Merge pull request #22871 from LucaCappelletti94/upstream/rust-memory-queue-logging

Rust: Add neutral models for spurious Vec and VecDeque sink models

Author: geoffw0

rust/ql/lib/change-notes/2026-10-22-neutral-models-vec-vecdeque.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added neutral models to inhibit spurious generated sink models for `Vec` and `VecDeque` methods such as `insert`, `remove` and `push_back`. This fixes some false positive results from queries such as `rust/cleartext-logging`.

rust/ql/lib/codeql/rust/frameworks/stdlib/alloc.model.yml

@@ -70,3 +70,29 @@ extensions:
       - ["<alloc::rc::Rc as core::convert::From>::from", "sink", "manual"]
       - ["<alloc::string::String>::split_off", "sink", "manual"]
       - ["<alloc::vec::Vec>::split_off", "sink", "manual"]
+      - ["<alloc::vec::Vec>::insert", "sink", "manual"]
+      - ["<alloc::vec::Vec>::insert_mut", "sink", "manual"]
+      - ["<alloc::vec::Vec>::remove", "sink", "manual"]
+      - ["<alloc::vec::Vec>::swap_remove", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as alloc::collections::vec_deque::spec_extend::SpecExtend>::spec_extend", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as core::iter::traits::collect::Extend>::extend_one", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as core::iter::traits::collect::Extend>::extend_reserve", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as std::io::Write>::write_all_vectored", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as std::io::Write>::write_vectored", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::append", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::insert", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::insert_mut", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::make_contiguous", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::push_back", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::push_back_mut", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::push_front", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::push_front_mut", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::remove", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::reserve", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::reserve_exact", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::rotate_left", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::rotate_right", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::shrink_to", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::shrink_to_fit", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::try_reserve", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::try_reserve_exact", "sink", "manual"]

rust/ql/test/query-tests/security/CWE-312/test_logging.rs

@@ -251,6 +251,26 @@ fn test_std(password: String, i: i32, opt_i: Option<i32>) {
     err.write(format!("message = {}\n", password).as_bytes()); // $ Alert[rust/cleartext-logging]
 }
 
+fn test_collections(harmless: String) {
+    // collection operations are not logging
+    let mut passwords = Vec::new();
+    passwords.insert(0, harmless.clone());
+    passwords.insert(1, harmless.clone());
+    _ = passwords.remove(1);
+    _ = passwords.swap_remove(0);
+
+    let mut password_queue = std::collections::VecDeque::new();
+    password_queue.push_back(harmless.clone());
+    password_queue.push_front(harmless.clone());
+    password_queue.insert(1, harmless.clone());
+    password_queue.append(&mut std::collections::VecDeque::from([harmless]));
+    password_queue.reserve(1);
+    password_queue.rotate_left(1);
+    password_queue.shrink_to(1);
+    _ = password_queue.remove(1);
+    password_queue.make_contiguous();
+}
+
 fn main() {
     simple_logger::SimpleLogger::new().init().unwrap();
 
@@ -260,4 +280,5 @@ fn main() {
         "[encrypted]".to_string(),
     );
     test_std("123456".to_string(), 0, None);
+    test_collections("harmless".to_string());
 }