wip

hvitved · hvitved · commit 8f8076230436 · 2025-09-17T17:00:11.000+02:00
diff --git a/rust/ql/lib/codeql/rust/internal/TypeMention.qll b/rust/ql/lib/codeql/rust/internal/TypeMention.qll
@@ -113,7 +113,8 @@ class NonAliasPathTypeMention extends PathTypeMention {
 
   NonAliasPathTypeMention() {
     resolved = [resolvePath(this), resolvePath(this).(Variant).getEnum().(TypeItemNode)] and
-    not exists(resolved.(TypeAlias).getTypeRepr())
+    not exists(resolved.(TypeAlias).getTypeRepr()) and
+    not this = any(ImplItemNode i).getASelfPath() // handled by `ImplSelfMention`
   }
 
   TypeItemNode getResolved() { result = resolved }
@@ -145,23 +146,6 @@ class NonAliasPathTypeMention extends PathTypeMention {
   private TypeMention getPositionalTypeArgument0(int i) {
     result = this.getSegment().getGenericArgList().getTypeArg(i)
     or
-    // `Self` paths inside `impl` blocks have implicit type arguments that are
-    // the type parameters of the `impl` block. For example, in
-    //
-    // ```rust
-    // impl<T> Foo<T> {
-    //   fn m(self) -> Self {
-    //     self
-    //   }
-    // }
-    // ```
-    //
-    // the `Self` return type is shorthand for `Foo<T>`.
-    exists(ImplItemNode node |
-      this = node.getASelfPath() and
-      result = node.(ImplItemNode).getSelfPath().getSegment().getGenericArgList().getTypeArg(i)
-    )
-    or
     // `Option::<i32>::Some` is valid in addition to `Option::Some::<i32>`
     resolvePath(this) instanceof Variant and
     result = this.getQualifier().getSegment().getGenericArgList().getTypeArg(i)
@@ -260,6 +244,14 @@ class NonAliasPathTypeMention extends PathTypeMention {
   }
 }
 
+class ImplSelfMention extends PathTypeMention {
+  private ImplItemNode impl;
+
+  ImplSelfMention() { this = impl.getASelfPath() }
+
+  override Type resolveTypeAt(TypePath typePath) { result = resolveImplSelfType(impl, typePath) }
+}
+
 class PathTypeReprMention extends TypeMention, PathTypeRepr {
   private PathTypeMention path;
 
diff --git a/rust/ql/test/library-tests/dataflow/sources/test_futures_io.rs b/rust/ql/test/library-tests/dataflow/sources/test_futures_io.rs
@@ -42,11 +42,11 @@ async fn test_futures_rustls_futures_io() -> io::Result<()> {
     {
         // using the `AsyncReadExt::read` extension method (higher-level)
         let mut buffer1 = [0u8; 64];
-        let bytes_read1 = futures::io::AsyncReadExt::read(&mut reader, &mut buffer1).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
+        let bytes_read1 = futures::io::AsyncReadExt::read(&mut reader, &mut buffer1).await?;
         sink(&buffer1[..bytes_read1]); // $ hasTaintFlow=url
 
         let mut buffer2 = [0u8; 64];
-        let bytes_read2 = reader.read(&mut buffer2).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
+        let bytes_read2 = reader.read(&mut buffer2).await?;
 
         sink(&buffer2[..bytes_read2]); // $ hasTaintFlow=url
     }
@@ -80,7 +80,7 @@ async fn test_futures_rustls_futures_io() -> io::Result<()> {
 
     {
         // using the `AsyncBufReadExt::fill_buf` extension method (higher-level)
-        let buffer = reader2.fill_buf().await?; // we cannot resolve the `fill_buf` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
+        let buffer = reader2.fill_buf().await?;
         sink(buffer); // $ hasTaintFlow=url
     }
 
