Rust: Type inference for pattern matching

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/StructPatImpl.qll

@@ -33,13 +33,20 @@ module Impl {
       name = this.getStructPatFieldList().getAField().getFieldName()
     }
 
-    /** Gets the record field that matches the `name` pattern of this pattern. */
+    /** Gets the struct field that matches the `name` pattern of this pattern. */
     pragma[nomagic]
     StructField getStructField(string name) {
       exists(PathResolution::ItemNode i | i = this.getResolvedPath(name) |
         result.isStructField(i, name) or
         result.isVariantField(i, name)
       )
     }
+
+    /** Gets the struct pattern for the field `name`. */
+    pragma[nomagic]
+    StructPatField getPatField(string name) {
+      result = this.getStructPatFieldList().getAField() and
+      name = result.getFieldName()
+    }
   }
 }

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -276,6 +276,20 @@ private predicate typeEquality(AstNode n1, TypePath prefix1, AstNode n2, TypePat
     or
     n1 = n2.(MatchExpr).getAnArm().getExpr()
     or
+    exists(LetExpr let |
+      n1 = let.getScrutinee() and
+      n2 = let.getPat()
+    )
+    or
+    exists(MatchExpr me |
+      n1 = me.getScrutinee() and
+      n2 = me.getAnArm().getPat()
+    )
+    or
+    n1 = n2.(OrPat).getAPat()
+    or
+    n1 = n2.(ParenPat).getPat()
+    or
     exists(BreakExpr break |
       break.getExpr() = n1 and
       break.getTarget() = n2.(LoopExpr)
@@ -287,12 +301,18 @@ private predicate typeEquality(AstNode n1, TypePath prefix1, AstNode n2, TypePat
     )
     or
     n1 = n2.(MacroExpr).getMacroCall().getMacroCallExpansion()
+    or
+    n1 = n2.(MacroPat).getMacroCall().getMacroCallExpansion()
   )
   or
   n1 = n2.(RefExpr).getExpr() and
   prefix1.isEmpty() and
   prefix2 = TypePath::singleton(TRefTypeParameter())
   or
+  n1 = n2.(RefPat).getPat() and
+  prefix1.isEmpty() and
+  prefix2 = TypePath::singleton(TRefTypeParameter())
+  or
   exists(BlockExpr be |
     n1 = be and
     n2 = be.getStmtList().getTailExpr() and
@@ -478,7 +498,7 @@ private module StructExprMatchingInput implements MatchingInputSig {
     Type getInferredType(AccessPosition apos, TypePath path) {
       result = inferType(this.getNodeAt(apos), path)
       or
-      // The struct type is supplied explicitly as a type qualifier, e.g.
+      // The struct/enum type is supplied explicitly as a type qualifier, e.g.
       // `Foo<Bar>::Variant { ... }`.
       apos.isStructPos() and
       exists(Path p, TypeMention tm |
@@ -576,7 +596,7 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     }
   }
 
-  abstract private class TupleDeclaration extends Declaration {
+  abstract additional class TupleDeclaration extends Declaration {
     override Type getDeclaredType(DeclarationPosition dpos, TypePath path) {
       result = super.getDeclaredType(dpos, path)
       or
@@ -1178,6 +1198,120 @@ private Type inferIndexExprType(IndexExpr ie, TypePath path) {
   )
 }
 
