hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #21375 from geoffw0/mapfix

Browse Source 
Rust: Add neutral models (map, from)
This commit is contained in:
Geoffrey White
2026-03-06 17:20:14 +00:00
committed by GitHub
parent a6de855549 370c5157f1
commit fd7093e74d
9 changed files with 358 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rust/ql/test/query-tests/security/CWE-117/CONSISTENCY/PathResolutionConsistency.expected Normal file
View File

@@ -0,0 +1,2 @@
multipleResolvedTargets
| main.rs:123:28:123:48 | ...::from(...) |

129
rust/ql/test/query-tests/security/CWE-117/Cargo.lock generated
View File

@@ -34,6 +34,58 @@ version = "1.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
[[package]]
name = "axum"
version = "0.8.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
dependencies = [
"axum-core",
"bytes",
"form_urlencoded",
"futures-util",
"http",
"http-body",
"http-body-util",
"hyper",
"hyper-util",
"itoa",
"matchit",
"memchr",
"mime",
"percent-encoding",
"pin-project-lite",
"serde_core",
"serde_json",
"serde_path_to_error",
"serde_urlencoded",
"sync_wrapper",
"tokio",
"tower",
"tower-layer",
"tower-service",
"tracing",
]
[[package]]
name = "axum-core"
version = "0.5.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
dependencies = [
"bytes",
"futures-core",
"http",
"http-body",
"http-body-util",
"mime",
"pin-project-lite",
"sync_wrapper",
"tower-layer",
"tower-service",
"tracing",
]
[[package]]
name = "backtrace"
version = "0.3.75"
@@ -339,6 +391,12 @@ version = "1.10.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
[[package]]
name = "httpdate"
version = "1.0.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
[[package]]
name = "humantime"
version = "2.2.0"
@@ -358,6 +416,7 @@ dependencies = [
"http",
"http-body",
"httparse",
"httpdate",
"itoa",
"pin-project-lite",
"smallvec",
@@ -592,6 +651,12 @@ version = "0.4.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
[[package]]
name = "matchit"
version = "0.8.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
[[package]]
name = "memchr"
version = "2.7.5"
@@ -951,18 +1016,27 @@ dependencies = [
[[package]]
name = "serde"
version = "1.0.219"
version = "1.0.228"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
dependencies = [
"serde_core",
]
[[package]]
name = "serde_core"
version = "1.0.228"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
dependencies = [
"serde_derive",
]
[[package]]
name = "serde_derive"
version = "1.0.219"
version = "1.0.228"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
dependencies = [
"proc-macro2",
"quote",
@@ -981,6 +1055,17 @@ dependencies = [
"serde",
]
[[package]]
name = "serde_path_to_error"
version = "0.1.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
dependencies = [
"itoa",
"serde",
"serde_core",
]
[[package]]
name = "serde_urlencoded"
version = "0.7.1"
@@ -1111,6 +1196,7 @@ dependencies = [
name = "test"
version = "0.0.1"
dependencies = [
"axum",
"env_logger",
"log",
"reqwest",
@@ -1138,9 +1224,21 @@ dependencies = [
"mio",
"pin-project-lite",
"socket2",
"tokio-macros",
"windows-sys 0.52.0",
]
[[package]]
name = "tokio-macros"
version = "2.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "tokio-native-tls"
version = "0.3.1"
@@ -1174,6 +1272,28 @@ dependencies = [
"tokio",
]
[[package]]
name = "tower"
version = "0.5.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
dependencies = [
"futures-core",
"futures-util",
"pin-project-lite",
"sync_wrapper",
"tokio",
"tower-layer",
"tower-service",
"tracing",
]
[[package]]
name = "tower-layer"
version = "0.3.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
[[package]]
name = "tower-service"
version = "0.3.3"
@@ -1186,6 +1306,7 @@ version = "0.1.41"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
dependencies = [
"log",
"pin-project-lite",
"tracing-core",
]

130
rust/ql/test/query-tests/security/CWE-117/LogInjection.expected
View File

@@ -15,12 +15,13 @@
| main.rs:115:9:115:14 | ...::log | main.rs:109:25:109:38 | ...::args | main.rs:115:9:115:14 | ...::log | Log entry depends on a $@. | main.rs:109:25:109:38 | ...::args | user-provided value |
| main.rs:116:9:116:14 | ...::log | main.rs:109:25:109:38 | ...::args | main.rs:116:9:116:14 | ...::log | Log entry depends on a $@. | main.rs:109:25:109:38 | ...::args | user-provided value |
| main.rs:119:9:119:13 | ...::log | main.rs:109:25:109:38 | ...::args | main.rs:119:9:119:13 | ...::log | Log entry depends on a $@. | main.rs:109:25:109:38 | ...::args | user-provided value |
| main.rs:126:9:126:16 | ...::_print | main.rs:123:25:123:37 | ...::var | main.rs:126:9:126:16 | ...::_print | Log entry depends on a $@. | main.rs:123:25:123:37 | ...::var | user-provided value |
| main.rs:127:9:127:17 | ...::_eprint | main.rs:123:25:123:37 | ...::var | main.rs:127:9:127:17 | ...::_eprint | Log entry depends on a $@. | main.rs:123:25:123:37 | ...::var | user-provided value |
| main.rs:130:9:130:16 | ...::_print | main.rs:127:25:127:37 | ...::var | main.rs:130:9:130:16 | ...::_print | Log entry depends on a $@. | main.rs:127:25:127:37 | ...::var | user-provided value |
| main.rs:131:9:131:17 | ...::_eprint | main.rs:127:25:127:37 | ...::var | main.rs:131:9:131:17 | ...::_eprint | Log entry depends on a $@. | main.rs:127:25:127:37 | ...::var | user-provided value |
| main.rs:143:9:143:16 | ...::_print | main.rs:150:28:150:30 | get | main.rs:143:9:143:16 | ...::_print | Log entry depends on a $@. | main.rs:150:28:150:30 | get | user-provided value |
edges
| main.rs:8:9:8:12 | args [element] | main.rs:9:20:9:23 | args [element] | provenance | |
| main.rs:8:29:8:37 | ...::args | main.rs:8:29:8:39 | ...::args(...) [element] | provenance | Src:MaD:5 |
| main.rs:8:29:8:39 | ...::args(...) [element] | main.rs:8:29:8:49 | ... .collect() [element] | provenance | MaD:9 |
| main.rs:8:29:8:37 | ...::args | main.rs:8:29:8:39 | ...::args(...) [element] | provenance | Src:MaD:6 |
| main.rs:8:29:8:39 | ...::args(...) [element] | main.rs:8:29:8:49 | ... .collect() [element] | provenance | MaD:10 |
| main.rs:8:29:8:49 | ... .collect() [element] | main.rs:8:9:8:12 | args [element] | provenance | |
| main.rs:9:9:9:16 | username | main.rs:15:11:15:36 | MacroExpr | provenance | |
| main.rs:9:9:9:16 | username | main.rs:18:12:18:37 | MacroExpr | provenance | |
@@ -28,21 +29,21 @@ edges
| main.rs:9:9:9:16 | username | main.rs:26:55:26:62 | username | provenance | |
| main.rs:9:9:9:16 | username | main.rs:30:11:30:66 | MacroExpr | provenance | |
| main.rs:9:9:9:16 | username | main.rs:52:29:52:36 | username | provenance | |
| main.rs:9:20:9:23 | args [element] | main.rs:9:20:9:30 | args.get(...) [Some, &ref] | provenance | MaD:12 |
| main.rs:9:20:9:30 | args.get(...) [Some, &ref] | main.rs:9:20:9:64 | ... .unwrap_or(...) [&ref] | provenance | MaD:13 |
| main.rs:9:20:9:64 | ... .unwrap_or(...) [&ref] | main.rs:9:20:9:72 | ... .clone() | provenance | MaD:8 |
| main.rs:9:20:9:23 | args [element] | main.rs:9:20:9:30 | args.get(...) [Some, &ref] | provenance | MaD:13 |
| main.rs:9:20:9:30 | args.get(...) [Some, &ref] | main.rs:9:20:9:64 | ... .unwrap_or(...) [&ref] | provenance | MaD:16 |
| main.rs:9:20:9:64 | ... .unwrap_or(...) [&ref] | main.rs:9:20:9:72 | ... .clone() | provenance | MaD:9 |
| main.rs:9:20:9:72 | ... .clone() | main.rs:9:9:9:16 | username | provenance | |
| main.rs:10:9:10:18 | user_input | main.rs:16:11:16:44 | MacroExpr | provenance | |
| main.rs:10:9:10:18 | user_input | main.rs:19:12:19:39 | MacroExpr | provenance | |
| main.rs:10:22:10:34 | ...::var | main.rs:10:22:10:48 | ...::var(...) [Ok] | provenance | Src:MaD:6 |
| main.rs:10:22:10:48 | ...::var(...) [Ok] | main.rs:10:22:10:81 | ... .unwrap_or(...) | provenance | MaD:16 |
| main.rs:10:22:10:34 | ...::var | main.rs:10:22:10:48 | ...::var(...) [Ok] | provenance | Src:MaD:7 |
| main.rs:10:22:10:48 | ...::var(...) [Ok] | main.rs:10:22:10:81 | ... .unwrap_or(...) | provenance | MaD:19 |
| main.rs:10:22:10:81 | ... .unwrap_or(...) | main.rs:10:9:10:18 | user_input | provenance | |
| main.rs:11:9:11:19 | remote_data | main.rs:17:12:17:46 | MacroExpr | provenance | |
| main.rs:11:9:11:19 | remote_data | main.rs:30:11:30:66 | MacroExpr | provenance | |
| main.rs:11:23:11:44 | ...::get | main.rs:11:23:11:71 | ...::get(...) [Ok] | provenance | Src:MaD:4 |
| main.rs:11:23:11:71 | ...::get(...) [Ok] | main.rs:11:23:12:17 | ... .unwrap() | provenance | MaD:15 |
| main.rs:11:23:12:17 | ... .unwrap() | main.rs:11:23:12:24 | ... .text() [Ok] | provenance | MaD:18 |
| main.rs:11:23:12:24 | ... .text() [Ok] | main.rs:11:23:12:61 | ... .unwrap_or(...) | provenance | MaD:16 |
| main.rs:11:23:11:44 | ...::get | main.rs:11:23:11:71 | ...::get(...) [Ok] | provenance | Src:MaD:5 |
| main.rs:11:23:11:71 | ...::get(...) [Ok] | main.rs:11:23:12:17 | ... .unwrap() | provenance | MaD:18 |
| main.rs:11:23:12:17 | ... .unwrap() | main.rs:11:23:12:24 | ... .text() [Ok] | provenance | MaD:21 |
| main.rs:11:23:12:24 | ... .text() [Ok] | main.rs:11:23:12:61 | ... .unwrap_or(...) | provenance | MaD:19 |
| main.rs:11:23:12:61 | ... .unwrap_or(...) | main.rs:11:9:11:19 | remote_data | provenance | |
| main.rs:15:11:15:36 | MacroExpr | main.rs:15:5:15:9 | ...::log | provenance | MaD:1 Sink:MaD:1 |
| main.rs:16:11:16:44 | MacroExpr | main.rs:16:5:16:9 | ...::log | provenance | MaD:1 Sink:MaD:1 |
@@ -52,12 +53,12 @@ edges
| main.rs:22:9:22:21 | formatted_msg | main.rs:23:11:23:29 | MacroExpr | provenance | |
| main.rs:22:33:22:63 | ...::format(...) | main.rs:22:33:22:63 | { ... } | provenance | |
| main.rs:22:33:22:63 | ...::must_use(...) | main.rs:22:9:22:21 | formatted_msg | provenance | |
| main.rs:22:33:22:63 | MacroExpr | main.rs:22:33:22:63 | ...::format(...) | provenance | MaD:19 |
| main.rs:22:33:22:63 | { ... } | main.rs:22:33:22:63 | ...::must_use(...) | provenance | MaD:20 |
| main.rs:22:33:22:63 | MacroExpr | main.rs:22:33:22:63 | ...::format(...) | provenance | MaD:22 |
| main.rs:22:33:22:63 | { ... } | main.rs:22:33:22:63 | ...::must_use(...) | provenance | MaD:23 |
| main.rs:23:11:23:29 | MacroExpr | main.rs:23:5:23:9 | ...::log | provenance | MaD:1 Sink:MaD:1 |
| main.rs:26:9:26:18 | concat_msg | main.rs:27:11:27:26 | MacroExpr | provenance | |
| main.rs:26:22:26:62 | ... + ... | main.rs:26:9:26:18 | concat_msg | provenance | |
| main.rs:26:54:26:62 | &username [&ref] | main.rs:26:22:26:62 | ... + ... | provenance | MaD:11 |
| main.rs:26:54:26:62 | &username [&ref] | main.rs:26:22:26:62 | ... + ... | provenance | MaD:12 |
| main.rs:26:55:26:62 | username | main.rs:26:54:26:62 | &username [&ref] | provenance | |
| main.rs:27:11:27:26 | MacroExpr | main.rs:27:5:27:9 | ...::log | provenance | MaD:1 Sink:MaD:1 |
| main.rs:30:11:30:66 | MacroExpr | main.rs:30:5:30:9 | ...::log | provenance | MaD:1 Sink:MaD:1 |
@@ -66,7 +67,7 @@ edges
| main.rs:56:27:56:40 | ...: ... [&ref] | main.rs:65:38:65:45 | username [&ref] | provenance | |
| main.rs:65:9:65:17 | user_info [UserInfo] | main.rs:66:28:66:36 | user_info [UserInfo] | provenance | |
| main.rs:65:21:65:59 | UserInfo {...} [UserInfo] | main.rs:65:9:65:17 | user_info [UserInfo] | provenance | |
| main.rs:65:38:65:45 | username [&ref] | main.rs:65:38:65:57 | username.to_string() | provenance | MaD:7 |
| main.rs:65:38:65:45 | username [&ref] | main.rs:65:38:65:57 | username.to_string() | provenance | MaD:8 |
