Skip to content

Rust: Source and sink doc / tidy up#18977

Merged
geoffw0 merged 9 commits intogithub:mainfrom
geoffw0:sourcesinkdoc
Mar 13, 2025
Merged

Rust: Source and sink doc / tidy up#18977
geoffw0 merged 9 commits intogithub:mainfrom
geoffw0:sourcesinkdoc

Conversation

@geoffw0
Copy link
Copy Markdown
Contributor

@geoffw0 geoffw0 commented Mar 11, 2025

Source and sink tidy up:

  • first commit: add qldoc to FlowSource.qll and FlowSink.qll explaining what they are, what the related classes are, and how it all fits together.
  • second commit: add a QuerySink concept, a thin wrapper on DataFlow::Node that all Rust query sinks should extend now. This replaces the incomplete and easily forgotten getAQuerySinkKind in Stats.qll as a mechanism for finding all query sinks, e.g. for metric reporting.
  • third commit: add the weak sensitive data hashing sinks to QuerySink (they were missing from getAQuerySinkKind).

@geoffw0 geoffw0 added no-change-note-required This PR does not need a change note Rust Pull requests that update Rust code labels Mar 11, 2025
Copilot AI review requested due to automatic review settings March 11, 2025 15:51
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more

@geoffw0
Copy link
Copy Markdown
Contributor Author

geoffw0 commented Mar 11, 2025

DCA LGTM (some additional sinks are detected as a result of the third commit; performance is unchanged).

* v
* `sinkNode` predicate | other QL defined sinks, for example using concepts
* v v
* various `Sink` classes for specific data flow configurations <- extending `QuerySink`
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This QL doc does not render well in VS code. Consider using a code block, e.g.

 * ```
 * data from `*.model.yml` or QL extensions of `FlowSink::Range`
 *   v
 * `FlowSink` (associated with a models-as-data `kind` string)
 *   v
 * `sinkNode` predicate | other QL defined sinks, for example using concepts
 *   v
 * various `Sink` classes for specific data flow configurations <- extending `QuerySink`
 * ```

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, I wasn't aware this was actually rendered anywhere (it's rendered when mousing over an import, possibly other places).

Done.

* v
* `ActiveThreatModelSource` (just the enabled sources)
* v
* various `Source` classes for specific data flow configurations
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same about rendering

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also done.

@geoffw0
Copy link
Copy Markdown
Contributor Author

geoffw0 commented Mar 12, 2025

I've also added regular expression injection sinks to the sink metrics now, since that query was just merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-change-note-required This PR does not need a change note Rust Pull requests that update Rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants