René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Rust] weird behavior in dataflow when trying to select a specific node","articleBody":"(Apologies for the vague issue title, but I just didn't know any better title...)\n\n**Description of the issue**\n\n(I don't _think_ this is related to https://github.com/github/codeql/issues/19982 but linking anyway)\n\nWhen running the \"working base version\" (see below for code), I successfully find flow from the argument `data` to `remaining_len - 4 - tail_len..remaining_len - 4` just as I wanted:\n\n\u003cimg width=\"1873\" height=\"486\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/76a7451f-5271-4b21-9643-b43faf491b07\" /\u003e\n\n#### `source` change\n\nThe problem appears when I change the source predicate to this more general version (all results of `read_region` are assumed to return user-controlled data) where I've manually verified that the result of `read_region` is used in a call with a `data` argument:\n```ql\npredicate isSource(DataFlow::Node node) {\n    exists(CallExpr ce, Function f | f.getName().getText() = \"read_region\" |\n      node.asExpr().getExpr() = ce and ce.getStaticTarget() = f\n    ) and\n    node.getLocation().getStartLine() = 727\n  }\n```\n\nThis results in ZERO alerts/#select/nodes/subpaths/edges.\n\n#### any() filtering in `sink`\n\nSo obviously, I tried to debug it and for that I changed the sink predicate to this:\n```ql\n  predicate isSink(DataFlow::Node node) {\n    any()\n  }\n```\n(Yes, yes, there is partial flow and stuff, but good old `any` works pretty well in simple cases :P)\nThis is exactly the flow I'm trying to find.\n\u003cimg width=\"1844\" height=\"392\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/50ca0760-6a47-4c8c-8228-a880180db317\" /\u003e\n\n#### RangeExpr filtering in `sink`\n\nWhat happens if I change my sink predicate to check whether the node is a `RangeExpr` using `node.asExpr().getExpr() instanceof RangeExpr`? That should work, because earlier, `sink.getNode().asExpr().getExpr().getAPrimaryQlClass()` returned `RangeExpr`, right?\n\nWell, we get ZERO alerts/.../... again.\n\n#### getStartLine filterting in `sink`\n\nOkay, then let's change the predicate to `node.getLocation().getStartLine() = 20` because that should also work as we verified that the node of interested has its start line indeed in line 20.\n\nThis **does** give us four results:\nbut our `RangeExpr` is nowhere to be found!?\n\n\u003cimg width=\"916\" height=\"854\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/7effa8c5-2335-4cfd-8f7b-cf9e17aca92f\" /\u003e\n\n### two `sections.rs` files\nThere exist two `sections.rs` files:\n`cosmwasm-db-cf413c5ad6a58a87e0be894584f01506f3b2e0af^/src.zip/home/sg/dev/cosmwasm/packages/std/src/sections.rs`\nand\n`cosmwasm-db-cf413c5ad6a58a87e0be894584f01506f3b2e0af^/src.zip/home/sg/dev/cosmwasm/packages/vm/src/sections.rs`\nbut I don't really see how that could be relevant, but highlighting anyway.\n\n### Summary\nI'm not sure whether I did something dumb or whether I've run into a bug :)\n\n**Reproduction steps**\n```\ngit clone https://github.com/CosmWasm/cosmwasm.git\ngit checkout cf413c5ad6a58a87e0be894584f01506f3b2e0af^\ncodeql database create --language=rust \"cosmwasm-db-cf413c5ad6a58a87e0be894584f01506f3b2e0af^\" --overwrite\n```\n\n\"Working base version\"\n```ql\n/**\n * @name Empty block\n * @kind path-problem\n * @problem.severity warning\n * @id rust/example/empty-block\n */\n\nimport rust\nimport codeql.rust.dataflow.DataFlow\nimport codeql.rust.dataflow.TaintTracking\n\nmodule MyConfig implements DataFlow::ConfigSig {\n  predicate isSource(DataFlow::Node node) {\n    node.asPat().getPat().(IdentPat).getName().getText() = \"data\"\n  }\n\n  predicate isSink(DataFlow::Node node) {\n    exists(IndexExpr ie | node.asExpr().getExpr().(RangeExpr) = ie.getIndex())\n  }\n\n  predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {\n    // If the start/end of a range is tainted, then the whole range is tainted.\n    exists(RangeExpr re |\n      pred.asExpr().getExpr() = [re.getStart(), re.getEnd()] and\n      succ.asExpr().getExpr() = re\n    )\n    or\n    // Propagate taint from `tainted` to the result of `tainted?`\n    exists(TryExpr te |\n      te.getExpr() = pred.asExpr().getExpr() and\n      te = succ.asExpr().getExpr()\n    )\n    or\n    // Propagate taint from `tainted` to `[tainted]`\n    exists(ArrayListExpr ale |\n      ale.getAnExpr() = pred.asExpr().getExpr() and\n      ale = succ.asExpr().getExpr()\n    )\n    or\n    // Propagate taint from `tainted` to `from_be_bytes(tainted)`\n    exists(CallExpr ce, Function f |\n      pred.asExpr().getExpr() = ce.getArg(0) and\n      succ.asExpr().getExpr() = ce and\n      ce.getStaticTarget() = f and\n      f.getName().getText() = \"from_be_bytes\"\n    )\n    or\n    // Propagate taint from `tainted` to `tainted as usize`\n    exists(CastExpr ce |\n      pred.asExpr().getExpr() = ce.getExpr() and\n      succ.asExpr().getExpr() = ce and\n      pred.getLocation().getFile().getAbsolutePath().matches(\"%section%\")\n    )\n  }\n}\n\nmodule Flow = TaintTracking::Global\u003cMyConfig\u003e;\n\nimport Flow::PathGraph\n\nfrom Flow::PathNode source, Flow::PathNode sink\nwhere Flow::flowPath(source, sink)\nselect sink, source, sink,\n  \"PrimaryQlClass: \" + sink.getNode().asExpr().getExpr().getAPrimaryQlClass() + \"start: \" +\n    sink.getLocation().getStartLine()\n```\n\n**Files**\n\n[cosmwasm-db-cf413c5ad6a58a87e0be894584f01506f3b2e0af^.zip](https://github.com/intrigus-lgtm/file-dump/releases/tag/cosmwasm-db-cf413c5ad6a58a87e0be894584f01506f3b2e0af.zip)","author":{"url":"https://github.com/intrigus-lgtm","@type":"Person","name":"intrigus-lgtm"},"datePublished":"2025-07-05T15:01:31.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/19983/codeql/issues/19983"}