Rust: Exclude taint-read-steps for axum::extract::state::State

Author: hvitved

rust/ql/lib/codeql/rust/frameworks/axum.model.yml

@@ -20,4 +20,9 @@ extensions:
       - ["<axum::routing::method_routing::MethodRouter>::patch", "Argument[0].Parameter[0..7]", "remote", "manual"]
       # on
       - ["axum::routing::method_routing::on", "Argument[1].Parameter[0..7]", "remote", "manual"]
-      - ["<axum::routing::method_routing::MethodRouter>::on", "Argument[1].Parameter[0..7]", "remote", "manual"]
+      - ["<axum::routing::method_routing::MethodRouter>::on", "Argument[1].Parameter[0..7]", "remote", "manual"]
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: excludeFieldTaintStep
+    data:
+      - ["axum::extract::state::State(0)"]

rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected

@@ -55,7 +55,6 @@ edges
 | test.rs:213:65:213:81 | my_axum_handler_5 | test.rs:182:14:182:20 | payload | provenance | Src:MaD:4  |
 | test.rs:215:33:215:49 | my_axum_handler_6 | test.rs:188:14:188:17 | body | provenance | Src:MaD:8  |
 | test.rs:215:56:215:72 | my_axum_handler_7 | test.rs:194:14:194:17 | body | provenance | Src:MaD:3  |
-| test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:200:14:200:20 | state.0 | provenance | Src:MaD:8  |
 | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:201:14:201:17 | body | provenance | Src:MaD:8  |
 | test.rs:231:37:236:9 | \|...\| ... | test.rs:233:18:233:18 | a | provenance | Src:MaD:6  |
 | test.rs:240:13:244:13 | \|...\| ... | test.rs:241:22:241:22 | a | provenance | Src:MaD:7  |
@@ -113,7 +112,6 @@ nodes
 | test.rs:182:14:182:20 | payload | semmle.label | payload |
 | test.rs:188:14:188:17 | body | semmle.label | body |
 | test.rs:194:14:194:17 | body | semmle.label | body |
-| test.rs:200:14:200:20 | state.0 | semmle.label | state.0 |
 | test.rs:201:14:201:17 | body | semmle.label | body |
 | test.rs:208:34:208:50 | my_axum_handler_1 | semmle.label | my_axum_handler_1 |
 | test.rs:209:39:209:55 | my_axum_handler_2 | semmle.label | my_axum_handler_2 |
@@ -122,7 +120,6 @@ nodes
 | test.rs:215:33:215:49 | my_axum_handler_6 | semmle.label | my_axum_handler_6 |
 | test.rs:215:56:215:72 | my_axum_handler_7 | semmle.label | my_axum_handler_7 |
 | test.rs:216:33:216:49 | my_axum_handler_8 | semmle.label | my_axum_handler_8 |
-| test.rs:216:33:216:49 | my_axum_handler_8 | semmle.label | my_axum_handler_8 |
 | test.rs:231:37:236:9 | \|...\| ... | semmle.label | \|...\| ... |
 | test.rs:233:18:233:18 | a | semmle.label | a |
 | test.rs:240:13:244:13 | \|...\| ... | semmle.label | \|...\| ... |
@@ -161,7 +158,6 @@ testFailures
 | test.rs:182:14:182:20 | payload | test.rs:213:65:213:81 | my_axum_handler_5 | test.rs:182:14:182:20 | payload | $@ | test.rs:213:65:213:81 | my_axum_handler_5 | my_axum_handler_5 |
 | test.rs:188:14:188:17 | body | test.rs:215:33:215:49 | my_axum_handler_6 | test.rs:188:14:188:17 | body | $@ | test.rs:215:33:215:49 | my_axum_handler_6 | my_axum_handler_6 |
 | test.rs:194:14:194:17 | body | test.rs:215:56:215:72 | my_axum_handler_7 | test.rs:194:14:194:17 | body | $@ | test.rs:215:56:215:72 | my_axum_handler_7 | my_axum_handler_7 |
-| test.rs:200:14:200:20 | state.0 | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:200:14:200:20 | state.0 | $@ | test.rs:216:33:216:49 | my_axum_handler_8 | my_axum_handler_8 |
 | test.rs:201:14:201:17 | body | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:201:14:201:17 | body | $@ | test.rs:216:33:216:49 | my_axum_handler_8 | my_axum_handler_8 |
 | test.rs:233:18:233:18 | a | test.rs:231:37:236:9 | \|...\| ... | test.rs:233:18:233:18 | a | $@ | test.rs:231:37:236:9 | \|...\| ... | \|...\| ... |
 | test.rs:241:22:241:22 | a | test.rs:240:13:244:13 | \|...\| ... | test.rs:241:22:241:22 | a | $@ | test.rs:240:13:244:13 | \|...\| ... | \|...\| ... |

rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs

@@ -197,7 +197,7 @@ mod axum_test {
     }
 
     async fn my_axum_handler_8(state: State<()>, body: String) -> &'static str {
-        sink(state.0); // $ SPURIOUS: hasTaintFlow=my_axum_handler_8
+        sink(state.0);
         sink(body); // $ hasTaintFlow=my_axum_handler_8
 
         ""