| main.rs:65:38:65:57 | username.to_string() | main.rs:65:21:65:59 | UserInfo {...} [UserInfo] | provenance | |
| main.rs:66:11:66:41 | MacroExpr | main.rs:66:5:66:9 | ...::log | provenance | MaD:1 Sink:MaD:1 |
| main.rs:66:28:66:36 | user_info [UserInfo] | main.rs:66:28:66:41 | user_info.name | provenance | |
@@ -77,9 +78,9 @@ edges
| main.rs:109:13:109:21 | user_data | main.rs:115:16:115:37 | MacroExpr | provenance | |
| main.rs:109:13:109:21 | user_data | main.rs:116:16:116:37 | MacroExpr | provenance | |
| main.rs:109:13:109:21 | user_data | main.rs:119:15:119:75 | MacroExpr | provenance | |
| main.rs:109:25:109:38 | ...::args | main.rs:109:25:109:40 | ...::args(...) [element] | provenance | Src:MaD:5 |
| main.rs:109:25:109:40 | ...::args(...) [element] | main.rs:109:25:109:47 | ... .nth(...) [Some] | provenance | MaD:10 |
| main.rs:109:25:109:47 | ... .nth(...) [Some] | main.rs:109:25:109:67 | ... .unwrap_or_default() | provenance | MaD:14 |
| main.rs:109:25:109:38 | ...::args | main.rs:109:25:109:40 | ...::args(...) [element] | provenance | Src:MaD:6 |
| main.rs:109:25:109:40 | ...::args(...) [element] | main.rs:109:25:109:47 | ... .nth(...) [Some] | provenance | MaD:11 |
| main.rs:109:25:109:47 | ... .nth(...) [Some] | main.rs:109:25:109:67 | ... .unwrap_or_default() | provenance | MaD:17 |
| main.rs:109:25:109:67 | ... .unwrap_or_default() | main.rs:109:13:109:21 | user_data | provenance | |
| main.rs:112:15:112:35 | MacroExpr | main.rs:112:9:112:13 | ...::log | provenance | MaD:1 Sink:MaD:1 |
| main.rs:113:15:113:38 | MacroExpr | main.rs:113:9:113:13 | ...::log | provenance | MaD:1 Sink:MaD:1 |
@@ -87,34 +88,47 @@ edges
| main.rs:115:16:115:37 | MacroExpr | main.rs:115:9:115:14 | ...::log | provenance | MaD:1 Sink:MaD:1 |
| main.rs:116:16:116:37 | MacroExpr | main.rs:116:9:116:14 | ...::log | provenance | MaD:1 Sink:MaD:1 |
| main.rs:119:15:119:75 | MacroExpr | main.rs:119:9:119:13 | ...::log | provenance | MaD:1 Sink:MaD:1 |
| main.rs:123:13:123:21 | user_data | main.rs:126:18:126:38 | MacroExpr | provenance | |
| main.rs:123:13:123:21 | user_data | main.rs:127:19:127:49 | MacroExpr | provenance | |
| main.rs:123:25:123:37 | ...::var | main.rs:123:25:123:45 | ...::var(...) [Ok] | provenance | Src:MaD:6 |
| main.rs:123:25:123:45 | ...::var(...) [Ok] | main.rs:123:25:123:65 | ... .unwrap_or_default() | provenance | MaD:17 |
| main.rs:123:25:123:65 | ... .unwrap_or_default() | main.rs:123:13:123:21 | user_data | provenance | |
| main.rs:126:18:126:38 | MacroExpr | main.rs:126:9:126:16 | ...::_print | provenance | MaD:3 Sink:MaD:3 |
| main.rs:127:19:127:49 | MacroExpr | main.rs:127:9:127:17 | ...::_eprint | provenance | MaD:2 Sink:MaD:2 |
| main.rs:127:13:127:21 | user_data | main.rs:130:18:130:38 | MacroExpr | provenance | |
| main.rs:127:13:127:21 | user_data | main.rs:131:19:131:49 | MacroExpr | provenance | |
| main.rs:127:25:127:37 | ...::var | main.rs:127:25:127:45 | ...::var(...) [Ok] | provenance | Src:MaD:7 |
| main.rs:127:25:127:45 | ...::var(...) [Ok] | main.rs:127:25:127:65 | ... .unwrap_or_default() | provenance | MaD:20 |
| main.rs:127:25:127:65 | ... .unwrap_or_default() | main.rs:127:13:127:21 | user_data | provenance | |
| main.rs:130:18:130:38 | MacroExpr | main.rs:130:9:130:16 | ...::_print | provenance | MaD:3 Sink:MaD:3 |
| main.rs:131:19:131:49 | MacroExpr | main.rs:131:9:131:17 | ...::_eprint | provenance | MaD:2 Sink:MaD:2 |
| main.rs:140:32:140:59 | ...: Option::<...> | main.rs:141:22:141:27 | o_path | provenance | |
| main.rs:141:13:141:18 | m_path [Some] | main.rs:143:26:143:31 | m_path [Some] | provenance | |
| main.rs:141:22:141:27 | o_path | main.rs:141:22:141:38 | o_path.map(...) [Some] | provenance | MaD:14 |
| main.rs:141:22:141:27 | o_path | main.rs:141:34:141:34 | ... | provenance | MaD:14 |
| main.rs:141:22:141:38 | o_path.map(...) [Some] | main.rs:141:13:141:18 | m_path [Some] | provenance | |
| main.rs:141:34:141:34 | ... | main.rs:141:37:141:37 | x | provenance | |
| main.rs:143:18:143:40 | MacroExpr | main.rs:143:9:143:16 | ...::_print | provenance | MaD:3 Sink:MaD:3 |
| main.rs:143:26:143:31 | m_path [Some] | main.rs:143:26:143:40 | m_path.unwrap() | provenance | MaD:15 |
| main.rs:143:26:143:40 | m_path.unwrap() | main.rs:143:18:143:40 | MacroExpr | provenance | |
| main.rs:150:28:150:30 | get | main.rs:140:32:140:59 | ...: Option::<...> | provenance | Src:MaD:4 |
models
| 1 | Sink: log::__private_api::log; Argument[0]; log-injection |
| 2 | Sink: std::io::stdio::_eprint; Argument[0]; log-injection |
| 3 | Sink: std::io::stdio::_print; Argument[0]; log-injection |
| 4 | Source: reqwest::blocking::get; ReturnValue.Field[core::result::Result::Ok(0)]; remote |
| 5 | Source: std::env::args; ReturnValue.Element; commandargs |
| 6 | Source: std::env::var; ReturnValue.Field[core::result::Result::Ok(0)]; environment |
| 7 | Summary: <_ as alloc::string::ToString>::to_string; Argument[self].Reference; ReturnValue; taint |
| 8 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
| 9 | Summary: <_ as core::iter::traits::iterator::Iterator>::collect; Argument[self].Element; ReturnValue.Element; value |
| 10 | Summary: <_ as core::iter::traits::iterator::Iterator>::nth; Argument[self].Reference.Element; ReturnValue.Field[core::option::Option::Some(0)]; value |
| 11 | Summary: <alloc::string::String as core::ops::arith::Add>::add; Argument[0].Reference; ReturnValue; taint |
| 12 | Summary: <alloc::vec::Vec as core::ops::deref::Deref>::deref; Argument[self].Reference.Element; ReturnValue.Reference.Element; value |
| 13 | Summary: <core::option::Option>::unwrap_or; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
