Rust: More metrics for tracking taint.#18501
Conversation
geoffw0
added
no-change-note-required
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
Files not reviewed (7)
- rust/ql/src/queries/summary/CryptographicOperations.ql: Language not supported
- rust/ql/src/queries/summary/QuerySinkCounts.ql: Language not supported
- rust/ql/src/queries/summary/QuerySinks.ql: Language not supported
- rust/ql/src/queries/summary/Stats.qll: Language not supported
- rust/ql/src/queries/summary/SummaryStats.ql: Language not supported
- rust/ql/src/queries/summary/TaintReach.qll: Language not supported
- rust/ql/test/query-tests/diagnostics/SummaryStats.expected: Language not supported
Tip: Copilot code review supports C#, Go, Java, JavaScript, Markdown, Python, Ruby and TypeScript, with more languages coming soon. Learn more
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| private module TaintReachConfig implements DataFlow::ConfigSig { | ||
| predicate isSource(DataFlow::Node node) { node instanceof ActiveThreatModelSource } | ||
|
|
||
| predicate isSink(DataFlow::Node node) { any() } |
There was a problem hiding this comment.
This certainly looks like something that will not perform very well...
There was a problem hiding this comment.
Yes, though:
- we don't compute a path graph for this config.
- we never had any real issues with the same code in Swift.
- even on our largest database (
windows-rs) with a slightly warmed up cache, quick eval-inggetTaintReach()takes 2 seconds. With vast amounts of fake sources etc added to increase reach beyond what I think is ever plausible, 24s.
I'm guessing execution time is roughly linear in the number of nodes reached??? I'd be interested to hear your thoughts, concerns and suggestions - even if this means changing what we measure.
There was a problem hiding this comment.
OK, let's leave it as-is for now then.
Co-authored-by: Simon Friis Vindum <paldepind@github.com>
paldepind
left a comment
paldepind
left a comment
There was a problem hiding this comment.
Looks good to me. Really great to have these additional measures 👍
Add more metrics for tracking taint flow in Rust. Prior to this PR we have:
rust/summary/taint-sourcesandrust/summary/summary-statistics.rust/summary/sensitive-dataandrust/summary/summary-statistics.Which doesn't give us a very complete picture. This PR adds:
rust/summary/query-sinks,rust/summary/query-sink-countsandrust/summary/summary-statistics.rust/summary/cryptographic-operationsandrust/summary/summary-statistics.rust/summary/summary-statistics.rust/summary/summary-statistics.Most of these are soon to be added to our DCA runs (for catching regressions) and our metrics tracking page (to inform future work).
In the past people have raised performance concerns about taint reach, but I've never seen a problem in practice. DCA will confirm.