Rust: Type inference and path resolution for builtins

Author: hvitved

rust/ql/lib/codeql/rust/elements/LiteralExprExt.qll

@@ -0,0 +1,15 @@
+/** Provides sub classes of literal expressions. */
+
+private import internal.LiteralExprImpl
+
+final class CharLiteralExpr = Impl::CharLiteralExpr;
+
+final class StringLiteralExpr = Impl::StringLiteralExpr;
+
+final class NumberLiteralExpr = Impl::NumberLiteralExpr;
+
+final class IntegerLiteralExpr = Impl::IntegerLiteralExpr;
+
+final class FloatLiteralExpr = Impl::FloatLiteralExpr;
+
+final class BooleanLiteralExpr = Impl::BooleanLiteralExpr;

rust/ql/lib/codeql/rust/elements/internal/LiteralExprImpl.qll

@@ -42,4 +42,189 @@ module Impl {
       )
     }
   }
+
+  /**
+   * A [character literal][1]. For example:
+   *
+   * ```rust
+   * 'x';
+   * ```
+   *
+   * [1]: https://doc.rust-lang.org/reference/tokens.html#character-literals
+   */
+  class CharLiteralExpr extends LiteralExpr {
+    CharLiteralExpr() {
+      // todo: proper implementation
+      this.getTextValue().regexpMatch("'.*'")
+    }
+
+    override string getAPrimaryQlClass() { result = "CharLiteralExpr" }
+  }
+
+  /**
+   * A [string literal][1]. For example:
+   *
+   * ```rust
+   * "Hello, world!";
+   * ```
+   *
+   * [1]: https://doc.rust-lang.org/reference/tokens.html#string-literals
+   */
+  class StringLiteralExpr extends LiteralExpr {
+    StringLiteralExpr() {
+      // todo: proper implementation
+      this.getTextValue().regexpMatch("\".*\"")
+    }
+
+    override string getAPrimaryQlClass() { result = "StringLiteralExpr" }
+  }
+
+  /**
+   * A number literal.
+   */
+  abstract class NumberLiteralExpr extends LiteralExpr { }
+
+  // https://doc.rust-lang.org/reference/tokens.html#integer-literals
+  private module IntegerLiteralRegexs {
+    bindingset[s]
+    string paren(string s) { result = "(" + s + ")" }
+
+    string integerLiteral() {
+      result =
+        paren(paren(decLiteral()) + "|" + paren(binLiteral()) + "|" + paren(octLiteral()) + "|" +
+              paren(hexLiteral())) + paren(suffix()) + "?"
+    }
+
+    private string suffix() { result = "u8|i8|u16|i16|u32|i32|u64|i64|u128|i128|usize|isize" }
+
+    string decLiteral() { result = decDigit() + "(" + decDigit() + "|_)*" }
+
+    string binLiteral() {
+      result = "0b(" + binDigit() + "|_)*" + binDigit() + "(" + binDigit() + "|_)*"
+    }
+
+    string octLiteral() {
+      result = "0o(" + octDigit() + "|_)*" + octDigit() + "(" + octDigit() + "|_)*"
+    }
+
+    string hexLiteral() {
+      result = "0x(" + hexDigit() + "|_)*" + hexDigit() + "(" + hexDigit() + "|_)*"
+    }
+
+    string decDigit() { result = "[0-9]" }
+
+    string binDigit() { result = "[01]" }
+
+    string octDigit() { result = "[0-7]" }
+
+    string hexDigit() { result = "[0-9a-fA-F]" }
+  }
+
+  /**
+   * An [integer literal][1]. For example:
+   *
+   * ```rust
+   * 42;
+   * ```
+   *
+   * [1]: https://doc.rust-lang.org/reference/tokens.html#integer-literals
+   */
+  class IntegerLiteralExpr extends NumberLiteralExpr {
+    IntegerLiteralExpr() { this.getTextValue().regexpMatch(IntegerLiteralRegexs::integerLiteral()) }
+
+    /**
+     * Get the suffix of this integer literal, if any.
+     *
+     * For example, `42u8` has the suffix `u8`.
+     */
+    string getSuffix() {
+      exists(string s, string reg, int last |
+        s = this.getTextValue() and
+        reg = IntegerLiteralRegexs::integerLiteral() and
+        last = strictcount(reg.indexOf("(")) and
+        result = s.regexpCapture(reg, last)
+      )
+    }
+
+    override string getAPrimaryQlClass() { result = "IntegerLiteralExpr" }
+  }
+
+  // https://doc.rust-lang.org/reference/tokens.html#floating-point-literals
+  private module FloatLiteralRegexs {
+    private import IntegerLiteralRegexs
+
+    string floatLiteral() {
+      result =
+        paren(decLiteral() + "\\.") + "|" + paren(floatLiteralSuffix1()) + "|" +
+          paren(floatLiteralSuffix2())
+    }
+
+    string floatLiteralSuffix1() {
+      result = decLiteral() + "\\." + decLiteral() + paren(suffix()) + "?"
+    }
+
+    string floatLiteralSuffix2() {
+      result =
+        decLiteral() + paren("\\." + decLiteral()) + "?" + paren(exponent()) + paren(suffix()) + "?"
+    }
+
+    string integerSuffixLiteral() {
+      result =
+        paren(paren(decLiteral()) + "|" + paren(binLiteral()) + "|" + paren(octLiteral()) + "|" +
+              paren(hexLiteral())) + paren(suffix())
+    }
+
+    private string suffix() { result = "f32|f64" }
+
+    string exponent() {
+      result = "(e|E)(\\+|-)?(" + decDigit() + "|_)*" + decDigit() + "(" + decDigit() + "|_)*"
+    }
+  }
+
+  /**
+   * A [floating-point literal][1]. For example:
+   *
+   * ```rust
+   * 42.0;
+   * ```
+   *
+   * [1]: https://doc.rust-lang.org/reference/tokens.html#floating-point-literals
+   */
+  class FloatLiteralExpr extends NumberLiteralExpr {
+    FloatLiteralExpr() {
+      this.getTextValue()
+          .regexpMatch([
+              FloatLiteralRegexs::floatLiteral(), FloatLiteralRegexs::integerSuffixLiteral()
+            ])
+    }
+
+    /**
+     * Get the suffix of this floating-point literal, if any.
+     *
+     * For example, `42.0f32` has the suffix `f32`.
+     */
+    string getSuffix() {
+      exists(string s, string reg, int last |
+        s = this.getTextValue() and
+        reg =
+          [
+            FloatLiteralRegexs::floatLiteralSuffix1(), FloatLiteralRegexs::floatLiteralSuffix2(),
+            FloatLiteralRegexs::integerSuffixLiteral()
+          ] and
+        last = strictcount(reg.indexOf("(")) and
+        result = s.regexpCapture(reg, last)
+      )
+    }
+
+    override string getAPrimaryQlClass() { result = "FloatLiteralExpr" }
+  }
+
+  /**
+   * A Boolean literal. Either `true` or `false`.
+   */
+  class BooleanLiteralExpr extends LiteralExpr {
+    BooleanLiteralExpr() { this.getTextValue().regexpMatch("true|false") }
+
+    override string getAPrimaryQlClass() { result = "BooleanLiteralExpr" }
+  }
 }

