wip

Author: hvitved

rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll

@@ -277,6 +277,11 @@ module LocalFlow {
       nodeTo.(Node::SsaNode).getDefinitionExt().(Ssa::WriteDefinition).getControlFlowNode()
     or
     SsaFlow::localFlowStep(_, nodeFrom, nodeTo, _)
+    or
+    exists(AssignmentExprCfgNode a |
+      a.getRhs() = nodeFrom.getCfgNode() and
+      a.getLhs() = nodeTo.getCfgNode()
+    )
   }
 }
 

rust/ql/lib/codeql/rust/dataflow/internal/SsaImpl.qll

@@ -474,14 +474,14 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
 
   /** Holds if SSA definition `def` assigns `value` to the underlying variable. */
   predicate ssaDefAssigns(WriteDefinition def, Expr value) {
-    exists(BasicBlock bb, int i | def.definesAt(_, bb, i) and value = bb.getNode(i))
+    none() // handled in `DataFlowImpl.qll` instead
   }
 
   class Parameter = CfgNodes::ParamCfgNode;
 
   /** Holds if SSA definition `def` initializes parameter `p` at function entry. */
   predicate ssaDefInitializesParam(WriteDefinition def, Parameter p) {
-    exists(BasicBlock bb, int i | bb.getNode(i) = p and def.definesAt(_, bb, i))
+    none() // handled in `DataFlowImpl.qll` instead
   }
 
   class Guard extends CfgNodes::AstCfgNode {

rust/ql/test/library-tests/dataflow/local/DataFlowStep.expected

@@ -46,6 +46,7 @@
 | main.rs:51:17:51:17 | 1 | main.rs:51:9:51:13 | i |
 | main.rs:53:5:53:5 | [SSA] i | main.rs:54:10:54:10 | i |
 | main.rs:53:5:53:5 | i | main.rs:53:5:53:5 | [SSA] i |
+| main.rs:53:9:53:17 | CallExpr | main.rs:53:5:53:5 | i |
 | main.rs:61:9:61:9 | [SSA] i | main.rs:62:11:62:11 | i |
 | main.rs:61:9:61:9 | i | main.rs:61:9:61:9 | [SSA] i |
 | main.rs:61:13:61:31 | CallExpr | main.rs:61:9:61:9 | i |

rust/ql/test/library-tests/dataflow/local/inline-flow.expected

@@ -4,6 +4,7 @@ edges
 | main.rs:24:13:24:21 | CallExpr : unit | main.rs:27:10:27:10 | c | provenance |  |
 | main.rs:31:13:31:21 | CallExpr : unit | main.rs:36:10:36:10 | b | provenance |  |
 | main.rs:45:15:45:23 | CallExpr : unit | main.rs:47:10:47:10 | b | provenance |  |
+| main.rs:53:9:53:17 | CallExpr : unit | main.rs:54:10:54:10 | i | provenance |  |
 nodes
 | main.rs:15:10:15:18 | CallExpr | semmle.label | CallExpr |
 | main.rs:19:13:19:21 | CallExpr : unit | semmle.label | CallExpr : unit |
@@ -14,6 +15,8 @@ nodes
 | main.rs:36:10:36:10 | b | semmle.label | b |
 | main.rs:45:15:45:23 | CallExpr : unit | semmle.label | CallExpr : unit |
 | main.rs:47:10:47:10 | b | semmle.label | b |
+| main.rs:53:9:53:17 | CallExpr : unit | semmle.label | CallExpr : unit |
+| main.rs:54:10:54:10 | i | semmle.label | i |
 subpaths
 testFailures
 #select
@@ -22,3 +25,4 @@ testFailures
 | main.rs:27:10:27:10 | c | main.rs:24:13:24:21 | CallExpr : unit | main.rs:27:10:27:10 | c | $@ | main.rs:24:13:24:21 | CallExpr : unit | CallExpr : unit |
 | main.rs:36:10:36:10 | b | main.rs:31:13:31:21 | CallExpr : unit | main.rs:36:10:36:10 | b | $@ | main.rs:31:13:31:21 | CallExpr : unit | CallExpr : unit |
 | main.rs:47:10:47:10 | b | main.rs:45:15:45:23 | CallExpr : unit | main.rs:47:10:47:10 | b | $@ | main.rs:45:15:45:23 | CallExpr : unit | CallExpr : unit |
+| main.rs:54:10:54:10 | i | main.rs:53:9:53:17 | CallExpr : unit | main.rs:54:10:54:10 | i | $@ | main.rs:53:9:53:17 | CallExpr : unit | CallExpr : unit |

rust/ql/test/library-tests/dataflow/local/main.rs

@@ -51,7 +51,7 @@ fn assignment() {
     let mut i = 1;
     sink(i);
     i = source(2);
-    sink(i); // $ MISSING: hasValueFlow=2
+    sink(i); // $ hasValueFlow=2
 }
 
 // -----------------------------------------------------------------------------