Skip to content

Rust: Add metric for DCA and debug predicates for type that reach the length limit #20147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 4, 2025
Merged

Rust: Add metric for DCA and debug predicates for type that reach the length limit #20147

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions rust/ql/integration-tests/query-suite/rust-code-scanning.qls.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ ql/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql
ql/rust/ql/src/queries/security/CWE-825/AccessInvalidPointer.ql
ql/rust/ql/src/queries/summary/LinesOfCode.ql
ql/rust/ql/src/queries/summary/LinesOfUserCode.ql
ql/rust/ql/src/queries/summary/NodesWithTypeAtLengthLimit.ql
ql/rust/ql/src/queries/summary/NumberOfFilesExtractedWithErrors.ql
ql/rust/ql/src/queries/summary/NumberOfSuccessfullyExtractedFiles.ql
ql/rust/ql/src/queries/summary/QuerySinkCounts.ql
Expand Down
1 change: 1 addition & 0 deletions rust/ql/integration-tests/query-suite/rust-security-and-quality.qls.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ ql/rust/ql/src/queries/security/CWE-825/AccessAfterLifetime.ql
ql/rust/ql/src/queries/security/CWE-825/AccessInvalidPointer.ql
ql/rust/ql/src/queries/summary/LinesOfCode.ql
ql/rust/ql/src/queries/summary/LinesOfUserCode.ql
ql/rust/ql/src/queries/summary/NodesWithTypeAtLengthLimit.ql
ql/rust/ql/src/queries/summary/NumberOfFilesExtractedWithErrors.ql
ql/rust/ql/src/queries/summary/NumberOfSuccessfullyExtractedFiles.ql
ql/rust/ql/src/queries/summary/QuerySinkCounts.ql
Expand Down
1 change: 1 addition & 0 deletions rust/ql/integration-tests/query-suite/rust-security-extended.qls.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ ql/rust/ql/src/queries/security/CWE-825/AccessAfterLifetime.ql
ql/rust/ql/src/queries/security/CWE-825/AccessInvalidPointer.ql
ql/rust/ql/src/queries/summary/LinesOfCode.ql
ql/rust/ql/src/queries/summary/LinesOfUserCode.ql
ql/rust/ql/src/queries/summary/NodesWithTypeAtLengthLimit.ql
ql/rust/ql/src/queries/summary/NumberOfFilesExtractedWithErrors.ql
ql/rust/ql/src/queries/summary/NumberOfSuccessfullyExtractedFiles.ql
ql/rust/ql/src/queries/summary/QuerySinkCounts.ql
Expand Down
14 changes: 14 additions & 0 deletions rust/ql/lib/codeql/rust/internal/TypeInference.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,8 @@ private module Input1 implements InputSig1<Location> {
tp0 order by kind, id1, id2
)
}

int getTypePathLimit() { result = 10 }
}

private import Input1
Expand All @@ -135,6 +137,8 @@ private module M1 = Make1<Location, Input1>;

private import M1

predicate getTypePathLimit = Input1::getTypePathLimit/0;

class TypePath = M1::TypePath;

module TypePath = M1::TypePath;
Expand Down Expand Up @@ -2265,6 +2269,16 @@ private module Debug {
result = strictcount(Type t0 | t0 = inferType(n, path))
}

Type debugInferTypeForNodeAtLimit(AstNode n, TypePath path) {
result = inferType(n, path) and
exists(TypePath path0 | exists(inferType(n, path0)) and path0.length() >= getTypePathLimit())
}

predicate countTypesForNodeAtLimit(AstNode n, int c) {
n = getRelevantLocatable() and
c = strictcount(Type t, TypePath path | t = debugInferTypeForNodeAtLimit(n, path))
}

predicate maxTypes(AstNode n, TypePath path, Type t, int c) {
c = countTypesAtPath(n, path, t) and
c = max(countTypesAtPath(_, _, _))
Expand Down
20 changes: 20 additions & 0 deletions rust/ql/src/queries/summary/NodesWithTypeAtLengthLimit.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
/**
* @name Nodes With Type At Length Limit
* @description Counts the number of AST nodes with a type at the type path length limit.
* @kind metric
* @id rust/summary/nodes-at-type-path-length-limit
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you want me to talk you through adding this metric to the DCA reports (and our metrics issue) - or would you prefer I do it for you? I'm happy either way assuming this is the only metric you have plans to add right now.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I can add the metric to DCA but it would be great to have your eyes on the PR!

Regarding the metrics issue it's up to you if we add it there or not. It obviously be nice to have, but may not be important enough to include.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mention me in the metrics PR then.

I'm happy to track it in metrics, it won't be among the fiddlier bits to track.

* @tags summary
*/

import rust
import codeql.rust.internal.TypeInference

from int atLimit
where
atLimit =
count(AstNode n, TypePath path |
exists(inferType(n, path)) and path.length() = getTypePathLimit()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How come this is =, whereas debugInferTypeForNodeAtLimit uses >=?

I'm a bit suspicious because in at least one case I get more results when I increase the threshold.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The length can never be greater than getTypePathLimit() so I = and >= should be the same?

In the debug predicate changing getTypePathLimit() to getTypePathLimit() - 2 was useful for me, and that is easier with >=, though we can also change it to = if the other is a bit confusing?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, and when the path limit is increased we potentially get more results because of more (longer) spurious / multiple paths being permitted and counted.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes :)

|
n
)
select atLimit