Rust: Distinguish &mut T from &T in type inference

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/OperationImpl.qll

@@ -30,6 +30,7 @@ module Impl{
 op="!"andpath="core::ops::bit::Not"andmethod="not"andborrows=0
 or
 // Dereference
+// todo: handle `core::ops::deref::DerefMut`
 op="*"andpath="core::ops::deref::Deref"andmethod="deref"andborrows=1
 )
 or

rust/ql/lib/codeql/rust/frameworks/stdlib/Builtins.qll

@@ -162,15 +162,20 @@ class ArrayType extends BuiltinType{
 overridestringgetDisplayName(){result="[;]"}
 }
 
-/** The builtin reference type `&T`. */
-classRefTypeextendsBuiltinType{
-RefType(){this.getName()="Ref"}
+/** A builtin reference type `&T` or `&mut T`. */
+abstractprivateclassRefTypeImplextendsBuiltinType{}
+
+finalclassRefType=RefTypeImpl;
+
+/** The builtin shared reference type `&T`. */
+classRefSharedTypeextendsRefTypeImpl{
+RefSharedType(){this.getName()="Ref"}
 
 overridestringgetDisplayName(){result="&"}
 }
 
-/** The builtin reference type `&mut T`. */
-classRefMutTypeextendsBuiltinType{
+/** The builtin mutable reference type `&mut T`. */
+classRefMutTypeextendsRefTypeImpl{
 RefMutType(){this.getName()="RefMut"}
 
 overridestringgetDisplayName(){result="&mut"}

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -771,8 +771,12 @@ private TypeItemNode resolveBuiltin(TypeRepr tr){
 trinstanceofArrayTypeReprand
 resultinstanceof Builtins::ArrayType
 or
-trinstanceofRefTypeReprand
-resultinstanceof Builtins::RefType
+tr=
+any(RefTypeReprrtr|
+ifrtr.isMut()
+thenresultinstanceof Builtins::RefMutType
+elseresultinstanceof Builtins::RefSharedType
+)
 or
 tr.(PtrTypeRepr).isConst()and
 resultinstanceof Builtins::PtrConstType

rust/ql/lib/codeql/rust/internal/Type.qll

@@ -224,21 +224,33 @@ TypeParamTypeParameter getArrayTypeParameter(){
 result=any(ArrayTypet).getPositionalTypeParameter(0)
 }
 
-/**
- * A reference type.
- *
- * Reference types like `& i64` are modeled as normal generic types
- * with a single type argument.
- */
-classRefTypeextendsStructType{
-RefType(){this.getStruct()instanceof Builtins::RefType}
+abstractclassRefTypeextendsStructType{}
+
+pragma[nomagic]
+TypeParamTypeParametergetRefTypeParameter(){
+result=any(RefTypet).getPositionalTypeParameter(0)
+}
+
+classRefMutTypeextendsRefType{
+RefMutType(){this.getStruct()instanceof Builtins::RefMutType}
+
+overridestringtoString(){result="&mut"}
+}
+
+pragma[nomagic]
+TypeParamTypeParametergetRefMutTypeParameter(){
+result=any(RefMutTypet).getPositionalTypeParameter(0)
+}
+
+classRefSharedTypeextendsRefType{
+RefSharedType(){this.getStruct()instanceof Builtins::RefSharedType}
 
 overridestringtoString(){result="&"}
 }
 
 pragma[nomagic]
-TypeParamTypeParametergetRefTypeParameter(){
-result=any(RefTypet).getPositionalTypeParameter(0)
+TypeParamTypeParametergetRefSharedTypeParameter(){
+result=any(RefSharedTypet).getPositionalTypeParameter(0)
 }
 
 /**