Rust: Disambiguate calls to associated functions

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/CallExprBaseImpl.qll

@@ -13,6 +13,7 @@ private import codeql.rust.elements.Resolvable
  */
 module Impl {
   private import rust
+  private import codeql.rust.internal.TypeInference as TypeInference
 
   pragma[nomagic]
   Resolvable getCallResolvable(CallExprBase call) {
@@ -27,7 +28,7 @@ module Impl {
    */
   class CallExprBase extends Generated::CallExprBase {
     /** Gets the static target of this call, if any. */
-    Callable getStaticTarget() { none() } // overridden by subclasses, but cannot be made abstract
+    final Function getStaticTarget() { result = TypeInference::resolveCallTarget(this) }
 
     override Expr getArg(int index) { result = this.getArgList().getArg(index) }
   }

rust/ql/lib/codeql/rust/elements/internal/CallExprImpl.qll

@@ -14,7 +14,6 @@ private import codeql.rust.elements.PathExpr
 module Impl {
   private import rust
   private import codeql.rust.internal.PathResolution as PathResolution
-  private import codeql.rust.internal.TypeInference as TypeInference
 
   pragma[nomagic]
   Path getFunctionPath(CallExpr ce) { result = ce.getFunction().(PathExpr).getPath() }
@@ -37,15 +36,6 @@ module Impl {
   class CallExpr extends Generated::CallExpr {
     override string toStringImpl() { result = this.getFunction().toAbbreviatedString() + "(...)" }
 
-    override Callable getStaticTarget() {
-      // If this call is to a trait method, e.g., `Trait::foo(bar)`, then check
-      // if type inference can resolve it to the correct trait implementation.
-      result = TypeInference::resolveMethodCallTarget(this)
-      or
-      not exists(TypeInference::resolveMethodCallTarget(this)) and
-      result = getResolvedFunction(this)
-    }
-
     /** Gets the struct that this call resolves to, if any. */
     Struct getStruct() { result = getResolvedFunction(this) }
 

rust/ql/lib/codeql/rust/elements/internal/CallImpl.qll

@@ -40,6 +40,9 @@ module Impl {
     /** Gets the trait targeted by this call, if any. */
     abstract Trait getTrait();
 
+    /** Holds if this call targets a trait. */
+    predicate hasTrait() { exists(this.getTrait()) }
+
     /** Gets the name of the method called if this call is a method call. */
     abstract string getMethodName();
 
@@ -59,12 +62,7 @@ module Impl {
     Expr getReceiver() { result = this.getArgument(TSelfArgumentPosition()) }
 
     /** Gets the static target of this call, if any. */
-    Function getStaticTarget() {
-      result = TypeInference::resolveMethodCallTarget(this)
-      or
-      not exists(TypeInference::resolveMethodCallTarget(this)) and
-      result = this.(CallExpr).getStaticTarget()
-    }
+    Function getStaticTarget() { result = TypeInference::resolveCallTarget(this) }
 
     /** Gets a runtime target of this call, if any. */
     pragma[nomagic]
@@ -78,23 +76,44 @@ module Impl {
     }
   }
 
+  private predicate callHasQualifier(CallExpr call, Path path, Path qualifier) {
+    path = call.getFunction().(PathExpr).getPath() and
+    qualifier = path.getQualifier()
+  }
+
+  private predicate callHasTraitQualifier(CallExpr call, Trait qualifier) {
+    exists(RelevantPath qualifierPath |
+      callHasQualifier(call, _, qualifierPath) and
+      qualifier = resolvePath(qualifierPath) and
+      // When the qualifier is `Self` and resolves to a trait, it's inside a
+      // trait method's default implementation. This is not a dispatch whose
+      // target is inferred from the type of the receiver, but should always
+      // resolve to the function in the trait block as path resolution does.
+      not qualifierPath.isUnqualified("Self")
+    )
+  }
+
   /** Holds if the call expression dispatches to a method. */
-  private predicate callIsMethodCall(CallExpr call, Path qualifier, string methodName) {
+  private predicate callIsMethodCall(
+    CallExpr call, Path qualifier, string methodName, boolean selfIsRef
+  ) {
     exists(Path path, Function f |
-      path = call.getFunction().(PathExpr).getPath() and
+      callHasQualifier(call, path, qualifier) and
       f = resolvePath(path) and
-      f.getParamList().hasSelfParam() and
-      qualifier = path.getQualifier() and
-      path.getSegment().getIdentifier().getText() = methodName
+      path.getSegment().getIdentifier().getText() = methodName and
+      exists(SelfParam self |
+        self = f.getParamList().getSelfParam() and
+        if self.isRef() then selfIsRef = true else selfIsRef = false
+      )
     )
   }
 
-  private class CallExprCall extends Call instanceof CallExpr {
-    CallExprCall() { not callIsMethodCall(this, _, _) }
+  class CallExprCall extends Call instanceof CallExpr {
+    CallExprCall() { not callIsMethodCall(this, _, _, _) }
 
     override string getMethodName() { none() }
 
-    override Trait getTrait() { none() }
+    override Trait getTrait() { callHasTraitQualifier(this, result) }
 
     override predicate implicitBorrowAt(ArgumentPosition pos, boolean certain) { none() }
 
@@ -103,22 +122,23 @@ module Impl {
     }
   }
 
-  private class CallExprMethodCall extends Call instanceof CallExpr {
+  class CallExprMethodCall extends Call instanceof CallExpr {
     Path qualifier;
     string methodName;
+    boolean selfIsRef;
+
+    CallExprMethodCall() { callIsMethodCall(this, qualifier, methodName, selfIsRef) }
 
-    CallExprMethodCall() { callIsMethodCall(this, qualifier, methodName) }
+    /**
+     * Holds if this call must have an explicit borrow for the `self` argument,
+     * because the corresponding parameter is `&self`. Explicit borrows are not
+     * needed when using method call syntax.
+     */
+    predicate hasExplicitSelfBorrow() { selfIsRef = true }
 
     override string getMethodName() { result = methodName }
 
-    override Trait getTrait() {
-      result = resolvePath(qualifier) and
-      // When the qualifier is `Self` and resolves to a trait, it's inside a
-      // trait method's default implementation. This is not a dispatch whose
-      // target is inferred from the type of the receiver, but should always
-      // resolve to the function in the trait block as path resolution does.
-      qualifier.toString() != "Self"
-    }
+    override Trait getTrait() { callHasTraitQualifier(this, result) }
 
     override predicate implicitBorrowAt(ArgumentPosition pos, boolean certain) { none() }
 

rust/ql/lib/codeql/rust/elements/internal/MethodCallExprImpl.qll

@@ -6,8 +6,6 @@
 
 private import rust
 private import codeql.rust.elements.internal.generated.MethodCallExpr
-private import codeql.rust.internal.PathResolution
-private import codeql.rust.internal.TypeInference
 
 /**
  * INTERNAL: This module contains the customizable definition of `MethodCallExpr` and should not
@@ -23,8 +21,6 @@ module Impl {
    * ```
    */
   class MethodCallExpr extends Generated::MethodCallExpr {
-    override Function getStaticTarget() { result = resolveMethodCallTarget(this) }
-
     private string toStringPart(int index) {
       index = 0 and
       result = this.getReceiver().toAbbreviatedString()

rust/ql/lib/codeql/rust/internal/Type.qll

@@ -425,6 +425,8 @@ final class TraitTypeAbstraction extends TypeAbstraction, Trait {
     result.(TypeParamTypeParameter).getTypeParam() = this.getGenericParamList().getATypeParam()
     or
     result.(AssociatedTypeTypeParameter).getTrait() = this
+    or
+    result.(SelfTypeParameter).getTrait() = this
   }
 }