Rust: Implement basic support for blanket implementations

paldepind · paldepind · commit 2e98c2438b02 · 2025-08-02T15:10:23.000+02:00
diff --git a/rust/ql/lib/codeql/rust/internal/PathResolution.qll b/rust/ql/lib/codeql/rust/internal/PathResolution.qll
@@ -933,15 +933,36 @@ class TypeParamItemNode extends TypeItemNode instanceof TypeParam {
   }
 
   pragma[nomagic]
-  Path getABoundPath() {
-    exists(TypeBoundList tbl | result = tbl.getABound().getTypeRepr().(PathTypeRepr).getPath() |
-      tbl = super.getTypeBoundList()
+  TypeBound getBound(int index) {
+    result = super.getTypeBoundList().getBound(index)
+    or
+    exists(int offset |
+      offset = super.getTypeBoundList().getNumberOfBounds()
       or
-      tbl = this.getAWherePred().getTypeBoundList()
+      not super.hasTypeBoundList() and
+      offset = 0
+    |
+      result = this.getAWherePred().getTypeBoundList().getBound(index - offset)
     )
   }
 
   pragma[nomagic]
+  Path getBoundPath(int index) {
+    result = this.getBound(index).getTypeRepr().(PathTypeRepr).getPath()
+  }
+
+  Path getABoundPath() { result = this.getBoundPath(_) }
+
+  pragma[nomagic]
+  ItemNode resolveBound(int index) {
+    result =
+      rank[index + 1](int i, ItemNode item |
+        item = resolvePath(this.getBoundPath(i))
+      |
+        item order by i
+      )
+  }
+
   ItemNode resolveABound() { result = resolvePath(this.getABoundPath()) }
 
   /**
diff --git a/rust/ql/lib/codeql/rust/internal/TypeInference.qll b/rust/ql/lib/codeql/rust/internal/TypeInference.qll
@@ -1643,6 +1643,10 @@ private predicate methodCandidateTrait(Type type, Trait trait, string name, int
   methodCandidate(type, name, arity, impl)
 }
 
+/**
+ * Holds if `mc` has `rootType` as the root type of the reciever and the target
+ * method is named `name` and has arity `arity`
+ */
 pragma[nomagic]
 private predicate isMethodCall(MethodCall mc, Type rootType, string name, int arity) {
   rootType = mc.getTypeAt(TypePath::nil()) and
@@ -1841,6 +1845,140 @@ private predicate methodCallHasImplCandidate(MethodCall mc, Impl impl) {
   else any()
 }
 