rust/ql/lib/codeql/rust/frameworks/stdlib/Bultins.qll

@@ -0,0 +1,109 @@
+/**
+ * Provides classes for builtins.
+ */
+
+private import rust
+
+/** The folder containing builtins. */
+class BuiltinsFolder extends Folder {
+  BuiltinsFolder() {
+    this.getBaseName() = "builtins" and
+    this.getParentContainer().getBaseName() = "tools"
+  }
+}
+
+private class BuiltinsTypesFile extends File {
+  BuiltinsTypesFile() {
+    this.getBaseName() = "types.rs" and
+    this.getParentContainer() instanceof BuiltinsFolder
+  }
+}
+
+private class BuiltinType extends Struct {
+  BuiltinType() { this.getFile() instanceof BuiltinsTypesFile }
+}
+
+/** The builtin `bool` type. */
+class Bool extends BuiltinType {
+  Bool() { this.getName().getText() = "bool" }
+}
+
+/** The builtin `char` type. */
+class Char extends BuiltinType {
+  Char() { this.getName().getText() = "char" }
+}
+
+/** The builtin `str` type. */
+class Str extends BuiltinType {
+  Str() { this.getName().getText() = "str" }
+}
+
+/** The builtin `i8` type. */
+class I8 extends BuiltinType {
+  I8() { this.getName().getText() = "i8" }
+}
+
+/** The builtin `i16` type. */
+class I16 extends BuiltinType {
+  I16() { this.getName().getText() = "i16" }
+}
+
+/** The builtin `i32` type. */
+class I32 extends BuiltinType {
+  I32() { this.getName().getText() = "i32" }
+}
+
+/** The builtin `i64` type. */
+class I64 extends BuiltinType {
+  I64() { this.getName().getText() = "i64" }
+}
+
+/** The builtin `i128` type. */
+class I128 extends BuiltinType {
+  I128() { this.getName().getText() = "i128" }
+}
+
+/** The builtin `u8` type. */
+class U8 extends BuiltinType {
+  U8() { this.getName().getText() = "u8" }
+}
+
+/** The builtin `u16` type. */
+class U16 extends BuiltinType {
+  U16() { this.getName().getText() = "u16" }
+}
+
+/** The builtin `u32` type. */
+class U32 extends BuiltinType {
+  U32() { this.getName().getText() = "u32" }
+}
+
+/** The builtin `u64` type. */
+class U64 extends BuiltinType {
+  U64() { this.getName().getText() = "u64" }
+}
+
+/** The builtin `u128` type. */
+class U128 extends BuiltinType {
+  U128() { this.getName().getText() = "u128" }
+}
+
+/** The builtin `usize` type. */
+class USize extends BuiltinType {
+  USize() { this.getName().getText() = "usize" }
+}
+
+/** The builtin `isize` type. */
+class ISize extends BuiltinType {
+  ISize() { this.getName().getText() = "isize" }
+}
+
+/** The builtin `f32` type. */
+class F32 extends BuiltinType {
+  F32() { this.getName().getText() = "f32" }
+}
+
+/** The builtin `f64` type. */
+class F64 extends BuiltinType {
+  F64() { this.getName().getText() = "f64" }
+}

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -180,6 +180,8 @@ abstract class ItemNode extends Locatable {
     or
     preludeEdge(this, name, result) and not declares(this, _, name)
     or
+    builtinEdge(this, name, result)
+    or
     name = "super" and
     if this instanceof Module or this instanceof SourceFile
     then result = this.getImmediateParentModule()
@@ -1184,6 +1186,21 @@ private predicate preludeEdge(SourceFile f, string name, ItemNode i) {
   )
 }
 
+private import codeql.rust.frameworks.stdlib.Bultins as Builtins
+
+pragma[nomagic]
+private predicate builtinEdge(ModuleLikeNode m, string name, ItemNode i) {
+  (
+    m instanceof SourceFile
+    or
+    m = any(CrateItemNode c).getModuleNode()
+  ) and
+  exists(SourceFileItemNode builtins |
+    builtins.getFile().getParentContainer() instanceof Builtins::BuiltinsFolder and
+    i = builtins.getASuccessorRec(name)
+  )
+}
+
 /** Provides predicates for debugging the path resolution implementation. */
 private module Debug {
   private Locatable getRelevantLocatable() {