Rust: Distinguish &mut T from &T in type inference

rust/ql/lib/codeql/rust/elements/internal/OperationImpl.qll

@@ -30,6 +30,7 @@ module Impl{
 op="!"andpath="core::ops::bit::Not"andmethod="not"andborrows=0
 or
 // Dereference
+// todo: handle `core::ops::deref::DerefMut`
 op="*"andpath="core::ops::deref::Deref"andmethod="deref"andborrows=1
 )
 or

rust/ql/lib/codeql/rust/frameworks/stdlib/Builtins.qll

@@ -162,15 +162,20 @@ class ArrayType extends BuiltinType{
  override string getDisplayName(){result = "[;]"}
 }
 
-/** The builtin reference type `&T`. */
-class RefType extends BuiltinType{
- RefType(){this.getName() = "Ref"}
+/** A builtin reference type `&T` or `&mut T`. */
+abstract private class RefTypeImpl extends BuiltinType{}
+
+final class RefType = RefTypeImpl;
+
+/** The builtin shared reference type `&T`. */
+class RefSharedType extends RefTypeImpl{
+ RefSharedType(){this.getName() = "Ref"}
 
  override string getDisplayName(){result = "&"}
 }
 
-/** The builtin reference type `&mut T`. */
-class RefMutType extends BuiltinType{
+/** The builtin mutable reference type `&mut T`. */
+class RefMutType extends RefTypeImpl{
  RefMutType(){this.getName() = "RefMut"}
 
  override string getDisplayName(){result = "&mut"}

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -771,8 +771,12 @@ private TypeItemNode resolveBuiltin(TypeRepr tr){
 trinstanceofArrayTypeReprand
 resultinstanceof Builtins::ArrayType
 or
-trinstanceofRefTypeReprand
-resultinstanceof Builtins::RefType
+tr=
+any(RefTypeReprrtr|
+ifrtr.isMut()
+thenresultinstanceof Builtins::RefMutType
+elseresultinstanceof Builtins::RefSharedType
+)
 or
 tr.(PtrTypeRepr).isConst()and
 resultinstanceof Builtins::PtrConstType

rust/ql/lib/codeql/rust/internal/Type.qll

@@ -224,21 +224,33 @@ TypeParamTypeParameter getArrayTypeParameter(){
  result = any(ArrayType t).getPositionalTypeParameter(0)
 }
 
-/**
- * A reference type.
- *
- * Reference types like `& i64` are modeled as normal generic types
- * with a single type argument.
- */
-class RefType extends StructType{
- RefType(){this.getStruct() instanceof Builtins::RefType }
+abstract class RefType extends StructType{}
+
+pragma[nomagic]
+TypeParamTypeParameter getRefTypeParameter(){
+ result = any(RefType t).getPositionalTypeParameter(0)
+}
+
+class RefMutType extends RefType{
+ RefMutType(){this.getStruct() instanceof Builtins::RefMutType }
+
+ override string toString(){result = "&mut"}
+}
+
+pragma[nomagic]
+TypeParamTypeParameter getRefMutTypeParameter(){
+ result = any(RefMutType t).getPositionalTypeParameter(0)
+}
+
+class RefSharedType extends RefType{
+ RefSharedType(){this.getStruct() instanceof Builtins::RefSharedType }
 
  override string toString(){result = "&"}
 }
 
 pragma[nomagic]
-TypeParamTypeParameter getRefTypeParameter(){
- result = any(RefType t).getPositionalTypeParameter(0)
+TypeParamTypeParameter getRefSharedTypeParameter(){
+ result = any(RefSharedType t).getPositionalTypeParameter(0)
 }
 
 /**