René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Rust: modules declared in a file brought in by `include!` are not resolved (no canonical paths, unresolved calls), e.g. in `windows-sys` and `windows`","articleBody":"**Description of the issue**\n\nWhen a crate's `lib.rs` brings in part of its module tree with `include!(\"tree/mod.rs\")`, and that file declares `pub mod inner;`, CodeQL looks for `inner` next to `lib.rs` instead of next to `tree/mod.rs`, where rustc finds it. As a result, nothing in `inner` gets a canonical path, calls into it have no `getStaticTarget()`, and models-as-data rows for its functions never apply.\n\nThe public `windows-sys` and `windows` crates are built this way (`lib.rs` contains `include!(\"Windows/mod.rs\")`), so Windows API calls made through them are never resolved:\n\n- `windows-sys` 0.61.2: 0 of the 10,661 functions under `src/Windows/Win32` have a canonical path.\n- `windows` 0.62.2: 777 of 130,113 do (with `codeql/rust-all` 0.2.25); `CreateFileW` is not among them.\n- Calls to `CreateFileW`, `ReadFile`, `RegQueryValueExW`, `CreateProcessW`, `ShellExecuteW` and `recv` through `windows-sys`, and to the first four through `windows`, are unresolved.\n\nSeen with CodeQL 2.27.2 (`codeql/rust-all` 0.2.23) and 2.27.4 (`codeql/rust-all` 0.2.25), Rust 1.99.0, Windows x64. Setting `extract_dependencies_as_source=true` does not change it.\n\n**Reproduction**\n\nA two-crate workspace. `toy-include` brings in module `inner` through `include!`; module `direct`, declared normally, has the same contents and serves as a control.\n\n`Cargo.toml`\n```toml\n[workspace]\nmembers = [\"toy-include\", \"toy-user\"]\nresolver = \"2\"\n```\n\n`toy-include/Cargo.toml`\n```toml\n[package]\nname = \"toy-include\"\nversion = \"0.1.0\"\nedition = \"2021\"\n```\n\n`toy-include/src/lib.rs`\n```rust\nmacro_rules! declare {\n    ($name:ident) => {\n        extern \"C\" {\n            pub fn $name() -> u32;\n        }\n    };\n}\n\ninclude!(\"tree/mod.rs\");\n\npub mod direct;\n```\n\n`toy-include/src/tree/mod.rs`\n```rust\npub mod inner;\n```\n\n`toy-include/src/tree/inner/mod.rs`\n```rust\npub fn hidden() -> u32 {\n    1\n}\n\ndeclare!(hidden_extern);\n```\n\n`toy-include/src/direct.rs`\n```rust\npub fn visible() -> u32 {\n    2\n}\n\ndeclare!(visible_extern);\n```\n\n`toy-user/Cargo.toml`\n```toml\n[package]\nname = \"toy-user\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n[dependencies]\ntoy-include = { path = \"../toy-include\" }\n```\n\n`toy-user/src/main.rs`\n```rust\nfn main() {\n    let a = toy_include::inner::hidden();\n    let b = toy_include::direct::visible();\n    let c = unsafe { toy_include::inner::hidden_extern() };\n    let d = unsafe { toy_include::direct::visible_extern() };\n    println!(\"{}\", a + b + c + d);\n}\n```\n\nThe workspace builds with `cargo check`. Query (`query/qlpack.yml` depends on `codeql/rust-all: \"*\"`):\n\n`query/include-paths.ql`\n```ql\nimport rust\n\n/** Each function of the `toy-include` crate, with its canonical path (none if CodeQL gives none). */\nquery predicate functions(string file, string name, string canonicalPath) {\n  exists(Function f |\n    f.getFile().getAbsolutePath().matches(\"%toy-include%\") and\n    file = f.getFile().getAbsolutePath().regexpCapture(\".*toy-include[/\\\\\\\\]src[/\\\\\\\\](.*)\", 1) and\n    name = f.getName().getText() and\n    if exists(f.getCanonicalPath()) then canonicalPath = f.getCanonicalPath() else canonicalPath = \"(none)\"\n  )\n}\n\n/** Each call in the program, with the function it resolves to (none if unresolved). */\nquery predicate calls(int line, string call, string target) {\n  exists(Call c | c.getFile().getBaseName() = \"main.rs\" |\n    line = c.getLocation().getStartLine() and\n    call = c.toString() and\n    if exists(c.getStaticTarget())\n    then target = c.getStaticTarget().getCanonicalPath()\n    else target = \"(unresolved)\"\n  )\n}\n\nselect 1\n```\n\nRun:\n```\ncodeql database create db --language=rust --source-root=.\ncodeql query run query/include-paths.ql --database=db --output=out.bqrs\ncodeql bqrs decode out.bqrs --format=csv --result-set=functions\ncodeql bqrs decode out.bqrs --format=csv --result-set=calls\n```\n\n**Expected:** `hidden` and `hidden_extern` have the canonical paths `toy_include::inner::hidden` and `toy_include::inner::hidden_extern`, and the calls on lines 2 and 4 resolve to them, like the control module's.\n\n**Actual:**\n```\n\"file\",\"name\",\"canonicalPath\"\n\"direct.rs\",\"visible\",\"toy_include::direct::visible\"\n\"direct.rs\",\"visible_extern\",\"toy_include::direct::visible_extern\"\n\"tree/inner/mod.rs\",\"hidden\",\"(none)\"\n\"tree/inner/mod.rs\",\"hidden_extern\",\"(none)\"\n\n\"line\",\"call\",\"target\"\n2,\"...::hidden(...)\",\"(unresolved)\"\n3,\"...::visible(...)\",\"toy_include::direct::visible\"\n4,\"...::hidden_extern(...)\",\"(unresolved)\"\n5,\"...::visible_extern(...)\",\"toy_include::direct::visible_extern\"\n```\n\n**Likely cause**\n\n- In the extractor, `text_range_for_node` (`rust/extractor/src/translate/base.rs`) keeps a node's location only if it maps into the file being extracted. Nodes produced by an `include!` map into the included file, so the `inner` module in the expansion reports `lib.rs` as its file.\n- `modImport0` in `codeql/rust/internal/PathResolution.qll` then looks for `mod inner;` relative to `lib.rs` (`src/inner.rs`, `src/inner/mod.rs`) instead of `src/tree/`.\n- `tree/mod.rs` is also extracted on its own, and there `mod inner;` does resolve, but that copy is not part of the crate's module tree.\n\nA possible fix: have the extractor give `include!`d nodes their locations in the included file (or record which file each `include!` includes), so that `mod` files are looked up next to the file that declares them.\n\n","author":{"url":"https://github.com/bdrodes","@type":"Person","name":"bdrodes"},"datePublished":"2026-11-04T01:42:23Z","url":"https://github.com/github/codeql/issues/23009"}