diff --git a/rust/ql/src/queries/summary/Stats.qll b/rust/ql/src/queries/summary/Stats.qll index 1feaf3ab48b2..3156f1ffb26e 100644 --- a/rust/ql/src/queries/summary/Stats.qll +++ b/rust/ql/src/queries/summary/Stats.qll @@ -189,6 +189,8 @@ predicate taintStats(string key, int value) { or key = "Taint reach - nodes tainted" and value = getTaintedNodesCount() or + key = "Taint reach - total non-summary nodes" and value = getTotalNodesCount() + or key = "Taint reach - per million nodes" and value = getTaintReach().floor() or key = "Taint sinks - query sinks" and value = getQuerySinksCount() diff --git a/rust/ql/src/queries/summary/TaintReach.qll b/rust/ql/src/queries/summary/TaintReach.qll index 0f00fe6f7c6e..650bbe727c33 100644 --- a/rust/ql/src/queries/summary/TaintReach.qll +++ b/rust/ql/src/queries/summary/TaintReach.qll @@ -7,6 +7,7 @@ import rust private import codeql.rust.Concepts private import codeql.rust.dataflow.DataFlow private import codeql.rust.dataflow.TaintTracking +private import codeql.rust.dataflow.internal.Node /** * A taint configuration for taint reach (flow to any node from any modeled source). @@ -21,11 +22,27 @@ private module TaintReachFlow = TaintTracking::Global; /** * Gets the total number of data flow nodes that taint reaches (from any source). + * + * We don't include flow summary nodes, as their number is unstable (varies when models + * are added). */ -int getTaintedNodesCount() { result = count(DataFlow::Node n | TaintReachFlow::flowTo(n)) } +int getTaintedNodesCount() { + result = count(DataFlow::Node n | TaintReachFlow::flowTo(n) and not n instanceof FlowSummaryNode) +} + +/** + * Gets the total number of data flow nodes. + * + * We don't include flow summary nodes, as their number is unstable (varies when models + * are added). + */ +int getTotalNodesCount() { result = count(DataFlow::Node n | not n instanceof FlowSummaryNode) } /** * Gets the proportion of data flow nodes that taint reaches (from any source), * expressed as a count per million nodes. + * + * We don't include flow summary nodes, as their number is unstable (varies when models + * are added). */ -float getTaintReach() { result = (getTaintedNodesCount() * 1000000.0) / count(DataFlow::Node n) } +float getTaintReach() { result = (getTaintedNodesCount() * 1000000.0) / getTotalNodesCount() }