| 14 | Summary: <core::option::Option>::unwrap_or_default; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
| 15 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 16 | Summary: <core::result::Result>::unwrap_or; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 17 | Summary: <core::result::Result>::unwrap_or_default; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 18 | Summary: <reqwest::blocking::response::Response>::text; Argument[self]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
| 19 | Summary: alloc::fmt::format; Argument[0]; ReturnValue; taint |
| 20 | Summary: core::hint::must_use; Argument[0]; ReturnValue; value |
| 4 | Source: axum::routing::method_routing::get; Argument[0].Parameter[0..7]; remote |
| 5 | Source: reqwest::blocking::get; ReturnValue.Field[core::result::Result::Ok(0)]; remote |
| 6 | Source: std::env::args; ReturnValue.Element; commandargs |
| 7 | Source: std::env::var; ReturnValue.Field[core::result::Result::Ok(0)]; environment |
| 8 | Summary: <_ as alloc::string::ToString>::to_string; Argument[self].Reference; ReturnValue; taint |
| 9 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
| 10 | Summary: <_ as core::iter::traits::iterator::Iterator>::collect; Argument[self].Element; ReturnValue.Element; value |
| 11 | Summary: <_ as core::iter::traits::iterator::Iterator>::nth; Argument[self].Reference.Element; ReturnValue.Field[core::option::Option::Some(0)]; value |
| 12 | Summary: <alloc::string::String as core::ops::arith::Add>::add; Argument[0].Reference; ReturnValue; taint |
| 13 | Summary: <alloc::vec::Vec as core::ops::deref::Deref>::deref; Argument[self].Reference.Element; ReturnValue.Reference.Element; value |
| 14 | Summary: <core::option::Option>::map; Argument[self].Field[core::option::Option::Some(0)]; Argument[0].Parameter[0]; value |
| 15 | Summary: <core::option::Option>::unwrap; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
| 16 | Summary: <core::option::Option>::unwrap_or; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
| 17 | Summary: <core::option::Option>::unwrap_or_default; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
| 18 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 19 | Summary: <core::result::Result>::unwrap_or; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 20 | Summary: <core::result::Result>::unwrap_or_default; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
| 21 | Summary: <reqwest::blocking::response::Response>::text; Argument[self]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
| 22 | Summary: alloc::fmt::format; Argument[0]; ReturnValue; taint |
| 23 | Summary: core::hint::must_use; Argument[0]; ReturnValue; value |
nodes
| main.rs:8:9:8:12 | args [element] | semmle.label | args [element] |
| main.rs:8:29:8:37 | ...::args | semmle.label | ...::args |
@@ -188,12 +202,24 @@ nodes
| main.rs:116:16:116:37 | MacroExpr | semmle.label | MacroExpr |
| main.rs:119:9:119:13 | ...::log | semmle.label | ...::log |
| main.rs:119:15:119:75 | MacroExpr | semmle.label | MacroExpr |
| main.rs:123:13:123:21 | user_data | semmle.label | user_data |
| main.rs:123:25:123:37 | ...::var | semmle.label | ...::var |
| main.rs:123:25:123:45 | ...::var(...) [Ok] | semmle.label | ...::var(...) [Ok] |
| main.rs:123:25:123:65 | ... .unwrap_or_default() | semmle.label | ... .unwrap_or_default() |
| main.rs:126:9:126:16 | ...::_print | semmle.label | ...::_print |
| main.rs:126:18:126:38 | MacroExpr | semmle.label | MacroExpr |
| main.rs:127:9:127:17 | ...::_eprint | semmle.label | ...::_eprint |
| main.rs:127:19:127:49 | MacroExpr | semmle.label | MacroExpr |
| main.rs:127:13:127:21 | user_data | semmle.label | user_data |
| main.rs:127:25:127:37 | ...::var | semmle.label | ...::var |
| main.rs:127:25:127:45 | ...::var(...) [Ok] | semmle.label | ...::var(...) [Ok] |
| main.rs:127:25:127:65 | ... .unwrap_or_default() | semmle.label | ... .unwrap_or_default() |
| main.rs:130:9:130:16 | ...::_print | semmle.label | ...::_print |
| main.rs:130:18:130:38 | MacroExpr | semmle.label | MacroExpr |
| main.rs:131:9:131:17 | ...::_eprint | semmle.label | ...::_eprint |
| main.rs:131:19:131:49 | MacroExpr | semmle.label | MacroExpr |
| main.rs:140:32:140:59 | ...: Option::<...> | semmle.label | ...: Option::<...> |
| main.rs:141:13:141:18 | m_path [Some] | semmle.label | m_path [Some] |
| main.rs:141:22:141:27 | o_path | semmle.label | o_path |
| main.rs:141:22:141:38 | o_path.map(...) [Some] | semmle.label | o_path.map(...) [Some] |
| main.rs:141:34:141:34 | ... | semmle.label | ... |
| main.rs:141:37:141:37 | x | semmle.label | x |
| main.rs:143:9:143:16 | ...::_print | semmle.label | ...::_print |
| main.rs:143:18:143:40 | MacroExpr | semmle.label | MacroExpr |
| main.rs:143:26:143:31 | m_path [Some] | semmle.label | m_path [Some] |
| main.rs:143:26:143:40 | m_path.unwrap() | semmle.label | m_path.unwrap() |
| main.rs:150:28:150:30 | get | semmle.label | get |
subpaths
| main.rs:141:22:141:27 | o_path | main.rs:141:34:141:34 | ... | main.rs:141:37:141:37 | x | main.rs:141:22:141:38 | o_path.map(...) [Some] |

23
rust/ql/test/query-tests/security/CWE-117/main.rs
View File

@@ -117,6 +117,10 @@ mod additional_tests {
// BAD: Complex format strings
info!("User {} did action {} at time {}", user_data, "login", "now"); // $ Alert[rust/log-injection]=commandargs
// GOOD: non-sinks
let _ : Vec<u8> = From::from(user_data.clone());
let _ : Box<str> = From::from(user_data);
}
pub fn test_println_patterns() {
@@ -127,3 +131,22 @@ mod additional_tests {
eprintln!("Error for user: {}", user_data); // $ Alert[rust/log-injection]=environment
}
}
mod axum_tests {
use axum::extract::Path;
use axum::routing::get;
use axum::Router;
