Rust: Address result duplication in rust/hard-coded-cryptographic-value

[geoffw0]

Small fix for a result duplication issue in rust/hard-coded-cryptographic-value. The issue is a match expression containing constants in each or many of the match arms, for example (from the test):

let str3 = match(val) {
    0 => "one", // constant
    1 => "two", // constant
    _ => "many" // constant
}

It turns out this can cause quite severe multiplication of results in rare cases (e.g. imagine the above but with 100 cases, and flowing to 20 sinks). The solution is to make the match expression itself the source, as it's close enough to see what's going on with just one result.

[Copilot]

Pull request overview

Collapses constant match-arm sources into the enclosing match expression, preventing duplicate cryptographic-value alerts.

Changes:

• Treats qualifying match expressions as constant sources.
• Adds regression coverage and updates expected results.
• Documents the analysis improvement.

Show a summary per file

File	Description
HardcodedCryptographicValueExtensions.qll	Adds match-expression source aggregation.
test_cookie.rs	Adds regression test coverage.
HardcodedCryptographicValue.expected	Updates generated expectations.
2026-08-25-hardcoded-cryptographic-match-expressions.md	Adds change note.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced