xml |
+| main.rs:157:29:157:37 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
+| main.rs:157:30:157:37 | user_xml | semmle.label | user_xml |
+| main.rs:158:28:158:41 | &user_filename [&ref] | semmle.label | &user_filename [&ref] |
+| main.rs:158:29:158:41 | user_filename | semmle.label | user_filename |
+| main.rs:159:27:159:35 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
+| main.rs:159:28:159:35 | user_xml | semmle.label | user_xml |
+| main.rs:160:26:160:32 | user_fd [&ref] | semmle.label | user_fd [&ref] |
+| main.rs:161:33:161:46 | &user_filename [&ref] | semmle.label | &user_filename [&ref] |
+| main.rs:161:34:161:46 | user_filename | semmle.label | user_filename |
+| main.rs:162:32:162:40 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
+| main.rs:162:33:162:40 | user_xml | semmle.label | user_xml |
+| main.rs:163:35:163:43 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
+| main.rs:163:36:163:43 | user_xml | semmle.label | user_xml |
+| main.rs:164:30:164:38 | &user_xml [&ref] | semmle.label | &user_xml [&ref] |
+| main.rs:164:31:164:38 | user_xml | semmle.label | user_xml |
 subpaths
diff --git a/rust/ql/test/query-tests/security/CWE-611/main.rs b/rust/ql/test/query-tests/security/CWE-611/main.rs
index 17d80b74196..7244a47110f 100644
--- a/rust/ql/test/query-tests/security/CWE-611/main.rs
+++ b/rust/ql/test/query-tests/security/CWE-611/main.rs
@@ -122,6 +122,12 @@ fn test_integer_literal_bad(user_xml: &str) {
     xmlReadMemory(user_xml, user_xml.len() as i32, "", "", 2); // $ Alert[rust/xxe]
 }
 
+fn test_dataflow_bad(user_xml: &str) {
+    // BAD: user-controlled XML with unsafe parser options via dataflow
+    let flags = XML_PARSE_NOENT | 1024;
+    xmlReadMemory(user_xml, user_xml.len() as i32, "", "", flags); // $ MISSING: Alert[rust/xxe]
+}
+
 // --- GOOD: user-controlled XML with safe parser options ---
 
 fn test_xml_parse_safe_options(user_xml: &str) {
@@ -156,6 +162,7 @@ fn main() {
     test_xml_ctxt_read_doc_bad(&user_xml);
     test_xml_ctxt_read_memory_bad(&user_xml);
     test_integer_literal_bad(&user_xml);
+    test_dataflow_bad(&user_xml);
     test_xml_parse_safe_options(&user_xml);
     test_xml_hardcoded_unsafe();
 }