async fn my_axum_handler_1(o_path: Option<Path<String>>) -> &'static str {
let m_path = o_path.map(|x| x);
println!("{:?}", m_path.unwrap()); // $ Alert[rust/log-injection]=post_handler
""
}
async fn test_axum() {
let app = Router::<()>::new()
.route("/{a}", get(my_axum_handler_1)); // $ Source=post_handler
}
}

3
rust/ql/test/query-tests/security/CWE-117/options.yml
View File

@@ -2,4 +2,5 @@ qltest_cargo_check: true
qltest_dependencies:
- log = "0.4"
- env_logger = "0.10"
- reqwest = { version = "0.12.9", features = ["blocking"] }
- reqwest = { version = "0.12.9", features = ["blocking"] }
- axum = { version = "0.8.7" }

173
rust/ql/test/query-tests/security/CWE-770/UncontrolledAllocationSize.expected
View File

@@ -1,56 +1,57 @@
#select
| main.rs:18:13:18:31 | ...::realloc | main.rs:320:13:320:26 | ...::args | main.rs:18:13:18:31 | ...::realloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:21:13:21:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:21:13:21:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:22:13:22:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:22:13:22:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:23:13:23:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:23:13:23:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:24:13:24:36 | ...::alloc_zeroed | main.rs:320:13:320:26 | ...::args | main.rs:24:13:24:36 | ...::alloc_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:30:13:30:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:30:13:30:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:33:13:33:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:33:13:33:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:37:13:37:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:37:13:37:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:40:13:40:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:40:13:40:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:50:13:50:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:50:13:50:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:51:13:51:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:51:13:51:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:53:13:53:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:53:13:53:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:54:13:54:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:54:13:54:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:59:13:59:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:59:13:59:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:61:13:61:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:61:13:61:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:63:13:63:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:63:13:63:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:64:13:64:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:64:13:64:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:65:13:65:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:65:13:65:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:68:13:68:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:68:13:68:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:88:13:88:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:88:13:88:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:96:17:96:33 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:96:17:96:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:102:17:102:33 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:102:17:102:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:103:17:103:33 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:103:17:103:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:109:17:109:33 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:109:17:109:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:111:17:111:33 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:111:17:111:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:146:17:146:33 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:146:17:146:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:148:17:148:33 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:148:17:148:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:152:13:152:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:152:13:152:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:155:13:155:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:155:13:155:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:162:17:162:33 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:162:17:162:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:169:17:169:33 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:169:17:169:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:177:13:177:29 | ...::alloc | main.rs:320:13:320:26 | ...::args | main.rs:177:13:177:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:193:32:193:36 | alloc | main.rs:320:13:320:26 | ...::args | main.rs:193:32:193:36 | alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:194:32:194:43 | alloc_zeroed | main.rs:320:13:320:26 | ...::args | main.rs:194:32:194:43 | alloc_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:195:32:195:39 | allocate | main.rs:320:13:320:26 | ...::args | main.rs:195:32:195:39 | allocate | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:196:32:196:46 | allocate_zeroed | main.rs:320:13:320:26 | ...::args | main.rs:196:32:196:46 | allocate_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:197:32:197:39 | allocate | main.rs:320:13:320:26 | ...::args | main.rs:197:32:197:39 | allocate | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:198:32:198:46 | allocate_zeroed | main.rs:320:13:320:26 | ...::args | main.rs:198:32:198:46 | allocate_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:202:32:202:38 | realloc | main.rs:320:13:320:26 | ...::args | main.rs:202:32:202:38 | realloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:208:40:208:43 | grow | main.rs:320:13:320:26 | ...::args | main.rs:208:40:208:43 | grow | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:210:40:210:50 | grow_zeroed | main.rs:320:13:320:26 | ...::args | main.rs:210:40:210:50 | grow_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:213:36:213:41 | shrink | main.rs:320:13:320:26 | ...::args | main.rs:213:36:213:41 | shrink | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:219:13:219:24 | ...::malloc | main.rs:320:13:320:26 | ...::args | main.rs:219:13:219:24 | ...::malloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:220:13:220:31 | ...::aligned_alloc | main.rs:320:13:320:26 | ...::args | main.rs:220:13:220:31 | ...::aligned_alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:222:13:222:24 | ...::calloc | main.rs:320:13:320:26 | ...::args | main.rs:222:13:222:24 | ...::calloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:223:13:223:24 | ...::calloc | main.rs:320:13:320:26 | ...::args | main.rs:223:13:223:24 | ...::calloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:224:13:224:25 | ...::realloc | main.rs:320:13:320:26 | ...::args | main.rs:224:13:224:25 | ...::realloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:228:13:228:41 | ...::try_with_capacity | main.rs:320:13:320:26 | ...::args | main.rs:228:13:228:41 | ...::try_with_capacity | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:229:13:229:37 | ...::with_capacity | main.rs:320:13:320:26 | ...::args | main.rs:229:13:229:37 | ...::with_capacity | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:230:13:230:44 | ...::try_with_capacity_in | main.rs:320:13:320:26 | ...::args | main.rs:230:13:230:44 | ...::try_with_capacity_in | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:231:13:231:40 | ...::with_capacity_in | main.rs:320:13:320:26 | ...::args | main.rs:231:13:231:40 | ...::with_capacity_in | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:320:13:320:26 | ...::args | user-provided value |
| main.rs:18:13:18:31 | ...::realloc | main.rs:339:13:339:26 | ...::args | main.rs:18:13:18:31 | ...::realloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:21:13:21:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:21:13:21:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:22:13:22:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:22:13:22:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:23:13:23:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:23:13:23:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:24:13:24:36 | ...::alloc_zeroed | main.rs:339:13:339:26 | ...::args | main.rs:24:13:24:36 | ...::alloc_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:30:13:30:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:30:13:30:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:33:13:33:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:33:13:33:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:37:13:37:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:37:13:37:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:40:13:40:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:40:13:40:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:50:13:50:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:50:13:50:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:51:13:51:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:51:13:51:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:53:13:53:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:53:13:53:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:54:13:54:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:54:13:54:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:59:13:59:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:59:13:59:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:61:13:61:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:61:13:61:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:63:13:63:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:63:13:63:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:64:13:64:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:64:13:64:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:65:13:65:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:65:13:65:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:68:13:68:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:68:13:68:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:88:13:88:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:88:13:88:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:96:17:96:33 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:96:17:96:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:102:17:102:33 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:102:17:102:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:103:17:103:33 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:103:17:103:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:109:17:109:33 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:109:17:109:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:111:17:111:33 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:111:17:111:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:146:17:146:33 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:146:17:146:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:148:17:148:33 