+private module BlanketImplementation {
+  /**
+   * Holds if `impl` is a blanket implementation, that is, an implementation of a
+   * trait for a type parameter.
+   */
+  private TypeParamItemNode getBlanketImplementationTypeParam(Impl impl) {
+    result = impl.(ImplItemNode).resolveSelfTy() and
+    result = impl.getGenericParamList().getAGenericParam() and
+    not exists(impl.getAttributeMacroExpansion())
+  }
+
+  predicate isBlanketImplementation(Impl impl) { exists(getBlanketImplementationTypeParam(impl)) }
+
+  private Impl getPotentialDuplicated(string fileName, string traitName, int arity, string tpName) {
+    tpName = getBlanketImplementationTypeParam(result).getName() and
+    fileName = result.getLocation().getFile().getBaseName() and
+    traitName = result.(ImplItemNode).resolveTraitTy().getName() and
+    arity = result.(ImplItemNode).resolveTraitTy().(Trait).getNumberOfGenericParams()
+  }
+
+  /**
+   * Holds if `impl1` and `impl2` are duplicates and `impl2` is more "canonical"
+   * than `impl1`.
+   */
+  predicate duplicatedImpl(Impl impl1, Impl impl2) {
+    exists(string fileName, string traitName, int arity, string tpName |
+      impl1 = getPotentialDuplicated(fileName, traitName, arity, tpName) and
+      impl2 = getPotentialDuplicated(fileName, traitName, arity, tpName) and
+      impl1.getLocation().getFile().getAbsolutePath() <
+        impl2.getLocation().getFile().getAbsolutePath()
+    )
+  }
+
+  predicate hasNoDuplicates(Impl impl) {
+    not duplicatedImpl(impl, _) and isBlanketImplementation(impl)
+  }
+
+  /**
+   * We currently consider blanket implementations to be in scope "globally",
+   * even though they actually need to be imported to be used. One downside of
+   * this is that the libraries included in the database can often occur several
+   * times for different library versions. This causes the same blanket
+   * implementations to exist multiple times, and these add no useful
+   * information.
+   *
+   * We detect these duplicates based on some files heuristic (same trait name,
+   * file name, etc.). For these duplicates we select the one with the greatest
+   * file name (which usually is also the one with the greatest library version
+   * in the path)
+   */
+  Impl getCanonicalImpl(Impl impl) {
+    result =
+      max(Impl impl0, Location l |
+        duplicatedImpl(impl, impl0) and l = impl0.getLocation()
+      |
+        impl0 order by l.getFile().getAbsolutePath(), l.getStartLine()
+      )
+    or
+    hasNoDuplicates(impl) and result = impl
+  }
+
+  predicate isCanonicalBlanketImplementation(Impl impl) { impl = getCanonicalImpl(impl) }
+
+  /**
+   * Holds if `impl` is a blanket implementation for a type parameter and the type
+   * parameter must implement `trait`.
+   */
+  private predicate blanketImplementationTraitBound(Impl impl, Trait t) {
+    t =
+      rank[1](Trait trait, int i |
+        trait = getBlanketImplementationTypeParam(impl).resolveBound(i) and
+        // Exclude traits that are "trivial" in the sense that they are known to
+        // not narrow things down very much.
+        not trait.getName().getText() =
+          [
+            "Sized", "Clone", "Fn", "FnOnce", "FnMut",
+            // The auto traits
+            "Send", "Sync", "Unpin", "UnwindSafe", "RefUnwindSafe"
+          ]
+      |
+        trait order by i
+      )
+  }
+
+  private predicate blanketImplementationMethod(
+    Impl impl, Trait trait, string name, int arity, Function f
+  ) {
+    isCanonicalBlanketImplementation(impl) and
+    blanketImplementationTraitBound(impl, trait) and
+    f.getParamList().hasSelfParam() and
+    arity = f.getParamList().getNumberOfParams() and
+    // Make this stronger and document
+    (
+      f = impl.(ImplItemNode).getAssocItem(name)
+      or
+      f = impl.(ImplItemNode).resolveTraitTy().getAssocItem(name) and
+      not f = impl.(ImplItemNode).getAssocItem(name)
+    ) and
+    not getBlanketImplementationTypeParam(impl).resolveABound().(TraitItemNode).getASuccessor(name) =
+      f
+  }
+
+  predicate methodCallMatchesBlanketImpl(MethodCall mc, Type t, Impl impl, Trait trait, Function f) {
+    // Only check method calls where we have ruled out inherent method targets.
+    // Ideally we would also check if non-blanket method targets have been ruled
+    // out.
+    methodCallHasNoInherentTarget(mc) and
+    exists(string name, int arity |
+      isMethodCall(mc, t, name, arity) and
+      blanketImplementationMethod(impl, trait, name, arity, f)
+    )
+  }
+
+  module SatisfiesConstraintInput implements SatisfiesConstraintInputSig<MethodCall> {
+    pragma[nomagic]
+    predicate relevantConstraint(MethodCall mc, Type constraint) {
+      methodCallMatchesBlanketImpl(mc, _, _, constraint.(TraitType).getTrait(), _)
+    }
+
+    predicate useUniversalConditions() { none() }
+  }
+
+  predicate getBlanketImpl(MethodCall mc, Type t, Impl impl, Trait trait, Function f) {
+    SatisfiesConstraint<MethodCall, SatisfiesConstraintInput>::satisfiesConstraintType(mc,
+      TTrait(trait), _, _) and
+    methodCallMatchesBlanketImpl(mc, t, impl, trait, f)
+  }
+
+  pragma[nomagic]
+  Function getMethodFromBlanketImpl(MethodCall mc) {
+    BlanketImplementation::getBlanketImpl(mc, _, _, _, result)
+  }
+}
+
 /** Gets a method from an `impl` block that matches the method call `mc`. */
 pragma[nomagic]
 private Function getMethodFromImpl(MethodCall mc) {
@@ -1876,6 +2014,8 @@ private Function resolveMethodCallTarget(MethodCall mc) {
   // The method comes from an `impl` block targeting the type of the receiver.
   result = getMethodFromImpl(mc)
   or
+  result = BlanketImplementation::getMethodFromBlanketImpl(mc)
+  or
   // The type of the receiver is a type parameter and the method comes from a
   // trait bound on the type parameter.
   result = getTypeParameterMethod(mc.getTypeAt(TypePath::nil()), mc.getMethodName())
diff --git a/rust/ql/test/library-tests/type-inference/blanket_impl.rs b/rust/ql/test/library-tests/type-inference/blanket_impl.rs
@@ -32,7 +32,7 @@ mod basic_blanket_impl {
     pub fn test_basic_blanket() {
         let x = S1.clone1(); // $ target=S1::clone1
         println!("{x:?}");
-        let y = S1.duplicate(); // $ MISSING: target=Clone1duplicate
+        let y = S1.duplicate(); // $ target=Clone1duplicate SPURIOUS: target=duplicate
         println!("{y:?}");
     }
 }
@@ -108,7 +108,7 @@ mod extension_trait_blanket_impl {
 
     fn test() {
         let my_try_flag = MyTryFlag { flag: true };
-        let result = my_try_flag.try_read_flag_twice(); // $ MISSING: target=TryFlagExt::try_read_flag_twice
+        let result = my_try_flag.try_read_flag_twice(); // $ target=TryFlagExt::try_read_flag_twice
 
         let my_flag = MyFlag { flag: true };
         // Here `TryFlagExt::try_read_flag_twice` is since there is a blanket
diff --git a/rust/ql/test/library-tests/type-inference/dyn_type.rs b/rust/ql/test/library-tests/type-inference/dyn_type.rs
@@ -101,7 +101,7 @@ fn test_assoc_type(obj: &dyn AssocTrait<i64, AP = bool>) {
 pub fn test() {
     test_basic_dyn_trait(&MyStruct { value: 42 }); // $ target=test_basic_dyn_trait
     test_generic_dyn_trait(&GenStruct {
-        value: "".to_string(),
+        value: "".to_string(), // $ target=to_string
     }); // $ target=test_generic_dyn_trait
     test_poly_dyn_trait(); // $ target=test_poly_dyn_trait
     test_assoc_type(&GenStruct { value: 100 }); // $ target=test_assoc_type
diff --git a/rust/ql/test/library-tests/type-inference/main.rs b/rust/ql/test/library-tests/type-inference/main.rs
@@ -316,7 +316,7 @@ mod method_non_parametric_trait_impl {
 
     fn type_bound_type_parameter_impl<TP: MyTrait<S1>>(thing: TP) -> S1 {
         // The trait bound on `TP` makes the implementation of `ConvertTo` valid
-        thing.convert_to() // $ MISSING: target=T::convert_to
+        thing.convert_to() // $ target=T::convert_to SPURIOUS: target=ConvertTo::convert_to
     }
 
     pub fn f() {
@@ -388,7 +388,7 @@ mod method_non_parametric_trait_impl {
         let x = get_snd_fst(c); // $ type=x:S1 target=get_snd_fst
 
         let thing = MyThing { a: S1 };
-        let i = thing.convert_to(); // $ MISSING: type=i:S1 target=T::convert_to
+        let i = thing.convert_to(); // $ type=i:S1 target=T::convert_to target=ConvertTo::convert_to
         let j = convert_to(thing); // $ type=j:S1 target=convert_to
     }
 }
@@ -1292,7 +1292,7 @@ mod method_call_type_conversion {
         let t = x7.m1(); // $ target=m1 type=t:& type=t:&T.S2
         println!("{:?}", x7);
 
-        let x9: String = "Hello".to_string(); // $ type=x9:String
+        let x9: String = "Hello".to_string(); // $ type=x9:String target=to_string
 
         // Implicit `String` -> `str` conversion happens via the `Deref` trait:
         // https://doc.rust-lang.org/std/string/struct.String.html#deref.
diff --git a/rust/ql/test/library-tests/type-inference/type-inference.expected b/rust/ql/test/library-tests/type-inference/type-inference.expected
@@ -23,11 +23,14 @@ inferType
 | blanket_impl.rs:34:18:34:24 | FormatArgsExpr |  | {EXTERNAL LOCATION} | Arguments |
 | blanket_impl.rs:34:18:34:24 | MacroExpr |  | {EXTERNAL LOCATION} | Arguments |
 | blanket_impl.rs:34:20:34:20 | x |  | blanket_impl.rs:4:5:5:14 | S1 |
+| blanket_impl.rs:35:13:35:13 | y |  | blanket_impl.rs:4:5:5:14 | S1 |
 | blanket_impl.rs:35:17:35:18 | S1 |  | blanket_impl.rs:4:5:5:14 | S1 |
+| blanket_impl.rs:35:17:35:30 | S1.duplicate() |  | blanket_impl.rs:4:5:5:14 | S1 |
 | blanket_impl.rs:36:18:36:24 | "{y:?}\\n" |  | file://:0:0:0:0 | & |
 | blanket_impl.rs:36:18:36:24 | "{y:?}\\n" | &T | {EXTERNAL LOCATION} | str |
 | blanket_impl.rs:36:18:36:24 | FormatArgsExpr |  | {EXTERNAL LOCATION} | Arguments |
 | blanket_impl.rs:36:18:36:24 | MacroExpr |  | {EXTERNAL LOCATION} | Arguments |
+| blanket_impl.rs:36:20:36:20 | y |  | blanket_impl.rs:4:5:5:14 | S1 |
 | blanket_impl.rs:46:22:46:26 | SelfParam |  | file://:0:0:0:0 | & |
 | blanket_impl.rs:46:22:46:26 | SelfParam | &T | blanket_impl.rs:45:5:47:5 | Self [trait Flag] |
 | blanket_impl.rs:50:26:50:30 | SelfParam |  | file://:0:0:0:0 | & |
@@ -78,7 +81,11 @@ inferType
 | blanket_impl.rs:110:13:110:23 | my_try_flag |  | blanket_impl.rs:76:5:78:5 | MyTryFlag |
 | blanket_impl.rs:110:27:110:50 | MyTryFlag {...} |  | blanket_impl.rs:76:5:78:5 | MyTryFlag |
 | blanket_impl.rs:110:45:110:48 | true |  | {EXTERNAL LOCATION} | bool |
+| blanket_impl.rs:111:13:111:18 | result |  | {EXTERNAL LOCATION} | Option |
+| blanket_impl.rs:111:13:111:18 | result | T | {EXTERNAL LOCATION} | bool |
 | blanket_impl.rs:111:22:111:32 | my_try_flag |  | blanket_impl.rs:76:5:78:5 | MyTryFlag |
+| blanket_impl.rs:111:22:111:54 | my_try_flag.try_read_flag_twice() |  | {EXTERNAL LOCATION} | Option |
+| blanket_impl.rs:111:22:111:54 | my_try_flag.try_read_flag_twice() | T | {EXTERNAL LOCATION} | bool |
 | blanket_impl.rs:113:13:113:19 | my_flag |  | blanket_impl.rs:87:5:89:5 | MyFlag |
 | blanket_impl.rs:113:23:113:43 | MyFlag {...} |  | blanket_impl.rs:87:5:89:5 | MyFlag |
 | blanket_impl.rs:113:38:113:41 | true |  | {EXTERNAL LOCATION} | bool |
@@ -649,12 +656,15 @@ inferType
 | dyn_type.rs:103:28:105:5 | &... |  | file://:0:0:0:0 | & |
 | dyn_type.rs:103:28:105:5 | &... | &T | dyn_type.rs:10:1:13:1 | dyn GenericGet |
 | dyn_type.rs:103:28:105:5 | &... | &T | dyn_type.rs:33:1:36:1 | GenStruct |
+| dyn_type.rs:103:28:105:5 | &... | &T.A | {EXTERNAL LOCATION} | String |
 | dyn_type.rs:103:28:105:5 | &... | &T.dyn(A) | {EXTERNAL LOCATION} | String |
 | dyn_type.rs:103:29:105:5 | GenStruct {...} |  | dyn_type.rs:10:1:13:1 | dyn GenericGet |
 | dyn_type.rs:103:29:105:5 | GenStruct {...} |  | dyn_type.rs:33:1:36:1 | GenStruct |
+| dyn_type.rs:103:29:105:5 | GenStruct {...} | A | {EXTERNAL LOCATION} | String |
 | dyn_type.rs:103:29:105:5 | GenStruct {...} | dyn(A) | {EXTERNAL LOCATION} | String |
 | dyn_type.rs:104:16:104:17 | "" |  | file://:0:0:0:0 | & |
 | dyn_type.rs:104:16:104:17 | "" | &T | {EXTERNAL LOCATION} | str |
+| dyn_type.rs:104:16:104:29 | "".to_string() |  | {EXTERNAL LOCATION} | String |
 | dyn_type.rs:107:21:107:45 | &... |  | file://:0:0:0:0 | & |
 | dyn_type.rs:107:21:107:45 | &... | &T | dyn_type.rs:15:1:19:1 | dyn AssocTrait |
 | dyn_type.rs:107:21:107:45 | &... | &T | dyn_type.rs:33:1:36:1 | GenStruct |
@@ -1267,8 +1277,10 @@ inferType
 | main.rs:390:21:390:37 | MyThing {...} |  | main.rs:175:5:178:5 | MyThing |
 | main.rs:390:21:390:37 | MyThing {...} | A | main.rs:186:5:187:14 | S1 |
 | main.rs:390:34:390:35 | S1 |  | main.rs:186:5:187:14 | S1 |
+| main.rs:391:13:391:13 | i |  | main.rs:186:5:187:14 | S1 |
 | main.rs:391:17:391:21 | thing |  | main.rs:175:5:178:5 | MyThing |
 | main.rs:391:17:391:21 | thing | A | main.rs:186:5:187:14 | S1 |
+| main.rs:391:17:391:34 | thing.convert_to() |  | main.rs:186:5:187:14 | S1 |
 | main.rs:392:13:392:13 | j |  | main.rs:186:5:187:14 | S1 |
