Sitelet https://github.com/github/codeql/pull/23126
Skip to content

Rust: Prevent MaD suppression for heuristic call-back summary - #23126

Draft
hvitved wants to merge 2 commits into
github:mainfrom
hvitved:rust/call-back-summary-no-suppress
Draft

hvitved wants to merge 2 commits into
github:mainfrom
hvitved:rust/call-back-summary-no-suppress

Conversation

@hvitved

@hvitved hvitved commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@hvitved
hvitved requested a max review from Copilot November 13, 2026 13:00
@hvitved
hvitved force-pushed the rust/call-back-summary-no-suppress branch from 80e2945 to 9fae106 Compare November 13, 2026 13:12
@github-actions github-actions Bot added the Rust Pull requests that update Rust code label Nov 13, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

An existing local dataflow test retains stale expectations that will cause failures, and the new regression does not cover captured-value flow through the closure-self heuristic.

2 open issues
What changed in this PR

This PR prevents Rust CodeQL’s heuristic callback summaries and models-as-data summaries from suppressing each other, preserving valid data-flow paths.

Changes:

  • Reuse existing summary provenance and exactness for heuristic callback models, retaining defaults when no summary exists.
  • Add array-iterator regression cases and update generated flow expectations.
File Description
rust/​ql/​test/​library-tests/​dataflow/​collections/​main.rs Adds value-flow cases for for_each and iterator loops.
rust/​ql/​test/​library-tests/​dataflow/​collections/​inline-flow.expected Records new iterator flows and updated model identifiers.
rust/​ql/​lib/​codeql/​rust/​dataflow/​internal/​ModelsAsData.qll Extracts summary lookup and aligns callback-model provenance and exactness.

Review effort: Max

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Rust Pull requests that update Rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants