wip4

Author: hvitved

rust/ql/examples/snippets/simple_constant_password.ql

@@ -30,7 +30,7 @@ module ConstantPasswordConfig implements DataFlow::ConfigSig {
 
   predicate isSink(DataFlow::Node node) {
     // `node` is an argument whose corresponding parameter name matches the pattern "pass%"
-    exists(CallExpr call, Function target, int argIndex, Variable v |
+    exists(Call call, Function target, int argIndex, Variable v |
       call.getStaticTarget() = target and
       v.getParameter() = target.getParam(argIndex) and
       v.getText().matches("pass%") and

rust/ql/examples/snippets/simple_sql_injection.ql

@@ -23,7 +23,7 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
 
   predicate isSink(DataFlow::Node node) {
     // `node` is the first argument of a call to `sqlx_core::query::query`
-    exists(CallExpr call |
+    exists(Call call |
       call.getStaticTarget().getCanonicalPath() = "sqlx_core::query::query" and
       call.getArgument(0) = node.asExpr()
     )

rust/ql/lib/codeql/rust/elements/internal/CallImpl.qll

@@ -7,7 +7,12 @@ module Impl {
   /**
    * A call.
    *
-   * Either a `CallExpr`, a `MethodCallExpr`, an `Operation`, or an `IndexExpr`.
+   * Either
+   *
+   * - a `ParenArgsExpr` that targets a function,
+   * - a `MethodCallExpr`,
+   * - an `Operation` that targets an overloadable opeator, or
+   * - an `IndexExpr`.
    */
   abstract class Call extends ExprImpl::Expr {
     /** Gets the `i`th positional argument of this call, if any. */

rust/ql/lib/codeql/rust/security/AccessAfterLifetimeExtensions.qll

@@ -100,9 +100,9 @@ module AccessAfterLifetime {
     a = b.getEnclosingBlock*()
     or
     // propagate through function calls
-    exists(CallExpr ce |
-      mayEncloseOnStack(a, ce.getEnclosingBlock()) and
-      ce.getStaticTarget() = b.getEnclosingCallable()
+    exists(Call call |
+      mayEncloseOnStack(a, call.getEnclosingBlock()) and
+      call.getStaticTarget() = b.getEnclosingCallable()
     )
   }
 

rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll

@@ -103,7 +103,7 @@ module HardcodedCryptographicValue {
    */
   private class GetRandomBarrier extends Barrier {
     GetRandomBarrier() {
-      exists(CallExpr call |
+      exists(Call call |
         call.getStaticTarget().getCanonicalPath() = ["getrandom::fill", "getrandom::getrandom"] and
         this.asExpr().getParentNode*() = call.getArgument(0)
       )

rust/ql/lib/codeql/rust/security/InsecureCookieExtensions.qll

@@ -80,7 +80,7 @@ module InsecureCookie {
    * as `false`.
    */
   predicate cookieSetNode(DataFlow::Node node, string attrib, boolean value) {
-    exists(FlowSummaryNode summaryNode, CallExpr call, int arg, DataFlow::Node argNode |
+    exists(FlowSummaryNode summaryNode, Call call, int arg, DataFlow::Node argNode |
       // decode the models-as-data `OptionalBarrier`
       cookieOptionalBarrier(summaryNode, attrib, arg) and
       // find a call and arg referenced by this optional barrier

rust/ql/lib/codeql/rust/security/regex/RegexInjectionExtensions.qll

@@ -53,7 +53,7 @@ module RegexInjection {
    */
   private class NewSink extends Sink {
     NewSink() {
-      exists(CallExpr call, Function f |
+      exists(Call call, Function f |
         call.getStaticTarget() = f and
         f.getCanonicalPath() = "<regex::regex::string::Regex>::new" and
         this.asExpr() = call.getArgument(0) and

rust/ql/src/queries/security/CWE-696/BadCtorInitialization.ql

@@ -30,7 +30,7 @@ class CtorAttr extends Attr {
 /**
  * A call into the Rust standard library, that is, a sink for this query.
  */
-class StdCall extends CallExpr {
+class StdCall extends Call {
   StdCall() { this.getStaticTarget().getCanonicalPath().matches(["std::%", "<std::%"]) }
 }
 
@@ -54,11 +54,11 @@ predicate edgesFwd(PathElement pred, PathElement succ) {
   or
   // [forwards reachable] callable -> enclosed call
   edgesFwd(_, pred) and
-  pred = succ.(CallExpr).getEnclosingCallable()
+  pred = succ.(Call).getEnclosingCallable()
   or
   // [forwards reachable] call -> target callable
   edgesFwd(_, pred) and
-  pred.(CallExpr).getStaticTarget() = succ
+  pred.(Call).getStaticTarget() = succ
 }
 
 /**

rust/ql/test/library-tests/type-inference/type-inference.ql

@@ -32,7 +32,7 @@ module ResolveTest implements TestSig {
       source.fromSource() and
       not source.isFromMacroExpansion()
     |
-      target = source.(CallExpr).getStaticTarget() and
+      target = source.(Call).getStaticTarget() and
       functionHasValue(target, value) and
       // `isFromMacroExpansion` does not always work
       not target.(Function).getName().getText() = ["panic_fmt", "_print", "format", "must_use"] and