hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Rust: Fix column orders in interpretModelForTest

Browse Source
This commit is contained in:
Tom Hvitved
2025-06-18 12:58:35 +02:00
parent 63379df004
commit c88a5049e0
10 changed files with 74 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
View File

@@ -143,22 +143,22 @@ extensible predicate summaryModel(
*/
predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
exists(string crate, string path, string output, string kind |
sourceModelDeprecated(crate, path, kind, output, _, madId) and
sourceModelDeprecated(crate, path, output, kind, _, madId) and
model = "Source: " + crate + "; " + path + "; " + output + "; " + kind
)
or
exists(string path, string output, string kind |
sourceModel(path, kind, output, _, madId) and
sourceModel(path, output, kind, _, madId) and
model = "Source: " + path + "; " + output + "; " + kind
)
or
exists(string crate, string path, string input, string kind |
sinkModelDeprecated(crate, path, kind, input, _, madId) and
sinkModelDeprecated(crate, path, input, kind, _, madId) and
model = "Sink: " + crate + "; " + path + "; " + input + "; " + kind
)
or
exists(string path, string input, string kind |
sinkModel(path, kind, input, _, madId) and
sinkModel(path, input, kind, _, madId) and
model = "Sink: " + path + "; " + input + "; " + kind
)
or

14
rust/ql/test/library-tests/dataflow/models/models.expected
View File

@@ -1,11 +1,11 @@
models
| 1 | Sink: <main::MyFieldEnum>::sink; test-sink; Argument[self].Field[main::MyFieldEnum::D::field_d] |
| 2 | Sink: main::enum_sink; test-sink; Argument[0].Field[main::MyFieldEnum::C::field_c] |
| 3 | Sink: main::simple_sink; test-sink; Argument[0] |
| 4 | Source: <main::MyFieldEnum>::source; test-source; ReturnValue.Field[main::MyFieldEnum::C::field_c] |
| 5 | Source: main::arg_source; test-source; Argument[0] |
| 6 | Source: main::enum_source; test-source; ReturnValue.Field[main::MyFieldEnum::D::field_d] |
| 7 | Source: main::simple_source; test-source; ReturnValue |
| 1 | Sink: <main::MyFieldEnum>::sink; Argument[self].Field[main::MyFieldEnum::D::field_d]; test-sink |
| 2 | Sink: main::enum_sink; Argument[0].Field[main::MyFieldEnum::C::field_c]; test-sink |
| 3 | Sink: main::simple_sink; Argument[0]; test-sink |
| 4 | Source: <main::MyFieldEnum>::source; ReturnValue.Field[main::MyFieldEnum::C::field_c]; test-source |
| 5 | Source: main::arg_source; Argument[0]; test-source |
| 6 | Source: main::enum_source; ReturnValue.Field[main::MyFieldEnum::D::field_d]; test-source |
| 7 | Source: main::simple_source; ReturnValue; test-source |
| 8 | Summary: main::apply; Argument[0]; Argument[1].Parameter[0]; value |
| 9 | Summary: main::apply; Argument[1].ReturnValue; ReturnValue; value |
| 10 | Summary: main::coerce; Argument[0]; ReturnValue; taint |

2
rust/ql/test/query-tests/security/CWE-020/RegexInjection.expected
View File

@@ -13,7 +13,7 @@ edges
| main.rs:5:25:5:44 | { ... } | main.rs:5:25:5:44 | ...::must_use(...) | provenance | MaD:4 |
| main.rs:6:26:6:30 | regex | main.rs:6:25:6:30 | &regex | provenance | |
models
| 1 | Source: lang:std; crate::env::var; environment; ReturnValue.Field[core::result::Result::Ok(0)] |
| 1 | Source: lang:std; crate::env::var; ReturnValue.Field[core::result::Result::Ok(0)]; environment |
| 2 | Summary: lang:alloc; crate::fmt::format; Argument[0]; ReturnValue; taint |
| 3 | Summary: lang:core; <crate::result::Result>::unwrap_or; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 4 | Summary: lang:core; crate::hint::must_use; Argument[0]; ReturnValue; value |

