take2

Author: hvitved

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -208,7 +208,6 @@ abstract class ItemNode extends Locatable {
     crateDefEdge(this, name, result, kind)
     or
     crateDependencyEdge(this, name, result) and
-    not declaresDirectly(this, TTypeNamespace(), name) and
     kind.isInternal()
     or
     externCrateEdge(this, name, result) and
@@ -1233,17 +1232,23 @@ private class BuiltinSourceFile extends SourceFileItemNode {
   BuiltinSourceFile() { this.getFile().getParentContainer() instanceof Builtins::BuiltinsFolder }
 }
 
+pragma[nomagic]
+private predicate crateDependency(SourceFileItemNode file, string name, CrateItemNode dep) {
+  exists(CrateItemNode c | dep = c.(Crate).getDependency(name) | file = c.getASourceFile())
+}
+
 /**
  * Holds if `file` depends on crate `dep` named `name`.
  */
 pragma[nomagic]
 private predicate crateDependencyEdge(SourceFileItemNode file, string name, CrateItemNode dep) {
-  exists(CrateItemNode c | dep = c.(Crate).getDependency(name) | file = c.getASourceFile())
+  crateDependency(file, name, dep)
   or
-  // All files _should_ belong to a crate, but for those where we cannot identify the crate,
-  // we give access to all crates as a fallback.
-  not file = any(Crate c).getASourceFile() and
-  name = dep.getName()
+  // As a fallback, give all files access to crates that do not conflict with known dependencies
+  // and declarations.
+  name = dep.getName() and
+  not declaresDirectly(file, TTypeNamespace(), name) and
+  not crateDependency(file, name, _)
 }
 
 private predicate useTreeDeclares(UseTree tree, string name) {