Skip to content

Commit 00b556c

Browse files
ropwareJBropwareJB
authored
Revert "Remove Broken Rust Queries"
1 parent aec5d89 commit 00b556c

File tree

6 files changed

+149
-0
lines changed

6 files changed

+149
-0
lines changed

‎rust/ql/src/queries/diagnostics/DataFlowConsistencyCounts.ql‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @name Data flow inconsistency counts
3+
* @description Counts the number of data flow inconsistencies of each type. This query is intended for internal use.
4+
* @kind diagnostic
5+
* @id rust/diagnostics/data-flow-consistency-counts
6+
*/
7+
8+
import codeql.rust.dataflow.internal.DataFlowConsistency as Consistency
9+
10+
// see also `rust/diagnostics/data-flow-consistency`, which lists the
11+
// individual inconsistency results.
12+
from string type, int num
13+
where num = Consistency::getInconsistencyCounts(type)
14+
select type, num

‎rust/ql/src/queries/security/CWE-089/SqlInjection.ql‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* @name Database query built from user-controlled sources
3+
* @description Building a database query from user-controlled sources is vulnerable to insertion of malicious code by attackers.
4+
* @kind path-problem
5+
* @problem.severity error
6+
* @security-severity 8.8
7+
* @precision high
8+
* @id rust/sql-injection
9+
* @tags security
10+
* external/cwe/cwe-089
11+
*/
12+
13+
import rust
14+
import codeql.rust.dataflow.DataFlow
15+
import codeql.rust.dataflow.TaintTracking
16+
import codeql.rust.security.SqlInjectionExtensions
17+
import SqlInjectionFlow::PathGraph
18+
19+
/**
20+
* A taint configuration for tainted data that reaches a SQL sink.
21+
*/
22+
module SqlInjectionConfig implements DataFlow::ConfigSig {
23+
predicate isSource(DataFlow::Node node) { node instanceof SqlInjection::Source }
24+
25+
predicate isSink(DataFlow::Node node) { node instanceof SqlInjection::Sink }
26+
27+
predicate isBarrier(DataFlow::Node barrier) { barrier instanceof SqlInjection::Barrier }
28+
}
29+
30+
module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;
31+
32+
from SqlInjectionFlow::PathNode sourceNode, SqlInjectionFlow::PathNode sinkNode
33+
where SqlInjectionFlow::flowPath(sourceNode, sinkNode)
34+
select sinkNode.getNode(), sourceNode, sinkNode, "This query depends on a $@.",
35+
sourceNode.getNode(), "user-provided value"

‎rust/ql/src/queries/summary/LinesOfCode.ql‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @name Total lines of Rust code in the database
3+
* @description The total number of lines of Rust code across all files, including any libraries and auto-generated files that the extractor sees. This is a useful metric of the size of a database. For all files that were seen during the build, this query counts the lines of code, excluding whitespace or comments.
4+
* @kind metric
5+
* @id rust/summary/lines-of-code
6+
* @tags summary
7+
* lines-of-code
8+
* telemetry
9+
*/
10+
11+
import rust
12+
import Stats
13+
14+
select getLinesOfCode()

‎rust/ql/src/queries/summary/LinesOfUserCode.ql‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @name Total lines of user written Rust code in the database
3+
* @description The total number of lines of Rust code from the source code directory. This query counts the lines of code, excluding whitespace or comments.
4+
* @kind metric
5+
* @id rust/summary/lines-of-user-code
6+
* @tags summary
7+
* lines-of-code
8+
* debug
9+
*/
10+
11+
import rust
12+
import Stats
13+
14+
select getLinesOfUserCode()

‎rust/ql/src/queries/summary/SummaryStats.ql‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
/**
2+
* @name Summary Statistics
3+
* @description A table of summary statistics about a database.
4+
* @kind metric
5+
* @id rust/summary/summary-statistics
6+
* @tags summary
7+
*/
8+
9+
import rust
10+
import codeql.rust.Concepts
11+
import codeql.rust.Diagnostics
12+
import Stats
13+
14+
from string key, int value
15+
where
16+
key = "Elements extracted" and value = count(Element e | not e instanceof Unextracted)
17+
or
18+
key = "Elements unextracted" and value = count(Unextracted e)
19+
or
20+
key = "Extraction errors" and value = count(ExtractionError e)
21+
or
22+
key = "Extraction warnings" and value = count(ExtractionWarning w)
23+
or
24+
key = "Files extracted - total" and value = count(ExtractedFile f | exists(f.getRelativePath()))
25+
or
26+
key = "Files extracted - with errors" and
27+
value =
28+
count(ExtractedFile f |
29+
exists(f.getRelativePath()) and not f instanceof SuccessfullyExtractedFile
30+
)
31+
or
32+
key = "Files extracted - without errors" and
33+
value = count(SuccessfullyExtractedFile f | exists(f.getRelativePath()))
34+
or
35+
key = "Lines of code extracted" and value = getLinesOfCode()
36+
or
37+
key = "Lines of user code extracted" and value = getLinesOfUserCode()
38+
or
39+
key = "Inconsistencies - AST" and value = getTotalAstInconsistencies()
40+
or
41+
key = "Inconsistencies - CFG" and value = getTotalCfgInconsistencies()
42+
or
43+
key = "Inconsistencies - data flow" and value = getTotalDataFlowInconsistencies()
44+
or
45+
key = "Macro calls - total" and value = count(MacroCall mc)
46+
or
47+
key = "Macro calls - resolved" and value = count(MacroCall mc | mc.hasExpanded())
48+
or
49+
key = "Macro calls - unresolved" and value = count(MacroCall mc | not mc.hasExpanded())
50+
or
51+
key = "Taint sources - total" and value = count(ThreatModelSource s)
52+
or
53+
key = "Taint sources - active" and value = count(ActiveThreatModelSource s)
54+
select key, value order by key

‎rust/ql/src/queries/summary/TaintSources.ql‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/**
2+
* @name Taint Sources
3+
* @description List all sources of untrusted input that have been idenfitied
4+
* in the database.
5+
* @kind problem
6+
* @problem.severity info
7+
* @id rust/summary/taint-sources
8+
* @tags summary
9+
*/
10+
11+
import rust
12+
import codeql.rust.Concepts
13+
14+
from ThreatModelSource s, string defaultString
15+
where
16+
if s instanceof ActiveThreatModelSource then defaultString = " (DEFAULT)" else defaultString = ""
17+
select s,
18+
"Flow source '" + s.getSourceType() + "' of type " + s.getThreatModel() + defaultString + "."

0 commit comments

Comments
 (0)