Rust: Data flow through trait methods #19881
Open
+938
−578
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2ef6a9f to
5e79203
Compare
5e79203 to
8c24039
Compare
There was a problem hiding this comment.
Pull Request Overview
Enhance data-flow tracking by dispatching trait method calls to all implementations and by applying data-flow models to implementations without source code.
- Extend models to include
Ord::maxandPartialOrd::lttrait methods - Update tests to cover trait dispatch scenarios and adjust expectations
- Introduce QL predicates for runtime trait dispatch (
getARuntimeTarget,implements) and adjust DataFlowImpl to use them
Reviewed Changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| rust/ql/test/library-tests/dataflow/models/models.ext.yml | Add models for <_ as Ord>::max and <_ as PartialOrd>::lt |
| rust/ql/test/library-tests/dataflow/models/models.expected | Update expected summaries to include new trait models |
| rust/ql/test/library-tests/dataflow/models/main.rs | Add test_trait_model and trait implementations for Ord |
| rust/ql/test/library-tests/dataflow/global/main.rs | Introduce MyTrait, MyTrait2, and trait-dispatch tests |
| rust/ql/lib/codeql/rust/internal/PathResolution.qll | Add getAssocItem(name) helper |
| rust/ql/lib/codeql/rust/elements/internal/CallImpl.qll | Define getARuntimeTarget for dispatching to impls |
| rust/ql/lib/codeql/rust/elements/internal/AssocItemImpl.qll | Implement implements relation for associated items |
| rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll | Override hasProvenance to pick up summary models |
| rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll | Enhance viableCallable to consider runtime trait dispatch |
| rust/ql/.gitattributes | Remove generated marker for AssocItemImpl.qll |
| rust/ql/.generated.list | Remove AssocItemImpl.qll from generated list |
Comments suppressed due to low confidence (2)
rust/ql/test/library-tests/dataflow/global/main.rs:280
- [nitpick] Using a numeric suffix in the trait name (
MyTrait2) can be confusing; consider a more descriptive name or merge it into the existing trait to avoid ambiguity.
trait MyTrait2 {
rust/ql/lib/codeql/rust/elements/internal/CallImpl.qll:71
- [nitpick] Method name
getARuntimeTargetis a bit verbose and uses mixed-case acronym; consider renaming togetRuntimeTargetfor consistency with your naming conventions.
Function getARuntimeTarget() {
| @@ -404,10 +404,20 @@ module RustDataFlow implements InputSig<Location> { | |||
|
|
|||
| /** Gets a viable implementation of the target of the given `Call`. */ | |||
| DataFlowCallable viableCallable(DataFlowCall call) { | |||
There was a problem hiding this comment.
[nitpick] The viableCallable definition contains deeply nested exists and or expressions; extracting the trait-dispatch logic into a helper predicate could improve readability and maintenance.
Copilot uses AI. Check for mistakes.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR makes two improvements to data flow:
foo<T : Trait>(x : T) { x.trait_method() }, data flow will now dispatch to all possible implementations of the trait method, just like we do for virtual dispatch in OO languages like C# and Java.The first improvement is likely to result in some false positive flow, which we can address to some extent later by tracking types in data flow.