Rust: Fallback crate resolution

Author: hvitved

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -188,6 +188,7 @@ abstract class ItemNode extends Locatable {
     crateDefEdge(this, name, result, kind)
     or
     crateDependencyEdge(this, name, result) and
+    not declares(this, TTypeNamespace(), name) and
     kind.isInternal()
     or
     externCrateEdge(this, name, result) and
@@ -1153,6 +1154,11 @@ private class BuiltinSourceFile extends SourceFileItemNode {
 pragma[nomagic]
 private predicate crateDependencyEdge(SourceFileItemNode file, string name, CrateItemNode dep) {
   exists(CrateItemNode c | dep = c.(Crate).getDependency(name) | file = c.getASourceFile())
+  or
+  // All files _should_ belong to a crate, but for those where we cannot identify the crate,
+  // we give access to all crates as a fallback.
+  not file = any(Crate c).getASourceFile() and
+  name = dep.getName()
 }
 
 private predicate useTreeDeclares(UseTree tree, string name) {
@@ -1482,20 +1488,13 @@ private predicate externCrateEdge(ExternCrateItemNode ec, string name, CrateItem
 
 pragma[nomagic]
 private predicate preludeItem(string name, ItemNode i) {
-  exists(Crate stdOrCore, string stdOrCoreName |
-    stdOrCore.getName() = stdOrCoreName and
-    stdOrCoreName = ["std", "core"]
-  |
-    name = stdOrCoreName and
-    i = stdOrCore
-    or
-    exists(ModuleLikeNode mod, ModuleItemNode prelude, ModuleItemNode rust |
-      mod = stdOrCore.getSourceFile() and
-      prelude = mod.getASuccessor("prelude") and
-      rust = prelude.getASuccessor(["rust_2015", "rust_2018", "rust_2021", "rust_2024"]) and
-      i = rust.getASuccessor(name) and
-      not name = ["super", "self"]
-    )
+  exists(Crate stdOrCore, ModuleLikeNode mod, ModuleItemNode prelude, ModuleItemNode rust |
+    stdOrCore.getName() = ["std", "core"] and
+    mod = stdOrCore.getSourceFile() and
+    prelude = mod.getASuccessor("prelude") and
+    rust = prelude.getASuccessor(["rust_2015", "rust_2018", "rust_2021", "rust_2024"]) and
+    i = rust.getASuccessor(name) and
+    not name = ["super", "self"]
   )
 }