2
rust/ql/test/query-tests/security/CWE-022/TaintedPath.expected
View File

@@ -8,7 +8,7 @@ edges
| src/main.rs:8:35:8:43 | file_name | src/main.rs:8:21:8:44 | ...::from(...) | provenance | MaD:2 |
| src/main.rs:10:24:10:32 | file_path | src/main.rs:10:5:10:22 | ...::read_to_string | provenance | MaD:1 Sink:MaD:1 |
models
| 1 | Sink: lang:std; crate::fs::read_to_string; path-injection; Argument[0] |
| 1 | Sink: lang:std; crate::fs::read_to_string; Argument[0]; path-injection |
| 2 | Summary: lang:std; <crate::path::PathBuf as crate::convert::From>::from; Argument[0]; ReturnValue; taint |
nodes
| src/main.rs:6:11:6:19 | file_name | semmle.label | file_name |

4
rust/ql/test/query-tests/security/CWE-089/SqlInjection.expected
View File

@@ -24,8 +24,8 @@ edges
| sqlx.rs:54:26:54:39 | &remote_string [&ref] | sqlx.rs:54:9:54:22 | unsafe_query_2 [&ref] | provenance | |
| sqlx.rs:54:27:54:39 | remote_string | sqlx.rs:54:26:54:39 | &remote_string [&ref] | provenance | |
models
| 1 | Source: lang:std; crate::env::args; commandargs; ReturnValue.Element |
| 2 | Source: repo:https://github.com/seanmonstar/reqwest:reqwest; crate::blocking::get; remote; ReturnValue.Field[core::result::Result::Ok(0)] |
| 1 | Source: lang:std; crate::env::args; ReturnValue.Element; commandargs |
| 2 | Source: repo:https://github.com/seanmonstar/reqwest:reqwest; crate::blocking::get; ReturnValue.Field[core::result::Result::Ok(0)]; remote |
| 3 | Summary: lang:alloc; <crate::string::String>::as_str; Argument[self]; ReturnValue; value |
| 4 | Summary: lang:core; <crate::option::Option>::unwrap_or; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
| 5 | Summary: lang:core; <crate::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |

8
rust/ql/test/query-tests/security/CWE-311/CleartextTransmission.expected
View File

@@ -51,10 +51,10 @@ edges
| main.rs:33:50:33:57 | password | main.rs:33:23:33:57 | MacroExpr | provenance | |
| main.rs:35:33:35:35 | url | main.rs:35:12:35:18 | request | provenance | MaD:2 Sink:MaD:2 |
models
| 1 | Sink: repo:https://github.com/seanmonstar/reqwest:reqwest; <crate::async_impl::client::Client>::post; transmission; Argument[0] |
| 2 | Sink: repo:https://github.com/seanmonstar/reqwest:reqwest; <crate::async_impl::client::Client>::request; transmission; Argument[1] |
| 3 | Sink: repo:https://github.com/seanmonstar/reqwest:reqwest; <crate::blocking::client::Client>::request; transmission; Argument[1] |
| 4 | Sink: repo:https://github.com/seanmonstar/reqwest:reqwest; crate::blocking::get; transmission; Argument[0] |
| 1 | Sink: repo:https://github.com/seanmonstar/reqwest:reqwest; <crate::async_impl::client::Client>::post; Argument[0]; transmission |
| 2 | Sink: repo:https://github.com/seanmonstar/reqwest:reqwest; <crate::async_impl::client::Client>::request; Argument[1]; transmission |
| 3 | Sink: repo:https://github.com/seanmonstar/reqwest:reqwest; <crate::blocking::client::Client>::request; Argument[1]; transmission |
| 4 | Sink: repo:https://github.com/seanmonstar/reqwest:reqwest; crate::blocking::get; Argument[0]; transmission |
| 5 | Summary: lang:alloc; crate::fmt::format; Argument[0]; ReturnValue; taint |
| 6 | Summary: lang:core; <crate::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 7 | Summary: lang:core; crate::hint::must_use; Argument[0]; ReturnValue; value |

