diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll b/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll index bd9e3695efbd..f416c2a20e57 100644 --- a/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll +++ b/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll @@ -1160,12 +1160,19 @@ private module Cached { /** Holds if `n` is a flow barrier of kind `kind`. */ cached predicate barrierNode(Node n, string kind) { - exists(string model | - n.(FlowSummaryNode) - .getSummaryNode() - .(FlowSummaryImpl::Private::SourceOutputNode) - .isEntry(kind, model) - // getSourceElement().(FlowBarrier).isBarrier(_, kind, _, _) + exists( + FlowSummaryImpl::Public::BarrierElement b, + FlowSummaryImpl::Private::SummaryComponentStack stack + | + FlowSummaryImpl::Private::barrierSpec(b, stack, kind, _) + | + n = FlowSummaryImpl::StepsInput::getSourceNode(b, stack, false) + or + // For barriers like `Argument[0]` we want to target the pre-update node + n = + FlowSummaryImpl::StepsInput::getSourceNode(b, stack, true) + .(PostUpdateNode) + .getPreUpdateNode() ) } diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll b/rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll index ab0b3aff9ca9..850328146518 100644 --- a/rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll +++ b/rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll @@ -143,7 +143,7 @@ module Input implements InputSig { private import Make as Impl -private module StepsInput implements Impl::Private::StepsInputSig { +module StepsInput implements Impl::Private::StepsInputSig { DataFlowCall getACall(Public::SummarizedCallable sc) { result.asCall().getStaticTarget() = sc } /** Gets the argument of `source` described by `sc`, if any. */ @@ -171,18 +171,27 @@ private module StepsInput implements Impl::Private::StepsInputSig { result.asCfgScope() = source.getEnclosingCfgScope() } - RustDataFlow::Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { + additional RustDataFlow::Node getSourceNode( + Input::SourceBase source, Impl::Private::SummaryComponentStack s, boolean isArgPostUpdate + ) { s.head() = Impl::Private::SummaryComponent::return(_) and - result.asExpr() = source.getCall() + result.asExpr() = source.getCall() and + isArgPostUpdate = false or exists(RustDataFlow::ArgumentPosition pos, Expr arg | s.head() = Impl::Private::SummaryComponent::parameter(pos) and arg = getSourceNodeArgument(source, s.tail().headOfSingleton()) and - result.asParameter() = getCallable(arg).getParam(pos.getPosition()) + result.asParameter() = getCallable(arg).getParam(pos.getPosition()) and + isArgPostUpdate = false ) or result.(RustDataFlow::PostUpdateNode).getPreUpdateNode().asExpr() = - getSourceNodeArgument(source, s.headOfSingleton()) + getSourceNodeArgument(source, s.headOfSingleton()) and + isArgPostUpdate = true + } + + RustDataFlow::Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { + result = getSourceNode(source, s, _) } RustDataFlow::Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { diff --git a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll index d8b224b8e1af..fa20405f7882 100644 --- a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll +++ b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll @@ -736,7 +736,19 @@ module Make< ) } - private predicate summarySpec(string spec) { + private predicate isRelevantBarrier( + BarrierElement e, string output, string kind, Provenance provenance, string model + ) { + e.isBarrier(output, kind, provenance, model) and + ( + provenance.isManual() + or + provenance.isGenerated() and + not exists(Provenance p | p.isManual() and e.isBarrier(_, kind, p, _)) + ) + } + + private predicate flowSpec(string spec) { exists(SummarizedCallable c | c.propagatesFlow(spec, _, _, _, _, _) or @@ -745,10 +757,12 @@ module Make< or isRelevantSource(_, spec, _, _, _) or + isRelevantBarrier(_, spec, _, _, _) + or isRelevantSink(_, spec, _, _, _) } - import AccessPathSyntax::AccessPath + import AccessPathSyntax::AccessPath /** Holds if specification component `token` parses as parameter `pos`. */ predicate parseParam(AccessPathToken token, ArgumentPosition pos) { @@ -1528,6 +1542,18 @@ module Make< ) } + /** + * Holds if `barrier` is a relevant barrier element with output specification `outSpec`. + */ + predicate barrierSpec( + BarrierElement barrier, SummaryComponentStack outSpec, string kind, string model + ) { + exists(string output | + isRelevantBarrier(barrier, output, kind, _, model) and + External::interpretSpec(output, outSpec) + ) + } + signature module TypesInputSig { /** Gets the type of content `c`. */ DataFlowType getContentType(ContentSet c);