Rust: Implement basic type inference in QL

Author: hvitved

rust/ql/.generated.list

@@ -239,9 +239,8 @@ final class RecordExprCfgNode extends Nodes::RecordExprCfgNode {
   pragma[nomagic]
   ExprCfgNode getFieldExpr(string field) {
     exists(RecordExprField ref |
-      ref = node.getRecordExprFieldList().getAField() and
-      any(ChildMapping mapping).hasCfgChild(node, ref.getExpr(), this, result) and
-      field = ref.getFieldName()
+      ref = node.getFieldExpr(field) and
+      any(ChildMapping mapping).hasCfgChild(node, ref.getExpr(), this, result)
     )
   }
 }

rust/ql/.gitattributes

@@ -847,7 +847,7 @@ class TupleFieldContent extends FieldContent, TTupleFieldContent {
 
   predicate isStructField(Struct s, int pos) { field.isStructField(s, pos) }
 
-  override FieldExprCfgNode getAnAccess() { none() } // TODO
+  override FieldExprCfgNode getAnAccess() { field = result.getFieldExpr().getTupleField() }
 
   final override string toString() {
     exists(Variant v, int pos, string vname |
@@ -878,7 +878,7 @@ class RecordFieldContent extends FieldContent, TRecordFieldContent {
 
   predicate isStructField(Struct s, string name) { field.isStructField(s, name) }
 
-  override FieldExprCfgNode getAnAccess() { none() } // TODO
+  override FieldExprCfgNode getAnAccess() { field = result.getFieldExpr().getRecordField() }
 
   final override string toString() {
     exists(Variant v, string name, string vname |

rust/ql/lib/codeql/rust/controlflow/CfgNodes.qll

@@ -12,11 +12,7 @@ private import codeql.rust.elements.Resolvable
  * be referenced directly.
  */
 module Impl {
-  private import codeql.rust.elements.internal.CallableImpl::Impl
-  private import codeql.rust.elements.internal.MethodCallExprImpl::Impl
-  private import codeql.rust.elements.internal.CallExprImpl::Impl
-  private import codeql.rust.elements.internal.PathExprImpl::Impl
-  private import codeql.rust.elements.internal.PathResolution
+  private import rust
 
   pragma[nomagic]
   Resolvable getCallResolvable(CallExprBase call) {
@@ -30,14 +26,7 @@ module Impl {
    * A function or method call expression. See `CallExpr` and `MethodCallExpr` for further details.
    */
   class CallExprBase extends Generated::CallExprBase {
-    /**
-     * Gets the target callable of this call, if a unique such target can
-     * be statically resolved.
-     */
-    Callable getStaticTarget() {
-      getCallResolvable(this).resolvesAsItem(result)
-      or
-      result = resolvePath(this.(CallExpr).getFunction().(PathExpr).getPath())
-    }
+    /** Gets the static target of this call, if any. */
+    Callable getStaticTarget() { none() }
   }
 }

rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll

@@ -15,6 +15,14 @@ module Impl {
   private import rust
   private import PathResolution as PathResolution
 
+  pragma[nomagic]
+  Path getFunctionPath(CallExpr ce) { result = ce.getFunction().(PathExpr).getPath() }
+
+  pragma[nomagic]
+  PathResolution::ItemNode getResolvedFunction(CallExpr ce) {
+    result = PathResolution::resolvePath(getFunctionPath(ce))
+  }
+
   // the following QLdoc is generated: if you need to edit it, do it in the schema file
   /**
    * A function call expression. For example:
@@ -28,9 +36,17 @@ module Impl {
   class CallExpr extends Generated::CallExpr {
     override string toString() { result = this.getFunction().toAbbreviatedString() + "(...)" }
 
+    override Callable getStaticTarget() { result = getResolvedFunction(this) }
+
+    /** Gets the struct that this call resolves to, if any. */
+    Struct getStruct() { result = getResolvedFunction(this) }
+
+    /** Gets the variant that this call resolves to, if any. */
+    Variant getVariant() { result = getResolvedFunction(this) }
+
     pragma[nomagic]
-    private PathResolution::ItemNode getResolvedFunction(int pos) {
-      result = PathResolution::resolvePath(this.getFunction().(PathExpr).getPath()) and
+    private PathResolution::ItemNode getResolvedFunctionAndPos(int pos) {
+      result = getResolvedFunction(this) and
       exists(this.getArgList().getArg(pos))
     }
 
