Skip to content

Rust: Add sinks for tracing #22341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
geoffw0 wants to merge 19 commits into
base: main
Choose a base branch
from
+863 −475
Open

Rust: Add sinks for tracing #22341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
55364c0
Rust: Test more logging variants.
geoffw0 Aug 13, 2026
683fc46
Rust: Add QL sink models for the "tracing" crate.
geoffw0 Aug 13, 2026
d8c4e46
Rust: Change note.
geoffw0 Aug 13, 2026
95b210c
Rust: Extend the new sinks to cover rust/log-injection as well.
geoffw0 Aug 13, 2026
6d1b158
Rust: Add tracing to supported frameworks.
geoffw0 Aug 13, 2026
7f6ceb3
Rust: Add a few test cases for log injection as well.
geoffw0 Aug 13, 2026
a3358e4
Rust: Accept consistency test changes. There's a bit of noise here.
geoffw0 Aug 13, 2026
5274582
Rust: Add a few more test cases.
geoffw0 Aug 26, 2026
2ed53db
Rust: Limit sinks to the inner tracing macros, not wrappers as well.
geoffw0 Aug 26, 2026
d0126bf
Rust: Limit sinks within the tracing macros.
geoffw0 Aug 26, 2026
f645980
Merge branch 'main' into logsinks
geoffw0 Sep 8, 2026
10dd057
Rust: Update consistency test .expected files.
geoffw0 Sep 8, 2026
a05563e
Rust: Make the tracing macro sinks slightly more robust.
geoffw0 Sep 23, 2026
0317872
Rust: Block flow past sources / sinks in the two queries that use log…
geoffw0 Sep 23, 2026
83c305f
Merge branch 'main' into logsinks
geoffw0 Nov 11, 2026
7fc51cf
Rust: Narrow the new sink definition (mostly AI solution).
geoffw0 Nov 11, 2026
42c75f3
Rust: Simplify a little.
geoffw0 Nov 11, 2026
1de22c5
Rust: Update further test expectations.
geoffw0 Nov 12, 2026
b34d3de
Rust: More test expectations.
geoffw0 Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/codeql/reusables/supported-frameworks.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,6 +361,7 @@ and the CodeQL library pack ``codeql/rust-all`` (`changelog <https://github.com/
`sqlx <https://crates.io/crates/sqlx>`__, Database
`tokio <https://crates.io/crates/tokio>`__, Asynchronous IO
`tokio-postgres <https://crates.io/crates/tokio-postgres>`__, Database
`tracing <https://crates.io/crates/tracing>`__, Logging library
`url <https://crates.io/crates/url>`__, Utility library
`warp <https://crates.io/crates/warp>`__, Web framework

Expand Down
6 changes: 6 additions & 0 deletions rust/ql/lib/codeql/rust/security/CleartextLoggingExtensions.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ private import codeql.rust.dataflow.FlowSink
private import codeql.rust.security.SensitiveData
private import codeql.rust.Concepts
private import codeql.rust.security.Barriers as Barriers
private import codeql.rust.security.LogInjectionExtensions

/**
* Provides default sources, sinks and barriers for detecting cleartext logging
Expand Down Expand Up @@ -45,6 +46,11 @@ module CleartextLogging {
ModelsAsDataSink() { sinkNode(this, "log-injection") }
}

/**
* A sink for the logging macros of the `tracing` crate.
*/
private class TracingMacroSink extends Sink instanceof LogInjection::TracingMacroSink { }

/**
* A barrier for logging from model data.
*/
Expand Down
35 changes: 35 additions & 0 deletions rust/ql/lib/codeql/rust/security/LogInjectionExtensions.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,41 @@ module LogInjection {
ModelsAsDataSink() { sinkNode(this, "log-injection") }
}

/**
* A sink for the logging macros of the `tracing` crate, such as
* `tracing::info!`.
*/
class TracingMacroSink extends Sink {
Comment thread
geoffw0 marked this conversation as resolved.
Resolved
TracingMacroSink() {
exists(Crate c, MacroRules m, MacroExpr valueSet, Call consumer |
// `m` is `tracing::valueset_all`
c.getName() = "tracing" and
m.getName().getText() = "valueset_all" and
m.getLocation().getFile() = c.getASourceFile().getFile() and
// `this` is within the expansion of a call to `tracing::valueset_all`
valueSet.getMacroCall().resolveMacro() = m and
this.asExpr().getParentNode+() = valueSet.getMacroCall() and
// limit the consumer to relevant calls
(
not exists(consumer.getResolvedTarget()) and
consumer.getPositionalArgument(0) = valueSet
or
consumer.getResolvedTarget().getCanonicalPath() =
["<tracing::span::Span>::new", "<tracing::span::Span>::child_of"] and
valueSet.getParentNode*() = consumer.getAnArgument()
) and
// limit sinks to places that may have to do with producing the log message
(
this.asExpr().getParentNode() instanceof FormatArgsArg
or
this.asExpr().getParentNode() instanceof FormatArgsExpr
or
exists(ArgList al | al.getAnArg() = this.asExpr().getParentNode())
)
)
}
}