+/**
+ * A matching configuration for resolving types of struct patterns
+ * like `let Foo { bar } = ...`.
+ */
+private module StructPatMatchingInput implements MatchingInputSig {
+  class DeclarationPosition = StructExprMatchingInput::DeclarationPosition;
+
+  class Declaration = StructExprMatchingInput::Declaration;
+
+  class AccessPosition = DeclarationPosition;
+
+  class Access extends StructPat {
+    Type getTypeArgument(TypeArgumentPosition apos, TypePath path) { none() }
+
+    AstNode getNodeAt(AccessPosition apos) {
+      result = this.getPatField(apos.asFieldPos()).getPat()
+      or
+      result = this and
+      apos.isStructPos()
+    }
+
+    Type getInferredType(AccessPosition apos, TypePath path) {
+      result = inferType(this.getNodeAt(apos), path)
+      or
+      // The struct/enum type is supplied explicitly as a type qualifier, e.g.
+      // `let Foo<Bar>::Variant { ... } = ...`.
+      apos.isStructPos() and
+      exists(Path p, TypeMention tm |
+        p = this.getPath() and
+        if resolvePath(p) instanceof Variant then tm = p.getQualifier() else tm = p
+      |
+        result = tm.resolveTypeAt(path)
+      )
+    }
+
+    Declaration getTarget() { result = resolvePath(this.getPath()) }
+  }
+
+  predicate accessDeclarationPositionMatch(AccessPosition apos, DeclarationPosition dpos) {
+    apos = dpos
+  }
+}
+
+private module StructPatMatching = Matching<StructPatMatchingInput>;
+
+/**
+ * Gets the type of `n` at `path`, where `n` is either a struct pattern or
+ * a field pattern of a struct pattern.
+ */
+pragma[nomagic]
+private Type inferStructPatType(AstNode n, TypePath path) {
+  exists(StructPatMatchingInput::Access a, StructPatMatchingInput::AccessPosition apos |
+    n = a.getNodeAt(apos) and
+    result = StructPatMatching::inferAccessType(a, apos, path)
+  )
+}
+
+/**
+ * A matching configuration for resolving types of tuple struct patterns
+ * like `let Some(x) = ...`.
+ */
+private module TupleStructPatMatchingInput implements MatchingInputSig {
+  class DeclarationPosition = CallExprBaseMatchingInput::DeclarationPosition;
+
+  class Declaration = CallExprBaseMatchingInput::TupleDeclaration;
+
+  class AccessPosition = DeclarationPosition;
+
+  class Access extends TupleStructPat {
+    Type getTypeArgument(TypeArgumentPosition apos, TypePath path) { none() }
+
+    AstNode getNodeAt(AccessPosition apos) {
+      result = this.getField(apos.asPosition())
+      or
+      result = this and
+      apos.isSelf()
+    }
+
+    Type getInferredType(AccessPosition apos, TypePath path) {
+      result = inferType(this.getNodeAt(apos), path)
+      or
+      // The struct/enum type is supplied explicitly as a type qualifier, e.g.
+      // `let Option::<Foo>(x) = ...`.
+      apos.isSelf() and
+      exists(Path p, TypeMention tm |
+        p = this.getPath() and
+        if resolvePath(p) instanceof Variant then tm = p.getQualifier() else tm = p
+      |
+        result = tm.resolveTypeAt(path)
+      )
+    }
+
+    Declaration getTarget() { result = resolvePath(this.getPath()) }
+  }
+
+  predicate accessDeclarationPositionMatch(AccessPosition apos, DeclarationPosition dpos) {
+    apos = dpos
+  }
+}
+
+private module TupleStructPatMatching = Matching<TupleStructPatMatchingInput>;
+
+/**
+ * Gets the type of `n` at `path`, where `n` is either a tuple struct pattern or
+ * a positional pattern of a tuple struct pattern.
+ */
+pragma[nomagic]
+private Type inferTupleStructPatType(AstNode n, TypePath path) {
+  exists(TupleStructPatMatchingInput::Access a, TupleStructPatMatchingInput::AccessPosition apos |
+    n = a.getNodeAt(apos) and
+    result = TupleStructPatMatching::inferAccessType(a, apos, path)
+  )
+}
+
 final private class ForIterableExpr extends Expr {
   ForIterableExpr() { this = any(ForExpr fe).getIterable() }
 
@@ -1836,6 +1970,10 @@ private module Cached {
     result = inferForLoopExprType(n, path)
     or
     result = inferCastExprType(n, path)
+    or
+    result = inferStructPatType(n, path)
+    or
+    result = inferTupleStructPatType(n, path)
   }
 }
 

rust/ql/test/library-tests/dataflow/sources/CONSISTENCY/PathResolutionConsistency.expected