@@ -42,7 +58,7 @@ module Impl {
      */
     pragma[nomagic]
     TupleField getTupleField(int pos) {
-      exists(PathResolution::ItemNode i | i = this.getResolvedFunction(pos) |
+      exists(PathResolution::ItemNode i | i = this.getResolvedFunctionAndPos(pos) |
         result.isStructField(i, pos) or
         result.isVariantField(i, pos)
       )

rust/ql/lib/codeql/rust/elements/internal/CallExprBaseImpl.qll

@@ -11,6 +11,9 @@ private import codeql.rust.elements.internal.generated.FieldExpr
  * be referenced directly.
  */
 module Impl {
+  private import rust
+  private import TypeInference as TypeInference
+
   // the following QLdoc is generated: if you need to edit it, do it in the schema file
   /**
    * A field access expression. For example:
@@ -26,5 +29,11 @@ module Impl {
         if abbr = "..." then result = "... ." + name else result = abbr + "." + name
       )
     }
+
+    /** Gets the record field that this access references, if any. */
+    RecordField getRecordField() { result = TypeInference::resolveRecordFieldExpr(this) }
+
+    /** Gets the tuple field that this access references, if any. */
+    TupleField getTupleField() { result = TypeInference::resolveTupleFieldExpr(this) }
   }
 }

rust/ql/lib/codeql/rust/elements/internal/CallExprImpl.qll

@@ -11,6 +11,8 @@ private import codeql.rust.elements.internal.generated.GenericArgList
  * be referenced directly.
  */
 module Impl {
+  private import rust
+
   // the following QLdoc is generated: if you need to edit it, do it in the schema file
   /**
    * The base class for generic arguments.
@@ -22,5 +24,18 @@ module Impl {
     override string toString() { result = this.toAbbreviatedString() }
 
     override string toAbbreviatedString() { result = "<...>" }
+
+    /** Gets the `i`th type argument of this list. */
+    TypeRepr getTypeArgument(int i) {
+      result =
+        rank[i + 1](TypeRepr res, int j |
+          res = this.getGenericArg(j).(TypeArg).getTypeRepr()
+        |
+          res order by j
+        )
+    }
+
+    /** Gets a type argument of this list. */
+    TypeRepr getATypeArgument() { result = this.getTypeArgument(_) }
   }
 }

rust/ql/lib/codeql/rust/elements/internal/FieldExprImpl.qll

@@ -1,4 +1,3 @@
-// generated by codegen, remove this comment if you wish to edit this file
 /**
  * This module provides a hand-modifiable wrapper around the generated class `GenericParamList`.
  *
@@ -12,11 +11,26 @@ private import codeql.rust.elements.internal.generated.GenericParamList
  * be referenced directly.
  */
 module Impl {
+  private import rust
+
+  // the following QLdoc is generated: if you need to edit it, do it in the schema file
   /**
    * A GenericParamList. For example:
    * ```rust
    * todo!()
    * ```
    */
-  class GenericParamList extends Generated::GenericParamList { }
+  class GenericParamList extends Generated::GenericParamList {
+    override string toString() { result = this.toAbbreviatedString() }
+
+    override string toAbbreviatedString() { result = "<...>" }
+
+    /** Gets the `i`th type parameter of this list. */
+    TypeParam getTypeParam(int i) {
+      result = rank[i + 1](TypeParam res, int j | res = this.getGenericParam(j) | res order by j)
+    }
+
+    /** Gets a type parameter of this list. */
+    TypeParam getATypeParam() { result = this.getTypeParam(_) }
+  }
 }

rust/ql/lib/codeql/rust/elements/internal/GenericArgListImpl.qll

@@ -4,13 +4,18 @@
  * INTERNAL: Do not use.
  */
 
+private import rust
 private import codeql.rust.elements.internal.generated.MethodCallExpr
+private import codeql.rust.elements.internal.PathResolution
+private import codeql.rust.elements.internal.TypeInference
 
 /**
  * INTERNAL: This module contains the customizable definition of `MethodCallExpr` and should not
  * be referenced directly.
  */
 module Impl {
+  private predicate isImplFunction(Function f) { f = any(ImplItemNode impl).getAnAssocItem() }
+
   // the following QLdoc is generated: if you need to edit it, do it in the schema file
   /**
    * A method call expression. For example:
@@ -20,6 +25,23 @@ module Impl {
    * ```
    */
   class MethodCallExpr extends Generated::MethodCallExpr {
+    override Function getStaticTarget() {
+      result = resolveMethodCallExpr(this) and
+      (
+        // prioritize `impl` methods first
+        isImplFunction(result)
+        or
+        not isImplFunction(resolveMethodCallExpr(this)) and
+        (
+          // then trait methods with default implementations
+          result.hasBody()
+          or
+          // and finally trait methods without default implementations
+          not resolveMethodCallExpr(this).hasBody()
+        )
+      )
+    }
+
     override string toString() {
       exists(string base, string separator |
         base = this.getReceiver().toAbbreviatedString() and