Rust: Exclude taint-read-steps for axum::extract::state::State

Author: hvitved

rust/ql/lib/codeql/rust/frameworks/axum.model.yml

@@ -20,4 +20,9 @@ extensions:
       - ["<axum::routing::method_routing::MethodRouter>::patch", "Argument[0].Parameter[0..7]", "remote", "manual"]
       # on
       - ["axum::routing::method_routing::on", "Argument[1].Parameter[0..7]", "remote", "manual"]
-      - ["<axum::routing::method_routing::MethodRouter>::on", "Argument[1].Parameter[0..7]", "remote", "manual"]
+      - ["<axum::routing::method_routing::MethodRouter>::on", "Argument[1].Parameter[0..7]", "remote", "manual"]
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: excludeFieldTaintStep
+    data:
+      - ["axum::extract::state::State(0)"]

rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected

@@ -59,15 +59,13 @@ edges
 | test.rs:180:32:180:69 | ...: Json::<...> | test.rs:182:14:182:20 | payload | provenance |  |
 | test.rs:187:32:187:43 | ...: String | test.rs:188:14:188:17 | body | provenance |  |
 | test.rs:193:32:193:43 | ...: String | test.rs:194:14:194:17 | body | provenance |  |
-| test.rs:199:32:199:47 | ...: State::<...> | test.rs:200:14:200:20 | state.0 | provenance |  |
 | test.rs:199:50:199:61 | ...: String | test.rs:201:14:201:17 | body | provenance |  |
 | test.rs:208:34:208:50 | my_axum_handler_1 | test.rs:148:32:148:52 | ...: Path::<...> | provenance | Src:MaD:8  |
 | test.rs:209:39:209:55 | my_axum_handler_2 | test.rs:156:32:156:67 | ...: Path::<...> | provenance | Src:MaD:9  |
 | test.rs:210:33:210:49 | my_axum_handler_3 | test.rs:163:32:163:76 | ...: Query::<...> | provenance | Src:MaD:10  |
 | test.rs:213:65:213:81 | my_axum_handler_5 | test.rs:180:32:180:69 | ...: Json::<...> | provenance | Src:MaD:4  |
 | test.rs:215:33:215:49 | my_axum_handler_6 | test.rs:187:32:187:43 | ...: String | provenance | Src:MaD:8  |
 | test.rs:215:56:215:72 | my_axum_handler_7 | test.rs:193:32:193:43 | ...: String | provenance | Src:MaD:3  |
-| test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:199:32:199:47 | ...: State::<...> | provenance | Src:MaD:8  |
 | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:199:50:199:61 | ...: String | provenance | Src:MaD:8  |
 | test.rs:231:37:236:9 | \|...\| ... | test.rs:231:38:231:46 | ...: String | provenance | Src:MaD:6  |
 | test.rs:231:38:231:46 | ...: String | test.rs:233:18:233:18 | a | provenance |  |
@@ -139,9 +137,7 @@ nodes
 | test.rs:188:14:188:17 | body | semmle.label | body |
 | test.rs:193:32:193:43 | ...: String | semmle.label | ...: String |
 | test.rs:194:14:194:17 | body | semmle.label | body |
-| test.rs:199:32:199:47 | ...: State::<...> | semmle.label | ...: State::<...> |
 | test.rs:199:50:199:61 | ...: String | semmle.label | ...: String |
-| test.rs:200:14:200:20 | state.0 | semmle.label | state.0 |
 | test.rs:201:14:201:17 | body | semmle.label | body |
 | test.rs:208:34:208:50 | my_axum_handler_1 | semmle.label | my_axum_handler_1 |
 | test.rs:209:39:209:55 | my_axum_handler_2 | semmle.label | my_axum_handler_2 |
@@ -150,7 +146,6 @@ nodes
 | test.rs:215:33:215:49 | my_axum_handler_6 | semmle.label | my_axum_handler_6 |
 | test.rs:215:56:215:72 | my_axum_handler_7 | semmle.label | my_axum_handler_7 |
 | test.rs:216:33:216:49 | my_axum_handler_8 | semmle.label | my_axum_handler_8 |
-| test.rs:216:33:216:49 | my_axum_handler_8 | semmle.label | my_axum_handler_8 |
 | test.rs:231:37:236:9 | \|...\| ... | semmle.label | \|...\| ... |
 | test.rs:231:38:231:46 | ...: String | semmle.label | ...: String |
 | test.rs:233:18:233:18 | a | semmle.label | a |
@@ -193,7 +188,6 @@ testFailures
 | test.rs:182:14:182:20 | payload | test.rs:213:65:213:81 | my_axum_handler_5 | test.rs:182:14:182:20 | payload | $@ | test.rs:213:65:213:81 | my_axum_handler_5 | my_axum_handler_5 |
 | test.rs:188:14:188:17 | body | test.rs:215:33:215:49 | my_axum_handler_6 | test.rs:188:14:188:17 | body | $@ | test.rs:215:33:215:49 | my_axum_handler_6 | my_axum_handler_6 |
 | test.rs:194:14:194:17 | body | test.rs:215:56:215:72 | my_axum_handler_7 | test.rs:194:14:194:17 | body | $@ | test.rs:215:56:215:72 | my_axum_handler_7 | my_axum_handler_7 |
-| test.rs:200:14:200:20 | state.0 | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:200:14:200:20 | state.0 | $@ | test.rs:216:33:216:49 | my_axum_handler_8 | my_axum_handler_8 |
 | test.rs:201:14:201:17 | body | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:201:14:201:17 | body | $@ | test.rs:216:33:216:49 | my_axum_handler_8 | my_axum_handler_8 |
 | test.rs:233:18:233:18 | a | test.rs:231:37:236:9 | \|...\| ... | test.rs:233:18:233:18 | a | $@ | test.rs:231:37:236:9 | \|...\| ... | \|...\| ... |
 | test.rs:241:22:241:22 | a | test.rs:240:13:244:13 | \|...\| ... | test.rs:241:22:241:22 | a | $@ | test.rs:240:13:244:13 | \|...\| ... | \|...\| ... |

rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs

@@ -197,7 +197,7 @@ mod axum_test {
     }
 
     async fn my_axum_handler_8(state: State<()>, body: String) -> &'static str {
-        sink(state.0); // $ SPURIOUS: hasTaintFlow=my_axum_handler_8
+        sink(state.0);
         sink(body); // $ hasTaintFlow=my_axum_handler_8
 
         ""