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:148:17:148:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:152:13:152:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:152:13:152:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:155:13:155:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:155:13:155:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:162:17:162:33 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:162:17:162:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:169:17:169:33 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:169:17:169:33 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:177:13:177:29 | ...::alloc | main.rs:339:13:339:26 | ...::args | main.rs:177:13:177:29 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:193:32:193:36 | alloc | main.rs:339:13:339:26 | ...::args | main.rs:193:32:193:36 | alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:194:32:194:43 | alloc_zeroed | main.rs:339:13:339:26 | ...::args | main.rs:194:32:194:43 | alloc_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:195:32:195:39 | allocate | main.rs:339:13:339:26 | ...::args | main.rs:195:32:195:39 | allocate | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:196:32:196:46 | allocate_zeroed | main.rs:339:13:339:26 | ...::args | main.rs:196:32:196:46 | allocate_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:197:32:197:39 | allocate | main.rs:339:13:339:26 | ...::args | main.rs:197:32:197:39 | allocate | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:198:32:198:46 | allocate_zeroed | main.rs:339:13:339:26 | ...::args | main.rs:198:32:198:46 | allocate_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:202:32:202:38 | realloc | main.rs:339:13:339:26 | ...::args | main.rs:202:32:202:38 | realloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:208:40:208:43 | grow | main.rs:339:13:339:26 | ...::args | main.rs:208:40:208:43 | grow | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:210:40:210:50 | grow_zeroed | main.rs:339:13:339:26 | ...::args | main.rs:210:40:210:50 | grow_zeroed | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:213:36:213:41 | shrink | main.rs:339:13:339:26 | ...::args | main.rs:213:36:213:41 | shrink | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:219:13:219:24 | ...::malloc | main.rs:339:13:339:26 | ...::args | main.rs:219:13:219:24 | ...::malloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:220:13:220:31 | ...::aligned_alloc | main.rs:339:13:339:26 | ...::args | main.rs:220:13:220:31 | ...::aligned_alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:222:13:222:24 | ...::calloc | main.rs:339:13:339:26 | ...::args | main.rs:222:13:222:24 | ...::calloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:223:13:223:24 | ...::calloc | main.rs:339:13:339:26 | ...::args | main.rs:223:13:223:24 | ...::calloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:224:13:224:25 | ...::realloc | main.rs:339:13:339:26 | ...::args | main.rs:224:13:224:25 | ...::realloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:228:13:228:41 | ...::try_with_capacity | main.rs:339:13:339:26 | ...::args | main.rs:228:13:228:41 | ...::try_with_capacity | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:229:13:229:37 | ...::with_capacity | main.rs:339:13:339:26 | ...::args | main.rs:229:13:229:37 | ...::with_capacity | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:230:13:230:44 | ...::try_with_capacity_in | main.rs:339:13:339:26 | ...::args | main.rs:230:13:230:44 | ...::try_with_capacity_in | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:231:13:231:40 | ...::with_capacity_in | main.rs:339:13:339:26 | ...::args | main.rs:231:13:231:40 | ...::with_capacity_in | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
| main.rs:287:22:287:38 | ...::alloc | main.rs:311:25:311:38 | ...::args | main.rs:287:22:287:38 | ...::alloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:311:25:311:38 | ...::args | user-provided value |
| main.rs:331:13:331:24 | ...::malloc | main.rs:339:13:339:26 | ...::args | main.rs:331:13:331:24 | ...::malloc | This allocation size is derived from a $@ and could allocate arbitrary amounts of memory. | main.rs:339:13:339:26 | ...::args | user-provided value |
edges
| main.rs:12:36:12:43 | ...: usize | main.rs:18:41:18:41 | v | provenance | |
| main.rs:18:41:18:41 | v | main.rs:18:13:18:31 | ...::realloc | provenance | MaD:17 Sink:MaD:17 |
@@ -270,24 +271,28 @@ edges
| main.rs:311:25:311:40 | ...::args(...) [element] | main.rs:311:25:311:47 | ... .nth(...) [Some] | provenance | MaD:23 |
| main.rs:311:25:311:47 | ... .nth(...) [Some] | main.rs:311:25:311:74 | ... .unwrap_or(...) | provenance | MaD:39 |
| main.rs:311:25:311:74 | ... .unwrap_or(...) | main.rs:282:24:282:41 | ...: String | provenance | |
| main.rs:320:9:320:9 | v | main.rs:323:34:323:34 | v | provenance | |
| main.rs:320:9:320:9 | v | main.rs:324:42:324:42 | v | provenance | |
| main.rs:320:9:320:9 | v | main.rs:325:36:325:36 | v | provenance | |
| main.rs:320:9:320:9 | v | main.rs:326:27:326:27 | v | provenance | |
| main.rs:320:9:320:9 | v | main.rs:327:25:327:25 | v | provenance | |
| main.rs:320:9:320:9 | v | main.rs:328:22:328:22 | v | provenance | |
| main.rs:320:13:320:26 | ...::args | main.rs:320:13:320:28 | ...::args(...) [element] | provenance | Src:MaD:22 |
| main.rs:320:13:320:28 | ...::args(...) [element] | main.rs:320:13:320:35 | ... .nth(...) [Some] | provenance | MaD:23 |
| main.rs:320:13:320:35 | ... .nth(...) [Some] | main.rs:320:13:320:65 | ... .unwrap_or(...) | provenance | MaD:39 |
| main.rs:320:13:320:65 | ... .unwrap_or(...) | main.rs:320:13:320:82 | ... .parse() [Ok] | provenance | MaD:26 |
| main.rs:320:13:320:82 | ... .parse() [Ok] | main.rs:320:13:320:91 | ... .unwrap() | provenance | MaD:41 |
| main.rs:320:13:320:91 | ... .unwrap() | main.rs:320:9:320:9 | v | provenance | |
| main.rs:323:34:323:34 | v | main.rs:12:36:12:43 | ...: usize | provenance | |
| main.rs:324:42:324:42 | v | main.rs:43:44:43:51 | ...: usize | provenance | |
| main.rs:325:36:325:36 | v | main.rs:91:38:91:45 | ...: usize | provenance | |
| main.rs:326:27:326:27 | v | main.rs:183:29:183:36 | ...: usize | provenance | |
| main.rs:327:25:327:25 | v | main.rs:217:27:217:34 | ...: usize | provenance | |
| main.rs:328:22:328:22 | v | main.rs:227:24:227:31 | ...: usize | provenance | |
| main.rs:317:26:317:33 | ...: usize | main.rs:331:26:331:26 | a | provenance | |
| main.rs:331:26:331:26 | a | main.rs:331:13:331:24 | ...::malloc | provenance | MaD:20 Sink:MaD:20 |
| main.rs:339:9:339:9 | v | main.rs:342:34:342:34 | v | provenance | |
| main.rs:339:9:339:9 | v | main.rs:343:42:343:42 | v | provenance | |
| main.rs:339:9:339:9 | v | main.rs:344:36:344:36 | v | provenance | |
| main.rs:339:9:339:9 | v | main.rs:345:27:345:27 | v | provenance | |
| main.rs:339:9:339:9 | v | main.rs:346:25:346:25 | v | provenance | |
| main.rs:339:9:339:9 | v | main.rs:347:22:347:22 | v | provenance | |
| main.rs:339:9:339:9 | v | main.rs:349:24:349:24 | v | provenance | |
| main.rs:339:13:339:26 | ...::args | main.rs:339:13:339:28 | ...::args(...) [element] | provenance | Src:MaD:22 |
| main.rs:339:13:339:28 | ...::args(...) [element] | main.rs:339:13:339:35 | ... .nth(...) [Some] | provenance | MaD:23 |
| main.rs:339:13:339:35 | ... .nth(...) [Some] | main.rs:339:13:339:65 | ... .unwrap_or(...) | provenance | MaD:39 |
| main.rs:339:13:339:65 | ... .unwrap_or(...) | main.rs:339:13:339:82 | ... .parse() [Ok] | provenance | MaD:26 |
| main.rs:339:13:339:82 | ... .parse() [Ok] | main.rs:339:13:339:91 | ... .unwrap() | provenance | MaD:41 |
| main.rs:339:13:339:91 | ... .unwrap() | main.rs:339:9:339:9 | v | provenance | |
| main.rs:342:34:342:34 | v | main.rs:12:36:12:43 | ...: usize | provenance | |
| main.rs:343:42:343:42 | v | main.rs:43:44:43:51 | ...: usize | provenance | |
| main.rs:344:36:344:36 | v | main.rs:91:38:91:45 | ...: usize | provenance | |
| main.rs:345:27:345:27 | v | main.rs:183:29:183:36 | ...: usize | provenance | |
| main.rs:346:25:346:25 | v | main.rs:217:27:217:34 | ...: usize | provenance | |
| main.rs:347:22:347:22 | v | main.rs:227:24:227:31 | ...: usize | provenance | |
| main.rs:349:24:349:24 | v | main.rs:317:26:317:33 | ...: usize | provenance | |
models
| 1 | Sink: <alloc::alloc::Global as core::alloc::Allocator>::allocate; Argument[0]; alloc-layout |
| 2 | Sink: <alloc::alloc::Global as core::alloc::Allocator>::allocate_zeroed; Argument[0]; alloc-layout |
@@ -555,17 +560,21 @@ nodes
| main.rs:311:25:311:40 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
| main.rs:311:25:311:47 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
| main.rs:311:25:311:74 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
| main.rs:320:9:320:9 | v | semmle.label | v |
| main.rs:320:13:320:26 | ...::args | semmle.label | ...::args |
| main.rs:320:13:320:28 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
| main.rs:320:13:320:35 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
| main.rs:320:13:320:65 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
| main.rs:320:13:320:82 | ... .parse() [Ok] | semmle.label | ... .parse() [Ok] |
| main.rs:320:13:320:91 | ... .unwrap() | semmle.label | ... .unwrap() |
| main.rs:323:34:323:34 | v | semmle.label | v |
| main.rs:324:42:324:42 | v | semmle.label | v |
| main.rs:325:36:325:36 | v | semmle.label | v |
| main.rs:326:27:326:27 | v | semmle.label | v |
| main.rs:327:25:327:25 | v | semmle.label | v |
| main.rs:328:22:328:22 | v | semmle.label | v |
| main.rs:317:26:317:33 | ...: usize | semmle.label | ...: usize |
| main.rs:331:13:331:24 | ...::malloc | semmle.label | ...::malloc |
| main.rs:331:26:331:26 | a | semmle.label | a |
| main.rs:339:9:339:9 | v | semmle.label | v |
| main.rs:339:13:339:26 | ...::args | semmle.label | ...::args |
| main.rs:339:13:339:28 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
| main.rs:339:13:339:35 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
| main.rs:339:13:339:65 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
| main.rs:339:13:339:82 | ... .parse() [Ok] | semmle.label | ... .parse() [Ok] |
| main.rs:339:13:339:91 | ... .unwrap() | semmle.label | ... .unwrap() |
| main.rs:342:34:342:34 | v | semmle.label | v |
| main.rs:343:42:343:42 | v | semmle.label | v |
| main.rs:344:36:344:36 | v | semmle.label | v |
| main.rs:345:27:345:27 | v | semmle.label | v |
| main.rs:346:25:346:25 | v | semmle.label | v |
| main.rs:347:22:347:22 | v | semmle.label | v |
| main.rs:349:24:349:24 | v | semmle.label | v |
subpaths

20
rust/ql/test/query-tests/security/CWE-770/main.rs
View File

@@ -312,6 +312,25 @@ fn test_examples() {
allocate_buffer_good(std::env::args().nth(1).unwrap_or("0".to_string()));
}
extern crate alloc;
unsafe fn test_non_sinks(a: usize) {
let b = a as u64;
let _ = Vec::from([a]);
let _ = std::vec::Vec::from([a]);
let _ = alloc::vec::Vec::from([a]);
let _ : Vec<usize> = From::from([a]);
let _ : std::vec::Vec<usize> = From::from([a]);
let _ : alloc::vec::Vec<usize> = From::from([a]);
let _ = i128 ::from(b);
let _ : i128 = From::from(b);
let _ = libc::malloc(a); // $ Alert[rust/uncontrolled-allocation-size]=arg1
}
// --- main ---
fn main() {
@@ -327,6 +346,7 @@ fn main() {
test_libc_alloc(v);
test_vectors(v);
test_examples();
test_non_sinks(v);
}
println!("--- end ---");