Rust: Model [T;n] -> [T] unsized coercions as implicit derefs - #22432
Merged
Merged
Conversation
hvitved
force-pushed
the
rust/array-slice-unsized-coercion
branch
from
August 26, 2026 13:51
fe1b663 to
93e96e8
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
hvitved
force-pushed
the
rust/array-slice-unsized-coercion
branch
from
August 27, 2026 08:53
93e96e8 to
1df2578
Compare
hvitved
changed the title
[T;n] -> [T] unsized coercion in type inference[T;n] -> [T] unsized coercions as implicit derefs
hvitved
force-pushed
the
rust/array-slice-unsized-coercion
branch
2 times, most recently
from
September 16, 2026 18:40
4fe48a8 to
eaef972
Compare
hvitved
force-pushed
the
rust/array-slice-unsized-coercion
branch
from
September 18, 2026 13:10
eaef972 to
1f8b466
Compare
hvitved
marked this pull request as ready for review
September 21, 2026 11:23
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Mutable slice iteration still lacks an element-flow summary, leaving array iter_mut flows unresolved.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Models Rust array-to-slice coercion through implicit dereferencing, improving call resolution and data flow.
Changes:
- Adds a pseudo
Derefimplementation for arrays. - Adds array/slice flow summaries.
- Updates type-inference, data-flow, and security tests.
| File | Description |
|---|---|
rust/tools/builtins/types.rs |
Defines the pseudo array dereference. |
rust/ql/lib/codeql/rust/frameworks/stdlib/core.model.yml |
Adds dereference and slice iteration summaries. |
rust/ql/test/library-tests/type-inference/main.rs |
Tests newly resolved slice methods. |
rust/ql/test/library-tests/type-inference/type-inference.expected |
Updates generated inference results. |
rust/ql/test/library-tests/dataflow/local/main.rs |
Adds expected array iteration flows. |
rust/ql/test/library-tests/dataflow/local/inline-flow.expected |
Updates generated flow results. |
rust/ql/test/library-tests/dataflow/local/DataFlowStep.expected |
Updates generated flow steps. |
rust/ql/test/query-tests/security/CWE-078/main.rs |
Removes resolved false-positive annotations. |
rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected |
Updates generated security-query results. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
paldepind
reviewed
Sep 21, 2026
paldepind
left a comment
paldepind
left a comment
Contributor
There was a problem hiding this comment.
One question + Copilot has a comment that seems reasonable.
| - ["<&mut as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue", "value", "manual"] | ||
| - ["<core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue.Reference", "taint", "manual"] | ||
| # for the pseudo implementation in `builtins/types.rs` | ||
| - ["<[;] as core::ops::deref::Deref>::deref", "Argument[self].Reference", "ReturnValue.Reference", "value", "manual"] |
Contributor
There was a problem hiding this comment.
Might not work/be worth it, but could we have let the body of the pseudo implementation be &self and have gotten this for free?
Contributor
Author
There was a problem hiding this comment.
We do not generate CFGs for functions not in source, so that will not work.
paldepind
previously approved these changes
Sep 21, 2026
paldepind
approved these changes
Sep 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR models array to slice unsized coercions as if they were implemented using
Deref. The reason for doing it like this is that the type inference library (and data flow library) is already able to handle implicit calls toDeref::deref.DCA looks good: a small improvement to number of resolved calls and, as a result, a few more alerts.