Improve the Pattern for CVE-2021-15551, Migrate 3 Patterns from CodeQL Queries and Support Multiple-Pattern-Item Matching - #121
Merged
TheVeryDarkness merged 30 commits intoAug 4, 2026
Conversation
Co-Authored-By: Sunny Rain <139741903+jiuxiyan@users.noreply.github.com>
- Introduced a new module `item_attr` with a function `has_attr` to check for attributes on items. - Updated the `PredicateKind` enum to include `ItemAttr` variant. - Enhanced the `PredicateEvaluator` to handle the new `ItemAttr` predicate. - Added necessary imports and updated related files to accommodate the new functionality. - Improved error handling and diagnostics in the context of attribute checks.
- Introduced a new predicate function `runs_outside_main` to identify functions that execute outside the `main` lifetime, such as constructors and destructors. - Updated the `PredicateKind` enum to include the new predicate. - Enhanced the `PredicateEvaluator` to evaluate the new predicate correctly. - Modified relevant documentation and tests to reflect the changes in predicate handling.
- Introduced a new `MatchSession` struct to orchestrate candidate collection and CSP solving for pattern items. - Added `MatchCollectCtxt` for collecting function and ADT candidates, improving the organization of candidate handling. - Implemented a backtracking CSP solver in `CspSolver` for consistent matching across slots. - Created a `SessionConfig` struct to manage session parameters, including a limit on the number of results. - Added new modules for session management, including bindings, collection, and configuration. - Updated relevant tests and documentation to reflect the new session management capabilities.
- Introduced `try_span` method in the `Matched` trait to allow for optional span retrieval, enhancing error handling. - Updated implementations in `NormalizedMatched` and `MultiMatched` to utilize the new `try_span` method. - Modified `DynamicErrorBuilder` to filter spans using `try_span`, improving robustness in error reporting. - Enhanced `merge_ty_vars` logic in `MetaBindings` to skip certain type bindings, refining type variable management. - Updated tests to reflect changes in function signatures and error diagnostics for multi-function patterns.
- Updated the filtering logic in `MatchSession` to improve handling of negative matches by utilizing operation match keys. - Added `operation_match_key` method in `SessionResult` to facilitate comparison of matches within the same function using full `NormalizedMatched` equality. - Refined the `primary_fn_candidate` method to return candidates directly, enhancing clarity and usability.
- Updated the deduplication logic in `dedupe_pending` to utilize `NormalizedMatched` instead of `MetaBindings`, improving the accuracy of equality checks for lint matches. - Adjusted the handling of seen items to reflect the new structure, enhancing the overall clarity and maintainability of the code.
- Modified error messages in multiple test files to clarify the unsoundness of calling `Pin::new_unchecked` on mutable references that can be freely moved. - Fix several false negatives in previous versions.
…eous) - Updated the `dedupe_pending` function to include `MatchSlot` in the deduplication logic, improving the accuracy of lint match handling. - Introduced `commit_field_assignments` method in `MatchAdtCtxt` to streamline field assignment checks for ADTs. - Enhanced `MatchSession` to classify matching modes for function and ADT slots, improving the organization of candidate collection. - Added methods for deduplicating function slot permutations and retrieving primary function slots, enhancing clarity and usability in session results. - Updated relevant tests and documentation to reflect changes in pattern matching and session management capabilities.
- Updated the `match_adt` method in `MatchAdtCtxt` to streamline field candidate matching for structs, enhancing clarity and efficiency. - Removed the `commit_field_assignments` method, simplifying the ADT matching process. - Adjusted the `MatchCollectCtxt` to eliminate unnecessary field assignment checks, improving candidate collection logic. - Enhanced `MatchSession` to better classify function and ADT slot matching modes, refining the organization of candidate handling. - Updated relevant tests to reflect changes in ADT matching and session management capabilities.
…ching - Simplified the `fn_decl` function in `CheckFnCtxt` to use `hir().fn_decl_by_hir_id`, improving clarity and efficiency. - Enhanced field candidate matching in `MatchAdtCtxt` by adding logic to handle existing candidates more effectively. - Updated `MatchCtxt` to include checks for empty candidate lists, ensuring robust handling of type and constant variable matches. - Introduced a new matching mode in `RustItemsMatchingMode` for struct and function bindings, refining candidate processing. - Improved error diagnostics in CVE tests related to dereferencing null pointers and pointer out-of-bounds issues. - Updated relevant tests to reflect changes in matching logic and error handling capabilities.