@@ -11,8 +11,6 @@ multipleCallTargets
 | test.rs:178:30:178:68 | ...::_print(...) |
 | test.rs:187:26:187:105 | ...::_print(...) |
 | test.rs:228:22:228:72 | ... .read_to_string(...) |
-| test.rs:482:22:482:50 | file.read_to_end(...) |
-| test.rs:488:22:488:53 | file.read_to_string(...) |
 | test.rs:609:18:609:38 | ...::_print(...) |
 | test.rs:614:18:614:45 | ...::_print(...) |
 | test.rs:618:25:618:49 | address.to_socket_addrs() |
@@ -79,5 +77,11 @@ multipleCallTargets
 | test_futures_io.rs:93:26:93:63 | pinned.poll_read(...) |
 | test_futures_io.rs:116:22:116:50 | pinned.poll_fill_buf(...) |
 | test_futures_io.rs:145:26:145:49 | ...::with_capacity(...) |
+| web_frameworks.rs:13:14:13:22 | a.as_str() |
+| web_frameworks.rs:13:14:13:23 | a.as_str() |
+| web_frameworks.rs:14:14:14:24 | a.as_bytes() |
+| web_frameworks.rs:14:14:14:25 | a.as_bytes() |
 | web_frameworks.rs:101:14:101:23 | a.as_str() |
 | web_frameworks.rs:102:14:102:25 | a.as_bytes() |
+| web_frameworks.rs:158:14:158:23 | a.as_str() |
+| web_frameworks.rs:159:14:159:25 | a.as_bytes() |

rust/ql/test/library-tests/dataflow/sources/web_frameworks.rs

@@ -10,8 +10,8 @@ mod poem_test {
     #[handler]
     fn my_poem_handler_1(Path(a): Path<String>, // $ Alert[rust/summary/taint-sources]
     ) -> String {
-        sink(a.as_str()); // $ MISSING: hasTaintFlow -- no type inference for patterns
-        sink(a.as_bytes()); // $ MISSING: hasTaintFlow -- no type inference for patterns
+        sink(a.as_str()); // $ hasTaintFlow
+        sink(a.as_bytes()); // $ hasTaintFlow
         sink(a); // $ hasTaintFlow
 
         "".to_string()

rust/ql/test/library-tests/sensitivedata/CONSISTENCY/PathResolutionConsistency.expected

@@ -24,4 +24,6 @@ multipleCallTargets
 | test.rs:302:7:302:48 | ... .as_str() |
 | test.rs:303:7:303:35 | ... .as_str() |
 | test.rs:304:7:304:35 | ... .as_str() |
+| test.rs:313:8:313:19 | num.as_str() |
+| test.rs:324:8:324:19 | num.as_str() |
 | test.rs:343:7:343:39 | ... .as_str() |

rust/ql/test/library-tests/type-inference/main.rs

@@ -2362,12 +2362,12 @@ pub mod pattern_matching {
     pub fn f() -> Option<()> {
         let value = Some(42);
         if let Some(mesg) = value {
-            let mesg = mesg; // $ MISSING: type=mesg:i32
+            let mesg = mesg; // $ type=mesg:i32
             println!("{mesg}");
         }
         match value {
             Some(mesg) => {
-                let mesg = mesg; // $ MISSING: type=mesg:i32
+                let mesg = mesg; // $ type=mesg:i32
                 println!("{mesg}");
             }
             None => (),
@@ -2383,15 +2383,15 @@ pub mod pattern_matching {
             value2: false,
         };
         if let MyRecordStruct { value1, value2 } = my_record_struct {
-            let x = value1; // $ MISSING: type=x:i32
-            let y = value2; // $ MISSING: type=y:bool
+            let x = value1; // $ type=x:i32
+            let y = value2; // $ type=y:bool
             ();
         }
 
         let my_tuple_struct = MyTupleStruct(42, false);
         if let MyTupleStruct(value1, value2) = my_tuple_struct {
-            let x = value1; // $ MISSING: type=x:i32
-            let y = value2; // $ MISSING: type=y:bool
+            let x = value1; // $ type=x:i32
+            let y = value2; // $ type=y:bool
             ();
         }
 
@@ -2401,13 +2401,13 @@ pub mod pattern_matching {
         };
         match my_enum1 {
             MyEnum::Variant1 { value1, value2 } => {
-                let x = value1; // $ MISSING: type=x:i32
-                let y = value2; // $ MISSING: type=y:bool
+                let x = value1; // $ type=x:i32
+                let y = value2; // $ type=y:bool
                 ();
             }
             MyEnum::Variant2(value1, value2) => {
-                let x = value1; // $ MISSING: type=x:bool
-                let y = value2; // $ MISSING: type=y:i32
+                let x = value1; // $ type=x:bool
+                let y = value2; // $ type=y:i32
                 ();
             }
         }