Rust: Base DataFlow::Node on AST instead of CFG

Author: hvitved

rust/ql/lib/codeql/rust/Concepts.qll

@@ -4,14 +4,13 @@
  * provide concrete subclasses.
  */
 
+private import rust
 private import codeql.rust.dataflow.DataFlow
 private import codeql.rust.dataflow.internal.DataFlowImpl
 private import codeql.Locations
 private import codeql.threatmodels.ThreatModels
 private import codeql.rust.Frameworks
 private import codeql.rust.dataflow.FlowSource
-private import codeql.rust.controlflow.ControlFlowGraph as Cfg
-private import codeql.rust.controlflow.CfgNodes as CfgNodes
 private import codeql.concepts.ConceptsShared
 
 private module ConceptsShared = ConceptsMake<Location, RustDataFlow>;
@@ -345,16 +344,16 @@ module Path {
     SafeAccessCheck() { this = DataFlow::BarrierGuard<safeAccessCheck/3>::getABarrierNode() }
   }
 
-  private predicate safeAccessCheck(CfgNodes::AstCfgNode g, Cfg::CfgNode node, boolean branch) {
-    g.(SafeAccessCheck::Range).checks(node, branch)
+  private predicate safeAccessCheck(AstNode g, Expr e, boolean branch) {
+    g.(SafeAccessCheck::Range).checks(e, branch)
   }
 
   /** Provides a class for modeling new path safety checks. */
   module SafeAccessCheck {
     /** A data-flow node that checks that a path is safe to access in some way, for example by having a controlled prefix. */
-    abstract class Range extends CfgNodes::AstCfgNode {
-      /** Holds if this guard validates `node` upon evaluating to `branch`. */
-      abstract predicate checks(Cfg::CfgNode node, boolean branch);
+    abstract class Range extends AstNode {
+      /** Holds if this guard validates `e` upon evaluating to `branch`. */
+      abstract predicate checks(Expr e, boolean branch);
     }
   }
 }

rust/ql/lib/codeql/rust/dataflow/DataFlow.qll

@@ -8,8 +8,6 @@ private import codeql.dataflow.DataFlow
 private import internal.DataFlowImpl as DataFlowImpl
 private import internal.Node as Node
 private import internal.Content as Content
-private import codeql.rust.controlflow.ControlFlowGraph as Cfg
-private import codeql.rust.controlflow.CfgNodes as CfgNodes
 
 /**
  * Provides classes for performing local (intra-procedural) and global
@@ -68,7 +66,7 @@ module DataFlow {
    * For example, the guard `g` might be a call `isSafe(x)` and the expression `e`
    * the argument `x`.
    */
-  signature predicate guardChecksSig(CfgNodes::AstCfgNode g, Cfg::CfgNode e, boolean branch);
+  signature predicate guardChecksSig(AstNode g, Expr e, boolean branch);
 
   /**
    * Provides a set of barrier nodes for a guard that validates an expression.

rust/ql/lib/codeql/rust/dataflow/Ssa.qll

@@ -9,7 +9,6 @@ module Ssa {
   private import rust
   private import codeql.rust.controlflow.BasicBlocks
   private import codeql.rust.controlflow.ControlFlowGraph
-  private import codeql.rust.controlflow.CfgNodes
   private import codeql.rust.controlflow.internal.ControlFlowGraphImpl as CfgImpl
   private import internal.SsaImpl as SsaImpl
 
@@ -51,7 +50,7 @@ module Ssa {
      * }
      * ```
      */
-    final CfgNode getARead() { result = SsaImpl::getARead(this) }
+    final Expr getARead() { result = SsaImpl::getARead(this) }
 
     /**
      * Gets a first control flow node that reads the value of this SSA definition.
@@ -80,7 +79,7 @@ module Ssa {
      * }
      * ```
      */
-    final CfgNode getAFirstRead() { SsaImpl::firstRead(this, result) }
+    final Expr getAFirstRead() { SsaImpl::firstRead(this, result) }
 
     /**
      * Holds if `read1` and `read2` are adjacent reads of this SSA definition.
@@ -108,7 +107,7 @@ module Ssa {
      * }
      * ```
      */
-    final predicate hasAdjacentReads(CfgNode read1, CfgNode read2) {
+    final predicate hasAdjacentReads(Expr read1, Expr read2) {
       SsaImpl::adjacentReadPair(this, read1, read2)
     }
 
@@ -168,28 +167,28 @@ module Ssa {
    * ```
    */
   class WriteDefinition extends Definition, SsaImpl::WriteDefinition {
-    private CfgNode write;
+    private AstNode write;
 
