Skip to content

FlowSummaryImpl: Embed AST nodes in source/sink summary nodes for better locations#22145

Draft
hvitved wants to merge 12 commits into
github:mainfrom
hvitved:flow-summary-source-sink-locations
Draft

FlowSummaryImpl: Embed AST nodes in source/sink summary nodes for better locations#22145
hvitved wants to merge 12 commits into
github:mainfrom
hvitved:flow-summary-source-sink-locations

Conversation

@hvitved

@hvitved hvitved commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

This PR addresses the issues identified by @MathiasVP on #22113.

Note that the issue (and fix) only applies to Rust, which is the only language that currently supports source/sink definitions with non-empty access paths.

The underlying issue was that we were unable to map source/sink summary nodes to the locations represented by the output/input models-as-data specs, so for example a source with an Argument[0] spec would be unable to be mapped to the corresponding argument, and we instead resorted to using the location of the call as the source location. The second issue identified by @MathiasVP, defining a source that is supposed to be a parameter, was not even supported in Rust.

The fix to both issues is to embed language-specific AST nodes into the source/sink summary nodes, and then use the locations of those as the locations of the source/sink nodes. This PR also shows how to add support for parameter sources.

Commit-by-commit review is strongly encouraged, and the second commit should be reviewed ignoring whitespaces.

Comment thread rust/ql/lib/codeql/rust/dataflow/internal/FlowSummaryImpl.qll Fixed
Comment thread shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll Fixed
@hvitved hvitved force-pushed the flow-summary-source-sink-locations branch from b24377a to d2107ce Compare July 9, 2026 11:51
@github-actions github-actions Bot added Rust Pull requests that update Rust code DataFlow Library labels Jul 9, 2026
@hvitved hvitved force-pushed the flow-summary-source-sink-locations branch from d397063 to 6d8870b Compare July 9, 2026 13:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants