hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Rust: address review on docs

Browse Source
This commit is contained in:
Paolo Tranquilli
2025-06-17 11:19:59 +02:00
parent ad3a5d777d
commit e9a071032c
3 changed files with 19 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
docs/codeql/codeql-language-guides/analyzing-data-flow-in-rust.rst
View File

@@ -23,10 +23,9 @@ Using local data flow
~~~~~~~~~~~~~~~~~~~~~
You can use the local data flow library by importing the ``codeql.rust.dataflow.DataFlow`` module. The library uses the class ``Node`` to represent any element through which data can flow.
``Node``\ s are divided into expression nodes (``ExprNode``) and parameter nodes (``ParameterNode``).
You can map a data flow ``ParameterNode`` to its corresponding ``Parameter`` AST node using the ``asParameter`` member predicate.
Similarly, you can use the ``asExpr`` member predicate to map a data flow ``ExprNode`` to its corresponding ``ExprCfgNode`` in the control-flow library.
Common ``Node`` types include expression nodes (``ExprNode``) and parameter nodes (``ParameterNode``).
You can use the ``asExpr`` member predicate to map a data flow ``ExprNode`` to its corresponding ``ExprCfgNode`` in the control-flow library.
Similarly, you can map a data flow ``ParameterNode`` to its corresponding ``Parameter`` AST node using the ``asParameter`` member predicate.
.. code-block:: ql
class Node {
@@ -39,22 +38,8 @@ Similarly, you can use the ``asExpr`` member predicate to map a data flow ``Expr
...
}
You can use the predicates ``exprNode`` and ``parameterNode`` to map from expressions and parameters to their data-flow node:
.. code-block:: ql
/**
* Gets a node corresponding to expression `e`.
*/
ExprNode exprNode(CfgNodes::ExprCfgNode e) { ... }
/**
* Gets the node corresponding to the value of parameter `p` at function entry.
*/
ParameterNode parameterNode(Parameter p) { ... }
Note that since ``asExpr`` and ``exprNode`` map between data-flow and control-flow nodes, you then need to call the ``getExpr`` member predicate on the control-flow node to map to the corresponding AST node,
for example, by writing ``node.asExpr().getExpr()``.
Note that since ``asExpr`` maps from data-flow to control-flow nodes, you then need to call the ``getExpr`` member predicate on the control-flow node to map to the corresponding AST node,
for example by writing ``node.asExpr().getExpr()``.
A control-flow graph considers every way control can flow through code, consequently, there can be multiple data-flow and control-flow nodes associated with a single expression node in the AST.
The predicate ``localFlowStep(Node nodeFrom, Node nodeTo)`` holds if there is an immediate data flow edge from the node ``nodeFrom`` to the node ``nodeTo``.
@@ -207,11 +192,7 @@ The global taint tracking library uses the same configuration module as the glob
Predefined sources
~~~~~~~~~~~~~~~~~~
The data flow library module ``codeql.rust.dataflow.FlowSources`` contains a number of predefined sources that you can use to write security queries to track data flow and taint flow.
- The class ``RemoteFlowSource`` represents data flow from remote network inputs and from other applications.
- The class ``LocalFlowSource`` represents data flow from local user input.
- The class ``FlowSource`` includes both of the above.
The library module ``codeql.rust.Concepts`` contains a number of predefined sources and sinks that you can use to write security queries to track data flow and taint flow.
Examples of global data flow
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -229,16 +210,16 @@ The following global taint-tracking query finds places where a string literal is
import codeql.rust.dataflow.TaintTracking
module ConstantPasswordConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node.asExpr().getExpr() instanceof StringLiteralExpr }
predicate isSource(DataFlow::Node node) { node.asExpr().getExpr() instanceof StringLiteralExpr }
predicate isSink(DataFlow::Node node) {
// any argument going to a parameter called `password`
exists(Function f, CallExpr call, int index |
call.getArg(index) = node.asExpr().getExpr() and
call.getStaticTarget() = f and
f.getParam(index).getPat().(IdentPat).getName().getText() = "password"
)
}
predicate isSink(DataFlow::Node node) {
// any argument going to a parameter called `password`
exists(Function f, CallExpr call, int index |
call.getArg(index) = node.asExpr().getExpr() and
call.getStaticTarget() = f and
f.getParam(index).getPat().(IdentPat).getName().getText() = "password"
)
}
}
module ConstantPasswordFlow = TaintTracking::Global<ConstantPasswordConfig>;

2
docs/codeql/codeql-language-guides/codeql-for-rust.rst
View File

@@ -13,4 +13,4 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
analyzing-data-flow-in-rust
- :doc:`CodeQL library for Rust <codeql-library-for-rust>`: When you're analyzing Rust code, you can make use of the large collection of classes in the CodeQL library for Rust.
- :doc:`Analyzing data flow in Ruby <analyzing-data-flow-in-rust>`: You can use CodeQL to track the flow of data through a Rust program to places where the data is used.
- :doc:`Analyzing data flow in Rust <analyzing-data-flow-in-rust>`: You can use CodeQL to track the flow of data through a Rust program to places where the data is used.

6
docs/codeql/codeql-language-guides/codeql-library-for-rust.rst
View File

@@ -12,14 +12,14 @@ CodeQL ships with a library for analyzing Rust code. The classes in this library
abstractions and predicates to help you with common analysis tasks.
The library is implemented as a set of CodeQL modules, that is, files with the extension ``.qll``. The
module `rust.qll <https://github.com/github/codeql/blob/main/rust/ql/lib/rust.qll>`__ imports most other standard library modules, so you can include the complete
library by beginning your query with:
module `rust.qll <https://github.com/github/codeql/blob/main/rust/ql/lib/rust.qll>`__ imports most other standard library modules, so you can include them
by beginning your query with:
.. code-block:: ql
import rust
The CodeQL libraries model various aspects of Rust code. The above import includes the abstract syntax tree (AST) library, which is used for locating program elements,
The CodeQL libraries model various aspects of Rust code. The above import includes the abstract syntax tree (AST) library, which is used for locating program elements
to match syntactic elements in the source code. This can be used for example to find values, patterns and structures.
The control flow graph (CFG) is imported using