46
rust/ql/test/query-tests/security/CWE-312/CleartextLogging.expected
View File

@@ -200,40 +200,40 @@ edges
| test_logging.rs:208:42:208:49 | password | test_logging.rs:208:26:208:49 | MacroExpr | provenance | |
| test_logging.rs:211:28:211:51 | MacroExpr | test_logging.rs:211:13:211:52 | ...::panic_fmt | provenance | MaD:3 Sink:MaD:3 |
| test_logging.rs:211:44:211:51 | password | test_logging.rs:211:28:211:51 | MacroExpr | provenance | |
| test_logging.rs:214:13:214:54 | ...::assert_failed [Some] | test_logging.rs:214:13:214:54 | ...::assert_failed | provenance | Sink:MaD:2 |
| test_logging.rs:214:30:214:53 | ...::Some(...) [Some] | test_logging.rs:214:13:214:54 | ...::assert_failed | provenance | MaD:2 Sink:MaD:2 |
| test_logging.rs:214:30:214:53 | ...::Some(...) [Some] | test_logging.rs:214:13:214:54 | ...::assert_failed [Some] | provenance | MaD:1 |
| test_logging.rs:214:13:214:54 | ...::assert_failed [Some] | test_logging.rs:214:13:214:54 | ...::assert_failed | provenance | Sink:MaD:1 |
| test_logging.rs:214:30:214:53 | ...::Some(...) [Some] | test_logging.rs:214:13:214:54 | ...::assert_failed | provenance | MaD:1 Sink:MaD:1 |
| test_logging.rs:214:30:214:53 | ...::Some(...) [Some] | test_logging.rs:214:13:214:54 | ...::assert_failed [Some] | provenance | MaD:2 |
| test_logging.rs:214:30:214:53 | MacroExpr | test_logging.rs:214:30:214:53 | ...::Some(...) [Some] | provenance | |
| test_logging.rs:214:46:214:53 | password | test_logging.rs:214:30:214:53 | MacroExpr | provenance | |
| test_logging.rs:217:13:217:54 | ...::assert_failed [Some] | test_logging.rs:217:13:217:54 | ...::assert_failed | provenance | Sink:MaD:2 |
| test_logging.rs:217:30:217:53 | ...::Some(...) [Some] | test_logging.rs:217:13:217:54 | ...::assert_failed | provenance | MaD:2 Sink:MaD:2 |
| test_logging.rs:217:30:217:53 | ...::Some(...) [Some] | test_logging.rs:217:13:217:54 | ...::assert_failed [Some] | provenance | MaD:1 |
| test_logging.rs:217:13:217:54 | ...::assert_failed [Some] | test_logging.rs:217:13:217:54 | ...::assert_failed | provenance | Sink:MaD:1 |
| test_logging.rs:217:30:217:53 | ...::Some(...) [Some] | test_logging.rs:217:13:217:54 | ...::assert_failed | provenance | MaD:1 Sink:MaD:1 |
| test_logging.rs:217:30:217:53 | ...::Some(...) [Some] | test_logging.rs:217:13:217:54 | ...::assert_failed [Some] | provenance | MaD:2 |
| test_logging.rs:217:30:217:53 | MacroExpr | test_logging.rs:217:30:217:53 | ...::Some(...) [Some] | provenance | |
| test_logging.rs:217:46:217:53 | password | test_logging.rs:217:30:217:53 | MacroExpr | provenance | |
| test_logging.rs:220:34:220:57 | MacroExpr | test_logging.rs:220:13:220:58 | ...::panic_fmt | provenance | MaD:3 Sink:MaD:3 |
| test_logging.rs:220:50:220:57 | password | test_logging.rs:220:34:220:57 | MacroExpr | provenance | |
| test_logging.rs:223:13:223:60 | ...::assert_failed [Some] | test_logging.rs:223:13:223:60 | ...::assert_failed | provenance | Sink:MaD:2 |
| test_logging.rs:223:36:223:59 | ...::Some(...) [Some] | test_logging.rs:223:13:223:60 | ...::assert_failed | provenance | MaD:2 Sink:MaD:2 |
| test_logging.rs:223:36:223:59 | ...::Some(...) [Some] | test_logging.rs:223:13:223:60 | ...::assert_failed [Some] | provenance | MaD:1 |
| test_logging.rs:223:13:223:60 | ...::assert_failed [Some] | test_logging.rs:223:13:223:60 | ...::assert_failed | provenance | Sink:MaD:1 |
| test_logging.rs:223:36:223:59 | ...::Some(...) [Some] | test_logging.rs:223:13:223:60 | ...::assert_failed | provenance | MaD:1 Sink:MaD:1 |
| test_logging.rs:223:36:223:59 | ...::Some(...) [Some] | test_logging.rs:223:13:223:60 | ...::assert_failed [Some] | provenance | MaD:2 |
| test_logging.rs:223:36:223:59 | MacroExpr | test_logging.rs:223:36:223:59 | ...::Some(...) [Some] | provenance | |
| test_logging.rs:223:52:223:59 | password | test_logging.rs:223:36:223:59 | MacroExpr | provenance | |
| test_logging.rs:226:13:226:60 | ...::assert_failed [Some] | test_logging.rs:226:13:226:60 | ...::assert_failed | provenance | Sink:MaD:2 |
| test_logging.rs:226:36:226:59 | ...::Some(...) [Some] | test_logging.rs:226:13:226:60 | ...::assert_failed | provenance | MaD:2 Sink:MaD:2 |
| test_logging.rs:226:36:226:59 | ...::Some(...) [Some] | test_logging.rs:226:13:226:60 | ...::assert_failed [Some] | provenance | MaD:1 |
| test_logging.rs:226:13:226:60 | ...::assert_failed [Some] | test_logging.rs:226:13:226:60 | ...::assert_failed | provenance | Sink:MaD:1 |
| test_logging.rs:226:36:226:59 | ...::Some(...) [Some] | test_logging.rs:226:13:226:60 | ...::assert_failed | provenance | MaD:1 Sink:MaD:1 |
| test_logging.rs:226:36:226:59 | ...::Some(...) [Some] | test_logging.rs:226:13:226:60 | ...::assert_failed [Some] | provenance | MaD:2 |
| test_logging.rs:226:36:226:59 | MacroExpr | test_logging.rs:226:36:226:59 | ...::Some(...) [Some] | provenance | |
| test_logging.rs:226:52:226:59 | password | test_logging.rs:226:36:226:59 | MacroExpr | provenance | |
models
| 1 | Sink: lang:core; crate::panicking::assert_failed; log-injection; Argument[3] |
| 2 | Sink: lang:core; crate::panicking::assert_failed; log-injection; Argument[3].Field[core::option::Option::Some(0)] |
| 3 | Sink: lang:core; crate::panicking::panic_fmt; log-injection; Argument[0] |
| 4 | Sink: lang:std; crate::io::stdio::_eprint; log-injection; Argument[0] |
| 5 | Sink: lang:std; crate::io::stdio::_print; log-injection; Argument[0] |
| 6 | Sink: repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err; <crate::option::Option as crate::LogErrOption>::log_expect; log-injection; Argument[0] |
| 7 | Sink: repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err; <crate::result::Result as crate::LogErrResult>::log_expect; log-injection; Argument[0] |
| 8 | Sink: repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err; <crate::result::Result as crate::LogErrResult>::log_expect; log-injection; Argument[self].Field[core::result::Result::Err(0)] |
| 9 | Sink: repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err; <crate::result::Result as crate::LogErrResult>::log_unwrap; log-injection; Argument[self].Field[core::result::Result::Err(0)] |
| 10 | Sink: repo:https://github.com/rust-lang/log:log; crate::__private_api::log; log-injection; Argument[1] |
| 11 | Sink: repo:https://github.com/rust-lang/log:log; crate::__private_api::log; log-injection; Argument[3] |
| 1 | Sink: lang:core; crate::panicking::assert_failed; Argument[3].Field[core::option::Option::Some(0)]; log-injection |
| 2 | Sink: lang:core; crate::panicking::assert_failed; Argument[3]; log-injection |
| 3 | Sink: lang:core; crate::panicking::panic_fmt; Argument[0]; log-injection |
| 4 | Sink: lang:std; crate::io::stdio::_eprint; Argument[0]; log-injection |
| 5 | Sink: lang:std; crate::io::stdio::_print; Argument[0]; log-injection |
| 6 | Sink: repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err; <crate::option::Option as crate::LogErrOption>::log_expect; Argument[0]; log-injection |
| 7 | Sink: repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err; <crate::result::Result as crate::LogErrResult>::log_expect; Argument[0]; log-injection |
| 8 | Sink: repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err; <crate::result::Result as crate::LogErrResult>::log_expect; Argument[self].Field[core::result::Result::Err(0)]; log-injection |
| 9 | Sink: repo:https://github.com/DesmondWillowbrook/rs-log_err:log_err; <crate::result::Result as crate::LogErrResult>::log_unwrap; Argument[self].Field[core::result::Result::Err(0)]; log-injection |
| 10 | Sink: repo:https://github.com/rust-lang/log:log; crate::__private_api::log; Argument[1]; log-injection |
| 11 | Sink: repo:https://github.com/rust-lang/log:log; crate::__private_api::log; Argument[3]; log-injection |
| 12 | Summary: lang:alloc; crate::fmt::format; Argument[0]; ReturnValue; taint |
| 13 | Summary: lang:core; crate::hint::must_use; Argument[0]; ReturnValue; value |
nodes