@@ -100,11 +100,11 @@ async fn test_futures_rustls_futures_io() -> io::Result<()> {
     {
         // using the `AsyncReadExt::read` extension method (higher-level)
         let mut buffer1 = [0u8; 64];
-        let bytes_read1 = futures::io::AsyncReadExt::read(&mut reader2, &mut buffer1).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
+        let bytes_read1 = futures::io::AsyncReadExt::read(&mut reader2, &mut buffer1).await?;
         sink(&buffer1[..bytes_read1]); // $ hasTaintFlow=url
 
         let mut buffer2 = [0u8; 64];
-        let bytes_read2 = reader2.read(&mut buffer2).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
+        let bytes_read2 = reader2.read(&mut buffer2).await?;
         sink(&buffer2[..bytes_read2]); // $ hasTaintFlow=url
     }
 
@@ -122,34 +122,34 @@ async fn test_futures_rustls_futures_io() -> io::Result<()> {
 
     {
         // using the `AsyncBufReadExt::fill_buf` extension method (higher-level)
-        let buffer = reader2.fill_buf().await?; // we cannot resolve the `fill_buf` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
+        let buffer = reader2.fill_buf().await?;
         sink(buffer); // $ hasTaintFlow=url
     }
 
     {
         // using the `AsyncBufReadExt::read_until` extension method
         let mut line = Vec::new();
-        let _bytes_read = reader2.read_until(b'\n', &mut line).await?; // we cannot resolve the `read_until` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
+        let _bytes_read = reader2.read_until(b'\n', &mut line).await?;
         sink(&line); // $ hasTaintFlow=url
     }
 
     {
         // using the `AsyncBufReadExt::read_line` extension method
         let mut line = String::new();
-        let _bytes_read = reader2.read_line(&mut line).await?; // we cannot resolve the `read_line` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
+        let _bytes_read = reader2.read_line(&mut line).await?;
         sink(&line); // $ hasTaintFlow=url
     }
 
     {
         // using the `AsyncBufReadExt::read_to_end` extension method
         let mut buffer = Vec::with_capacity(1024);
-        let _bytes_read = reader2.read_to_end(&mut buffer).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
+        let _bytes_read = reader2.read_to_end(&mut buffer).await?;
         sink(&buffer); // $ hasTaintFlow=url
     }
 
     {
         // using the `AsyncBufReadExt::lines` extension method
-        let mut lines_stream = reader2.lines(); // we cannot resolve the `lines` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
+        let mut lines_stream = reader2.lines();
         sink(lines_stream.next().await.unwrap()); // $ MISSING: hasTaintFlow=url
         while let Some(line) = lines_stream.next().await {
             sink(line.unwrap()); // $ MISSING: hasTaintFlow