 | main.rs:392:17:392:33 | convert_to(...) |  | main.rs:186:5:187:14 | S1 |
 | main.rs:392:28:392:32 | thing |  | main.rs:175:5:178:5 | MyThing |
@@ -3168,14 +3180,22 @@ inferType
 | main.rs:1622:13:1625:13 | Vec2 {...} |  | main.rs:1502:5:1507:5 | Vec2 |
 | main.rs:1623:20:1623:23 | self |  | main.rs:1502:5:1507:5 | Vec2 |
 | main.rs:1623:20:1623:25 | self.x |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1623:20:1623:33 | ... \| ... |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1623:20:1623:33 | ... \| ... |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1623:20:1623:33 | ... \| ... | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1623:29:1623:31 | rhs |  | main.rs:1502:5:1507:5 | Vec2 |
+| main.rs:1623:29:1623:33 | rhs.x |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1623:29:1623:33 | rhs.x |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1623:29:1623:33 | rhs.x | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1624:20:1624:23 | self |  | main.rs:1502:5:1507:5 | Vec2 |
 | main.rs:1624:20:1624:25 | self.y |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1624:20:1624:33 | ... \| ... |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1624:20:1624:33 | ... \| ... |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1624:20:1624:33 | ... \| ... | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1624:29:1624:31 | rhs |  | main.rs:1502:5:1507:5 | Vec2 |
+| main.rs:1624:29:1624:33 | rhs.y |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1624:29:1624:33 | rhs.y |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1624:29:1624:33 | rhs.y | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1630:25:1630:33 | SelfParam |  | file://:0:0:0:0 | & |
 | main.rs:1630:25:1630:33 | SelfParam | &T | main.rs:1502:5:1507:5 | Vec2 |
 | main.rs:1630:36:1630:38 | rhs |  | main.rs:1502:5:1507:5 | Vec2 |
@@ -3513,10 +3533,16 @@ inferType
 | main.rs:1773:26:1773:30 | 33i64 |  | {EXTERNAL LOCATION} | i64 |
 | main.rs:1773:26:1773:38 | ... & ... |  | {EXTERNAL LOCATION} | i64 |
 | main.rs:1773:34:1773:38 | 34i64 |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1774:13:1774:21 | i64_bitor |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1774:13:1774:21 | i64_bitor |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1774:13:1774:21 | i64_bitor | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1774:25:1774:29 | 35i64 |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1774:25:1774:37 | ... \| ... |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1774:25:1774:37 | ... \| ... |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1774:25:1774:37 | ... \| ... | T | {EXTERNAL LOCATION} | i64 |
+| main.rs:1774:33:1774:37 | 36i64 |  | {EXTERNAL LOCATION} | NonZero |
 | main.rs:1774:33:1774:37 | 36i64 |  | {EXTERNAL LOCATION} | i64 |
+| main.rs:1774:33:1774:37 | 36i64 | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:1775:13:1775:22 | i64_bitxor |  | {EXTERNAL LOCATION} | i64 |
 | main.rs:1775:26:1775:30 | 37i64 |  | {EXTERNAL LOCATION} | i64 |
 | main.rs:1775:26:1775:38 | ... ^ ... |  | {EXTERNAL LOCATION} | i64 |
diff --git a/shared/typeinference/codeql/typeinference/internal/TypeInference.qll b/shared/typeinference/codeql/typeinference/internal/TypeInference.qll
@@ -903,6 +903,8 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
     signature module SatisfiesConstraintInputSig<HasTypeTreeSig HasTypeTree> {
       /** Holds if it is relevant to know if `term` satisfies `constraint`. */
       predicate relevantConstraint(HasTypeTree term, Type constraint);
+
+      default predicate useUniversalConditions() { any() }
     }
 
     module SatisfiesConstraint<
@@ -944,6 +946,7 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
           not exists(countConstraintImplementations(type, constraint)) and
           conditionSatisfiesConstraintTypeAt(abs, sub, constraintMention, _, _) and
           resolveTypeMentionRoot(sub) = abs.getATypeParameter() and
+          useUniversalConditions() and
           constraint = resolveTypeMentionRoot(constraintMention)
           or
           countConstraintImplementations(type, constraint) > 0 and