6
rust/ql/test/query-tests/security/CWE-328/WeakSensitiveDataHashing.expected
View File

@@ -33,9 +33,9 @@ edges
| test.rs:83:26:83:33 | password | test.rs:83:26:83:44 | password.as_bytes() | provenance | MaD:4 |
| test.rs:83:26:83:44 | password.as_bytes() | test.rs:83:9:83:24 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
models
| 1 | Sink: repo:https://github.com/RustCrypto/traits:digest; <_ as crate::digest::Digest>::digest; hasher-input; Argument[0] |
| 2 | Sink: repo:https://github.com/RustCrypto/traits:digest; <_ as crate::digest::Digest>::new_with_prefix; hasher-input; Argument[0] |
| 3 | Sink: repo:https://github.com/stainless-steel/md5:md5; crate::compute; hasher-input; Argument[0] |
| 1 | Sink: repo:https://github.com/RustCrypto/traits:digest; <_ as crate::digest::Digest>::digest; Argument[0]; hasher-input |
| 2 | Sink: repo:https://github.com/RustCrypto/traits:digest; <_ as crate::digest::Digest>::new_with_prefix; Argument[0]; hasher-input |
| 3 | Sink: repo:https://github.com/stainless-steel/md5:md5; crate::compute; Argument[0]; hasher-input |
| 4 | Summary: lang:core; <str>::as_bytes; Argument[self]; ReturnValue; taint |
| 5 | Summary: lang:core; <str>::trim; Argument[self]; ReturnValue.Reference; taint |
nodes

42
rust/ql/test/query-tests/security/CWE-770/UncontrolledAllocationSize.expected
View File

@@ -275,27 +275,27 @@ edges
| main.rs:323:27:323:27 | v | main.rs:183:29:183:36 | ...: usize | provenance | |
| main.rs:324:25:324:25 | v | main.rs:217:27:217:34 | ...: usize | provenance | |
models
| 1 | Sink: lang:alloc; <crate::alloc::Global as crate::alloc::Allocator>::allocate; alloc-layout; Argument[0] |
| 2 | Sink: lang:alloc; <crate::alloc::Global as crate::alloc::Allocator>::allocate_zeroed; alloc-layout; Argument[0] |
| 3 | Sink: lang:alloc; crate::alloc::alloc; alloc-layout; Argument[0] |
| 4 | Sink: lang:alloc; crate::alloc::alloc_zeroed; alloc-layout; Argument[0] |
| 5 | Sink: lang:alloc; crate::alloc::realloc; alloc-size; Argument[2] |
| 6 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::allocate; alloc-layout; Argument[0] |
| 7 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::allocate_zeroed; alloc-layout; Argument[0] |
| 8 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::grow; alloc-layout; Argument[2] |
| 9 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::grow_zeroed; alloc-layout; Argument[2] |
| 10 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::shrink; alloc-layout; Argument[2] |
| 11 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::alloc; alloc-layout; Argument[0] |
| 12 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::alloc; alloc-size; Argument[0] |
| 13 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::alloc_zeroed; alloc-layout; Argument[0] |
| 14 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::alloc_zeroed; alloc-size; Argument[0] |
| 15 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::realloc; alloc-layout; Argument[2] |
| 16 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::realloc; alloc-size; Argument[2] |
| 17 | Sink: repo:https://github.com/rust-lang/libc:libc; ::aligned_alloc; alloc-size; Argument[1] |
| 18 | Sink: repo:https://github.com/rust-lang/libc:libc; ::calloc; alloc-size; Argument[0,1] |
| 19 | Sink: repo:https://github.com/rust-lang/libc:libc; ::malloc; alloc-size; Argument[0] |
| 20 | Sink: repo:https://github.com/rust-lang/libc:libc; ::realloc; alloc-size; Argument[1] |
| 21 | Source: lang:std; crate::env::args; commandargs; ReturnValue.Element |
| 1 | Sink: lang:alloc; <crate::alloc::Global as crate::alloc::Allocator>::allocate; Argument[0]; alloc-layout |
| 2 | Sink: lang:alloc; <crate::alloc::Global as crate::alloc::Allocator>::allocate_zeroed; Argument[0]; alloc-layout |
| 3 | Sink: lang:alloc; crate::alloc::alloc; Argument[0]; alloc-layout |
| 4 | Sink: lang:alloc; crate::alloc::alloc_zeroed; Argument[0]; alloc-layout |
| 5 | Sink: lang:alloc; crate::alloc::realloc; Argument[2]; alloc-size |
| 6 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::allocate; Argument[0]; alloc-layout |
| 7 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::allocate_zeroed; Argument[0]; alloc-layout |
| 8 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::grow; Argument[2]; alloc-layout |
| 9 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::grow_zeroed; Argument[2]; alloc-layout |
| 10 | Sink: lang:std; <crate::alloc::System as crate::alloc::Allocator>::shrink; Argument[2]; alloc-layout |
| 11 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::alloc; Argument[0]; alloc-layout |
| 12 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::alloc; Argument[0]; alloc-size |
| 13 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::alloc_zeroed; Argument[0]; alloc-layout |
| 14 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::alloc_zeroed; Argument[0]; alloc-size |
| 15 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::realloc; Argument[2]; alloc-layout |
| 16 | Sink: lang:std; <crate::alloc::System as crate::alloc::global::GlobalAlloc>::realloc; Argument[2]; alloc-size |
| 17 | Sink: repo:https://github.com/rust-lang/libc:libc; ::aligned_alloc; Argument[1]; alloc-size |
| 18 | Sink: repo:https://github.com/rust-lang/libc:libc; ::calloc; Argument[0,1]; alloc-size |
| 19 | Sink: repo:https://github.com/rust-lang/libc:libc; ::malloc; Argument[0]; alloc-size |
| 20 | Sink: repo:https://github.com/rust-lang/libc:libc; ::realloc; Argument[1]; alloc-size |
| 21 | Source: lang:std; crate::env::args; ReturnValue.Element; commandargs |
| 22 | Summary: lang:core; <crate::alloc::layout::Layout>::align_to; Argument[self]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
| 23 | Summary: lang:core; <crate::alloc::layout::Layout>::array; Argument[0]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
| 24 | Summary: lang:core; <crate::alloc::layout::Layout>::extend; Argument[0]; ReturnValue.Field[core::result::Result::Ok(0)].Field[0]; taint |