- Introduced `AdtFieldMap` for managing field metavar bindings in ADT patterns, improving clarity and organization. - Added methods in `MatchAdtCtxt` for matching ADT structures and committing unique field candidates, enhancing the matching logic. - Updated `NormalizedMatched` and `BindingSnapshot` to include `adt_fields`, ensuring consistent handling of field bindings across the matching process. - Refined `MetaBindings` to support merging of ADT field bindings, improving the robustness of candidate management. - Enhanced tests to validate the new field candidate handling and merging logic, ensuring correctness in various scenarios.
TheVeryDarkness
changed the title
- Updated `is_not_unpin` to treat `PhantomData<_>` as `Unpin`, preventing incorrect competition with real `!Unpin` fields. - Introduced `with_typing_env` method in `MatchAdtCtxt` to allow caller's typing environment, improving predicate handling. - Added `reset_matches_after_probe` method in `FieldCandidates` to clear committed field bindings after candidate probing. - Implemented `collect_adt_field_bindings` and `reset_adt_field_bindings_after_probe` functions for better management of ADT field bindings. - Refactored `MatchTyCtxt` to ensure unique commits and prevent premature binding of ambiguous fields during matching. - Updated tests to validate new field candidate handling and ensure correctness in various scenarios.
- Simplified pattern matching logic by removing unnecessary references in match arms for `Rvalue` variants, enhancing readability and consistency.
- Removed the `RustItemsMatchingMode` enum and replaced it with a more flexible `SlotPolicy` struct to streamline matching logic. - Enhanced `SessionMatching` to utilize the new `SlotPolicy`, allowing for better handling of function and ADT slot matching. - Updated the matching process to differentiate between 'And' and 'Or' combinations for results, improving clarity and efficiency. - Refactored related functions to align with the new policy structure, ensuring consistent behavior across different matching scenarios. - Adjusted tests to validate the new matching logic and ensure correctness in various cases.
- Eliminated the SlotPolicy struct from the session matching logic, simplifying the matching process. - Updated the MatchSession and SessionMatching implementations to directly handle function and ADT slot matching without the policy abstraction. - Refactored related functions to ensure consistent behavior and improved clarity in the matching logic. - Adjusted tests to validate the updated matching process and ensure correctness across various scenarios.
- Introduced `#[expect(dead_code)]` annotations for `candidates` and `matched` fields in `ConstVarMatches` and `PlaceVarMatches` structs to clarify that these fields are not shared between functions.
TheVeryDarkness
marked this pull request as ready for review
July 14, 2026 02:22
TheVeryDarkness
changed the title
TheVeryDarkness
changed the title
- Introduced a new `places` module to manage multiple places predicates, improving the structure of predicate definitions. - Added `mentions_place` function to check if a computation references a specific place, enhancing predicate evaluation capabilities. - Updated `PredicateKind` to include `MultiplePlaces`, allowing for more comprehensive predicate handling. - Implemented `is_nonzero` function in `single_const` to evaluate constant values, contributing to improved predicate checks. - Enhanced documentation and comments for clarity on the new functionalities and their intended use cases.
- Updated patterns for uninitialized vectors to improve clarity and structure, including new patterns for `with_capacity`, `assign_with_capacity`, `reserve`, and `new`. - Enhanced CVE patterns for double drop and unsound casts, refining the logic to prevent potential vulnerabilities. - Removed redundant code and improved documentation for better understanding of the patterns and their implications. - Adjusted tests to reflect the changes and ensure correctness in the handling of uninitialized vectors and CVE scenarios.
- Added `flows_to` and `may_panic` predicates to support dataflow constraints in RPL, allowing for more expressive pattern matching. - Updated `PredicateEvaluator` and `MatchCollectCtxt` to incorporate the new predicates, enhancing the evaluation of constraints. - Introduced a new `MirDataDepGraph` to facilitate data dependency analysis within the MIR. - Enhanced documentation for dataflow predicates, including usage examples and limitations. - Added tests for new predicates and updated existing tests to ensure correctness in various scenarios.
- Updated `may_panic` predicate to clarify potential panic sites, including handling for unresolvable generics and local functions. - Introduced new patterns for CVE-2021-30455, CVE-2021-30456, and CVE-2021-30457, documenting unsafe dataflow scenarios in the `id-map` crate. - Added tests to validate panic safety in `clone_from`, `get_or_insert_with`, and `remove_set` methods, ensuring correct handling of potential double-free vulnerabilities. - Enhanced documentation for dataflow predicates and added examples for new CVE patterns, improving clarity and usability.
…`arg_has_param` function
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.