     WriteDefinition() {
-      exists(BasicBlock bb, int i, Variable v, CfgNode n |
+      exists(BasicBlock bb, int i, Variable v, AstNode n |
         this.definesAt(v, bb, i) and
-        SsaImpl::variableWriteActual(bb, i, v, n)
+        SsaImpl::variableWriteActual(bb, i, v, n.getACfgNode())
       |
-        write.(VariableAccessCfgNode).getAccess().getVariable() = v and
+        write.(VariableAccess).getVariable() = v and
         (
-          write = n.(AssignmentExprCfgNode).getAWriteAccess()
+          write = n.(AssignmentExpr).getAWriteAccess()
           or
-          write = n.(CompoundAssignmentExprCfgNode).getLhs()
+          write = n.(CompoundAssignmentExpr).getLhs()
         )
         or
-        not n instanceof AssignmentExprCfgNode and
-        not n instanceof CompoundAssignmentExprCfgNode and
+        not n instanceof AssignmentExpr and
+        not n instanceof CompoundAssignmentExpr and
         write = n
       )
     }
 
     /** Gets the underlying write access. */
-    final CfgNode getWriteAccess() { result = write }
+    final AstNode getWriteAccess() { result = write }
 
     /**
      * Holds if this SSA definition assigns `value` to the underlying
@@ -199,19 +198,19 @@ module Ssa {
      * `let` statement, `let x = value`. Note that patterns on the lhs. are
      * currently not supported.
      */
-    predicate assigns(ExprCfgNode value) {
-      exists(AssignmentExprCfgNode ae |
+    predicate assigns(Expr value) {
+      exists(AssignmentExpr ae |
         ae.getLhs() = write and
         ae.getRhs() = value
       )
       or
-      exists(IdentPatCfgNode pat | pat.getName() = write |
-        exists(LetStmtCfgNode ls |
+      exists(IdentPat pat | pat.getName() = write |
+        exists(LetStmt ls |
           pat = ls.getPat() and
           ls.getInitializer() = value
         )
         or
-        exists(LetExprCfgNode le |
+        exists(LetExpr le |
           pat = le.getPat() and
           le.getScrutinee() = value
         )

rust/ql/lib/codeql/rust/dataflow/internal/Content.qll

@@ -3,7 +3,6 @@
  */
 
 private import rust
-private import codeql.rust.controlflow.CfgNodes
 private import codeql.rust.frameworks.stdlib.Builtins
 private import DataFlowImpl
 
@@ -22,7 +21,7 @@ abstract class Content extends TContent {
 abstract class FieldContent extends Content {
   /** Gets an access to this field. */
   pragma[nomagic]
-  abstract FieldExprCfgNode getAnAccess();
+  abstract FieldExpr getAnAccess();
 }
 
 /** A tuple field belonging to either a variant or a struct. */
@@ -41,7 +40,7 @@ class TupleFieldContent extends FieldContent, TTupleFieldContent {
   /** Holds if this field belongs to a struct. */
   predicate isStructField(Struct s, int pos) { field.isStructField(s, pos) }
 
-  override FieldExprCfgNode getAnAccess() { field = result.getFieldExpr().getTupleField() }
+  override FieldExpr getAnAccess() { field = result.getTupleField() }
 
   final override string toString() {
     exists(Variant v, int pos, string vname |
@@ -74,7 +73,7 @@ class StructFieldContent extends FieldContent, TStructFieldContent {
   /** Holds if this field belongs to a struct. */
   predicate isStructField(Struct s, string name) { field.isStructField(s, name) }
 
-  override FieldExprCfgNode getAnAccess() { field = result.getFieldExpr().getStructField() }
+  override FieldExpr getAnAccess() { field = result.getStructField() }
 
   final override string toString() {
     exists(Variant v, string name, string vname |
@@ -153,7 +152,7 @@ final class TuplePositionContent extends FieldContent, TTuplePositionContent {
   /** Gets the index of this tuple position. */
   int getPosition() { result = pos }
 
-  override FieldExprCfgNode getAnAccess() {
+  override FieldExpr getAnAccess() {
     // TODO: limit to tuple types
     result.getIdentifier().getText().toInt() = pos
   }

rust/ql/lib/codeql/rust/dataflow/internal/DataFlowConsistency.qll

@@ -29,17 +29,9 @@ private module Input implements InputSig<Location, RustDataFlow> {
   }
 
   predicate missingLocationExclude(RustDataFlow::Node n) { not exists(n.asExpr().getLocation()) }
-
-  predicate multipleArgumentCallExclude(Node::ArgumentNode arg, DataFlowCall call) {
-    // An argument such as `x` in `if !x { ... }` has two successors (and hence
-    // two calls); one for each Boolean outcome of `x`.
-    exists(CfgNodes::ExprCfgNode n |
-      arg.isArgumentOf(call, _) and
-      n = call.asCallCfgNode() and
-      arg.asExpr().getASuccessor(any(ConditionalSuccessor c)).getASuccessor*() = n and
-      n.getASplit() instanceof ConditionalCompletionSplitting::ConditionalCompletionSplit
-    )
-  }
+  // predicate uniqueEnclosingCallableExclude(RustDataFlow::Node n) {
+  //   n.asExpr().getParentNode*() instanceof ConstArg
+  // }
 }
 
 import MakeConsistency<Location, RustDataFlow, RustTaintTracking, Input>