16
rust/ql/test/query-tests/security/CWE-825/AccessInvalidPointer.expected
View File

@@ -51,14 +51,14 @@ edges
| deallocation.rs:242:3:242:25 | ...::drop_in_place | deallocation.rs:242:27:242:29 | [post] ptr | provenance | Src:MaD:6 MaD:6 |
| deallocation.rs:242:27:242:29 | [post] ptr | deallocation.rs:248:18:248:20 | ptr | provenance | |
models
| 1 | Sink: lang:core; crate::ptr::read; pointer-access; Argument[0] |
| 2 | Sink: lang:core; crate::ptr::write; pointer-access; Argument[0] |
| 3 | Source: lang:alloc; crate::alloc::dealloc; pointer-invalidate; Argument[0] |
| 4 | Source: lang:core; crate::ptr::dangling; pointer-invalidate; ReturnValue |
| 5 | Source: lang:core; crate::ptr::dangling_mut; pointer-invalidate; ReturnValue |
| 6 | Source: lang:core; crate::ptr::drop_in_place; pointer-invalidate; Argument[0] |
| 7 | Source: lang:core; crate::ptr::null; pointer-invalidate; ReturnValue |
| 8 | Source: repo:https://github.com/rust-lang/libc:libc; ::free; pointer-invalidate; Argument[0] |
| 1 | Sink: lang:core; crate::ptr::read; Argument[0]; pointer-access |
| 2 | Sink: lang:core; crate::ptr::write; Argument[0]; pointer-access |
| 3 | Source: lang:alloc; crate::alloc::dealloc; Argument[0]; pointer-invalidate |
| 4 | Source: lang:core; crate::ptr::dangling; ReturnValue; pointer-invalidate |
| 5 | Source: lang:core; crate::ptr::dangling_mut; ReturnValue; pointer-invalidate |
| 6 | Source: lang:core; crate::ptr::drop_in_place; Argument[0]; pointer-invalidate |
| 7 | Source: lang:core; crate::ptr::null; ReturnValue; pointer-invalidate |
| 8 | Source: repo:https://github.com/rust-lang/libc:libc; ::free; Argument[0]; pointer-invalidate |
nodes
| deallocation.rs:20:3:20:21 | ...::dealloc | semmle.label | ...::dealloc |
| deallocation.rs:20:23:20:24 | [post] m1 | semmle.label | [post] m1 |