Original file line number	Diff line number	Diff line change
`@@ -42,11 +42,11 @@ async fn test_futures_rustls_futures_io() -> io::Result<()> {`
`42`	`42`	`{`
`43`	`43`	// using the `AsyncReadExt::read` extension method (higher-level)
`44`	`44`	`let mut buffer1 = [0u8; 64];`
`45`		- let bytes_read1 = futures::io::AsyncReadExt::read(&mut reader, &mut buffer1).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
	`45`	`+ let bytes_read1 = futures::io::AsyncReadExt::read(&mut reader, &mut buffer1).await?;`
`46`	`46`	`sink(&buffer1[..bytes_read1]); // $ hasTaintFlow=url`
`47`	`47`
`48`	`48`	`let mut buffer2 = [0u8; 64];`
`49`		- let bytes_read2 = reader.read(&mut buffer2).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
	`49`	`+ let bytes_read2 = reader.read(&mut buffer2).await?;`
`50`	`50`
`51`	`51`	`sink(&buffer2[..bytes_read2]); // $ hasTaintFlow=url`
`52`	`52`	`}`
`@@ -80,7 +80,7 @@ async fn test_futures_rustls_futures_io() -> io::Result<()> {`
`80`	`80`
`81`	`81`	`{`
`82`	`82`	// using the `AsyncBufReadExt::fill_buf` extension method (higher-level)
`83`		- let buffer = reader2.fill_buf().await?; // we cannot resolve the `fill_buf` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
	`83`	`+ let buffer = reader2.fill_buf().await?;`
`84`	`84`	`sink(buffer); // $ hasTaintFlow=url`
`85`	`85`	`}`
`86`	`86`
`@@ -100,11 +100,11 @@ async fn test_futures_rustls_futures_io() -> io::Result<()> {`
`100`	`100`	`{`
`101`	`101`	// using the `AsyncReadExt::read` extension method (higher-level)
`102`	`102`	`let mut buffer1 = [0u8; 64];`
`103`		- let bytes_read1 = futures::io::AsyncReadExt::read(&mut reader2, &mut buffer1).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
	`103`	`+ let bytes_read1 = futures::io::AsyncReadExt::read(&mut reader2, &mut buffer1).await?;`
`104`	`104`	`sink(&buffer1[..bytes_read1]); // $ hasTaintFlow=url`
`105`	`105`
`106`	`106`	`let mut buffer2 = [0u8; 64];`
`107`		- let bytes_read2 = reader2.read(&mut buffer2).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
	`107`	`+ let bytes_read2 = reader2.read(&mut buffer2).await?;`
`108`	`108`	`sink(&buffer2[..bytes_read2]); // $ hasTaintFlow=url`
`109`	`109`	`}`
`110`	`110`
`@@ -122,34 +122,34 @@ async fn test_futures_rustls_futures_io() -> io::Result<()> {`
`122`	`122`
`123`	`123`	`{`
`124`	`124`	// using the `AsyncBufReadExt::fill_buf` extension method (higher-level)
`125`		- let buffer = reader2.fill_buf().await?; // we cannot resolve the `fill_buf` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
	`125`	`+ let buffer = reader2.fill_buf().await?;`
`126`	`126`	`sink(buffer); // $ hasTaintFlow=url`
`127`	`127`	`}`
`128`	`128`
`129`	`129`	`{`
`130`	`130`	// using the `AsyncBufReadExt::read_until` extension method
`131`	`131`	`let mut line = Vec::new();`
`132`		- let _bytes_read = reader2.read_until(b'\n', &mut line).await?; // we cannot resolve the `read_until` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
	`132`	`+ let _bytes_read = reader2.read_until(b'\n', &mut line).await?;`
`133`	`133`	`sink(&line); // $ hasTaintFlow=url`
`134`	`134`	`}`
`135`	`135`
`136`	`136`	`{`
`137`	`137`	// using the `AsyncBufReadExt::read_line` extension method
`138`	`138`	`let mut line = String::new();`
`139`		- let _bytes_read = reader2.read_line(&mut line).await?; // we cannot resolve the `read_line` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
	`139`	`+ let _bytes_read = reader2.read_line(&mut line).await?;`
`140`	`140`	`sink(&line); // $ hasTaintFlow=url`
`141`	`141`	`}`
`142`	`142`
`143`	`143`	`{`
`144`	`144`	// using the `AsyncBufReadExt::read_to_end` extension method
`145`	`145`	`let mut buffer = Vec::with_capacity(1024);`
`146`		- let _bytes_read = reader2.read_to_end(&mut buffer).await?; // we cannot resolve the `read` call, which comes from `impl<R: AsyncRead + ?Sized> AsyncReadExt for R {}` in `async_read_ext.rs`
	`146`	`+ let _bytes_read = reader2.read_to_end(&mut buffer).await?;`
`147`	`147`	`sink(&buffer); // $ hasTaintFlow=url`
`148`	`148`	`}`
`149`	`149`
`150`	`150`	`{`
`151`	`151`	// using the `AsyncBufReadExt::lines` extension method
`152`		- let mut lines_stream = reader2.lines(); // we cannot resolve the `lines` call, which comes from `impl<R: AsyncBufRead + ?Sized> AsyncBufReadExt for R {}` in `async_buf_read_ext.rs`
	`152`	`+ let mut lines_stream = reader2.lines();`
`153`	`153`	`sink(lines_stream.next().await.unwrap()); // $ MISSING: hasTaintFlow=url`
`154`	`154`	`while let Some(line) = lines_stream.next().await {`
`155`	`155`	`sink(line.unwrap()); // $ MISSING: hasTaintFlow`