/**
* A barrier for log-injection from model data.
*/
Expand Down
4 changes: 4 additions & 0 deletions rust/ql/src/change-notes/2026-08-13-cleartext-logging.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added cleartext logging flow sink models for the "tracing" crate. This may cause additional results to be found for the "Cleartext logging of sensitive information" (`rust/cleartext-logging`) and "Log injection" (`rust/log-injection`) queries.
10 changes: 10 additions & 0 deletions rust/ql/src/queries/security/CWE-117/LogInjection.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,16 @@ module LogInjectionConfig implements DataFlow::ConfigSig {

predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }

predicate isBarrierIn(DataFlow::Node node) {
// make sources barriers so that we only report the closest instance
isSource(node)
}

predicate isBarrierOut(DataFlow::Node node) {
// make sinks barriers so that we only report the closest instance
isSink(node)
}

predicate observeDiffInformedIncrementalMode() { any() }
}

Expand Down
5 changes: 5 additions & 0 deletions rust/ql/src/queries/security/CWE-312/CleartextLogging.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,11 @@ module CleartextLoggingConfig implements DataFlow::ConfigSig {
isSource(node)
}

predicate isBarrierOut(DataFlow::Node node) {
// make sinks barriers so that we only report the closest instance
isSink(node)
}

predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
// flow from `a` to `&a`
node2.asExpr().(RefExpr).getExpr() = node1.asExpr()
Expand Down
57 changes: 56 additions & 1 deletion rust/ql/test/query-tests/security/CWE-117/CONSISTENCY/PathResolutionConsistency.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,57 @@
multipleResolvedTargets
| main.rs:123:28:123:48 | ...::from(...) |
| main.rs:135:28:135:48 | ...::from(...) |
multiplePathResolutions
| main.rs:123:9:123:22 | ...::__macro_support |
| main.rs:123:9:123:22 | ...::__macro_support |
| main.rs:123:9:123:22 | ...::__macro_support |
| main.rs:123:9:123:22 | ...::__macro_support |
| main.rs:123:9:123:22 | ...::__macro_support |
| main.rs:123:9:123:22 | ...::field |
| main.rs:124:9:124:22 | ...::__macro_support |
| main.rs:124:9:124:22 | ...::__macro_support |
| main.rs:124:9:124:22 | ...::__macro_support |
| main.rs:124:9:124:22 | ...::__macro_support |
| main.rs:124:9:124:22 | ...::__macro_support |
| main.rs:124:9:124:22 | ...::field |
| main.rs:125:9:125:23 | ...::__macro_support |
| main.rs:125:9:125:23 | ...::__macro_support |
| main.rs:125:9:125:23 | ...::__macro_support |
| main.rs:125:9:125:23 | ...::__macro_support |
| main.rs:125:9:125:23 | ...::__macro_support |
| main.rs:125:9:125:23 | ...::field |
| main.rs:126:9:126:23 | ...::__macro_support |
| main.rs:126:9:126:23 | ...::__macro_support |
| main.rs:126:9:126:23 | ...::__macro_support |
| main.rs:126:9:126:23 | ...::__macro_support |
| main.rs:126:9:126:23 | ...::__macro_support |
| main.rs:126:9:126:23 | ...::field |
| main.rs:127:9:127:23 | ...::__macro_support |
| main.rs:127:9:127:23 | ...::__macro_support |
| main.rs:127:9:127:23 | ...::__macro_support |
| main.rs:127:9:127:23 | ...::__macro_support |
| main.rs:127:9:127:23 | ...::__macro_support |
| main.rs:127:9:127:23 | ...::field |
| main.rs:128:9:128:23 | ...::__macro_support |
| main.rs:128:9:128:23 | ...::__macro_support |
| main.rs:128:9:128:23 | ...::__macro_support |
| main.rs:128:9:128:23 | ...::__macro_support |
| main.rs:128:9:128:23 | ...::__macro_support |
| main.rs:128:9:128:23 | ...::field |
| main.rs:129:9:129:23 | ...::__macro_support |
| main.rs:129:9:129:23 | ...::__macro_support |
| main.rs:129:9:129:23 | ...::__macro_support |
| main.rs:129:9:129:23 | ...::__macro_support |
| main.rs:129:9:129:23 | ...::__macro_support |
| main.rs:129:9:129:23 | ...::field |
| main.rs:130:9:130:22 | ...::__macro_support |
| main.rs:130:9:130:22 | ...::__macro_support |
| main.rs:130:9:130:22 | ...::__macro_support |
| main.rs:130:9:130:22 | ...::__macro_support |
| main.rs:130:9:130:22 | ...::__macro_support |
| main.rs:130:9:130:22 | ...::field |
| main.rs:131:9:131:28 | ...::__macro_support |
| main.rs:131:9:131:28 | ...::__macro_support |
| main.rs:131:9:131:28 | ...::__macro_support |
| main.rs:131:9:131:28 | ...::__macro_support |
| main.rs:131:9:131:28 | ...::__macro_support |
| main.rs:131:9:131:28 | ...::field |
Empty file added rust/ql/test/query-tests/security/CWE-117/CONSISTENCY/VariableCaptureConsistency.expected
View file
Open in desktop
Empty file.
9 changes: 5 additions & 4 deletions rust/ql/test/query-tests/security/CWE-117/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading