Rust: Source/sink/barrier MaD trait models apply to implementations

Author: hvitved

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -17,10 +17,6 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
   class SummarizedCallableBase = Function;
 
-  class SourceBase = Function;
-
-  class SinkBase = Function;
-
   class FlowSummaryCallBase = CallInstruction;
 
   predicate callableFromSource(SummarizedCallableBase c) { exists(c.getBlock()) }
@@ -232,7 +228,7 @@ private module Input2 implements Impl::Private::InputSig2 {
 
   bindingset[source, sc]
   SourceSinkReportingElement getASourceReportingElement(
-    Input::SourceBase source, Impl::Private::SummaryComponent sc
+    Input::SummarizedCallableBase source, Impl::Private::SummaryComponent sc
   ) {
     exists(Call call | call.getTarget() = source |
       sc = Impl::Private::SummaryComponent::return(_) and
@@ -312,7 +308,7 @@ private module Input2 implements Impl::Private::InputSig2 {
 
   bindingset[sink, sc]
   SourceSinkReportingElement getASinkReportingElement(
-    Input::SinkBase sink, Impl::Private::SummaryComponent sc
+    Input::SummarizedCallableBase sink, Impl::Private::SummaryComponent sc
   ) {
     exists(Call call, ArgumentPosition pos |
       call.getTarget() = sink and
@@ -525,9 +521,10 @@ private class SourceModelFunction extends Public::SourceElement instanceof Funct
   }
 
   override predicate isSource(
-    string output, string kind, Public::Provenance provenance, string model
+    string output, string kind, Public::Provenance provenance, boolean isExact, string model
   ) {
-    sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, model)
+    sourceModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, model) and
+    isExact = true
   }
 }
 
@@ -544,7 +541,10 @@ private class SinkModelFunction extends Public::SinkElement instanceof Function
     this = interpretElement(namespace, type, subtypes, name, signature, ext)
   }
 
-  override predicate isSink(string input, string kind, Public::Provenance provenance, string model) {
-    sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance, model)
+  override predicate isSink(
+    string input, string kind, Public::Provenance provenance, boolean isExact, string model
+  ) {
+    sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance, model) and
+    isExact = true
   }
 }

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

@@ -30,14 +30,10 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CsharpDataFlow>
     )
   }
 
-  class SourceBase extends Void {
+  class FlowSummaryCallBase extends Void {
     Location getLocation() { none() }
   }
 
-  class SinkBase = SourceBase;
-
-  class FlowSummaryCallBase = SourceBase;
-
   DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {
     result.asSummarizedCallable() = c
   }

go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll

@@ -27,14 +27,10 @@ module Input implements InputSig<Location, DataFlowImplSpecific::GoDataFlow> {
 
   class SummarizedCallableBase = Callable;
 
-  class SourceBase extends Void {
+  class FlowSummaryCallBase extends Void {
     Location getLocation() { none() }
   }
 
-  class SinkBase = SourceBase;
-
-  class FlowSummaryCallBase = SourceBase;
-
   predicate callableFromSource(SummarizedCallableBase c) { exists(c.getFuncDef()) }
 
   DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {

java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll

@@ -37,14 +37,10 @@ module Input implements InputSig<Location, DataFlowImplSpecific::JavaDataFlow> {
     sc.asCallable() = any(Callable c | c.fromSource() and not c.isStub())
   }
 
-  class SourceBase extends Void {
+  class FlowSummaryCallBase extends Void {
     Location getLocation() { none() }
   }
 
-  class SinkBase = SourceBase;
-
-  class FlowSummaryCallBase = SourceBase;
-
   DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {
     result.asSummarizedCallable() = c
   }

javascript/ql/lib/semmle/javascript/dataflow/internal/FlowSummaryPrivate.qll

@@ -24,14 +24,10 @@ class SummarizedCallableBase extends string {
   Location getLocation() { none() }
 }
 
-class SourceBase extends Void {
+class FlowSummaryCallBase extends Void {
   Location getLocation() { none() }
 }
 
-class SinkBase = SourceBase;
-
-class FlowSummaryCallBase = SourceBase;
-
 DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {
   result.asLibraryCallable() = c
 }

python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll

@@ -21,14 +21,10 @@ module Input implements InputSig<Location, DataFlowImplSpecific::PythonDataFlow>
     Location getLocation() { none() }
   }
 
-  class SourceBase extends Void {
+  class FlowSummaryCallBase extends Void {
     Location getLocation() { none() }
   }
 
-  class SinkBase = SourceBase;
-
-  class FlowSummaryCallBase = SourceBase;
-
   predicate callableFromSource(SummarizedCallableBase c) { none() }
 
   DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {

ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll

@@ -20,14 +20,10 @@ module Input implements InputSig<Location, DataFlowImplSpecific::RubyDataFlow> {
     Location getLocation() { result instanceof EmptyLocation }
   }
 
-  class SourceBase extends Void {
+  class FlowSummaryCallBase extends Void {
     Location getLocation() { none() }
   }
 
-  class SinkBase = SourceBase;
-
-  class FlowSummaryCallBase = SourceBase;
-
   predicate callableFromSource(SummarizedCallableBase c) { none() }
 
   DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {

rust/ql/lib/codeql/rust/dataflow/FlowBarrier.qll

@@ -44,9 +44,9 @@ module FlowBarrier {
     Range() { any() }
 
     override predicate isBarrier(
-      string output, string kind, Impl::Public::Provenance provenance, string model
+      string output, string kind, Impl::Public::Provenance provenance, boolean isExact, string model
     ) {
-      this.isBarrier(output, kind) and provenance = "manual" and model = ""
+      this.isBarrier(output, kind) and provenance = "manual" and isExact = true and model = ""
     }
 
     /**
@@ -67,9 +67,13 @@ module FlowBarrierGuard {
     Range() { any() }
 
     override predicate isBarrierGuard(
-      string input, string branch, string kind, Impl::Public::Provenance provenance, string model
+      string input, string branch, string kind, Impl::Public::Provenance provenance,
+      boolean isExact, string model
     ) {
-      this.isBarrierGuard(input, branch, kind) and provenance = "manual" and model = ""
+      this.isBarrierGuard(input, branch, kind) and
+      provenance = "manual" and
+      isExact = true and
+      model = ""
     }
 
     /**

rust/ql/lib/codeql/rust/dataflow/FlowSink.qll

@@ -36,9 +36,9 @@ module FlowSink {
     Range() { any() }
 
     override predicate isSink(
-      string input, string kind, Impl::Public::Provenance provenance, string model
+      string input, string kind, Impl::Public::Provenance provenance, boolean isExact, string model
     ) {
-      this.isSink(input, kind) and provenance = "manual" and model = ""
+      this.isSink(input, kind) and provenance = "manual" and isExact = true and model = ""
     }
 
     /**

rust/ql/lib/codeql/rust/dataflow/FlowSource.qll

@@ -42,9 +42,9 @@ module FlowSource {
     Range() { any() }
 
     override predicate isSource(
-      string output, string kind, Impl::Public::Provenance provenance, string model
+      string output, string kind, Impl::Public::Provenance provenance, boolean isExact, string model
     ) {
-      this.isSource(output, kind) and provenance = "manual" and model = ""
+      this.isSource(output, kind) and provenance = "manual" and isExact = true and model = ""
     }
 
     /**