Add AlertSuppression.ql for Rust (inline // codeql[...] suppression)
- Ngôn ngữ chính
- CodeQL
- Star
- 10.1k
- Fork
- 2.1k
- Merge trung bình
- 2 ngày 15 giờ
- Pull request đã merge (30 ngày)
- 141
Mô tả
**Description of the issue**
Rust is missing an `AlertSuppression.ql` query, which means `// codeql[...]` and `// lgtm[...]` inline suppression comments have no effect on Rust code scanning alerts. Every other supported language (C++, C#, Go, Java, JavaScript, Python, Ruby, Swift) has this query.
All the building blocks already exist in the Rust CodeQL library:
- **Shared suppression module**: [`shared/util/codeql/util/suppression/AlertSuppression.qll`](https://github.com/github/codeql/blob/main/shared/util/codeql/util/suppression/AlertSuppression.qll) — requires `AstNode` (with `hasLocationInfo`) and `SingleLineComment` (with `hasLocationInfo`, `getText`, `toString`)
- **Rust `Comment` class**: [`rust/ql/lib/codeql/rust/elements/Comment.qll`](https://github.com/github/codeql/blob/main/rust/ql/lib/codeql/rust/elements/Comment.qll) — already has `getText()` (raw text including `//`), `getCommentText()` (stripped), `hasLocationInfo` (inherited from `AstNode`/`Token`), and `toString`
- **Rust `AstNode`**: [`rust/ql/lib/codeql/rust/elements/AstNode.qll`](https://github.com/github/codeql/blob/main/rust/ql/lib/codeql/rust/elements/AstNode.qll)
### Proposed implementation
A new file at `rust/ql/src/AlertSuppression.ql`, following the same pattern as [`python/ql/src/AlertSuppression.ql`](https://github.com/github/codeql/blob/main/python/ql/src/AlertSuppression.ql):
```ql
/**
* @name Alert suppression
* @description Generates information about alert suppressions.
* @kind alert-suppression
* @id rust/alert-suppression
*/
private import codeql.util.suppression.AlertSuppression as AS
private import codeql.rust.elements.Comment as C
private import codeql.rust.elements.AstNode as A
class AstNode instanceof A::AstNode {
predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
super.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
}
string toString() { result = super.toString() }
}
class SingleLineComment instanceof C::Comment {
SingleLineComment() {
// Only match single-line comments (// ...), not block comments (/* ... */)
super.getText().matches("//%")
}
predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
super.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
}
string getText() { result = super.getText() }
string toString() { result = super.toString() }
}
import AS::Make
```
The `qlpack.yml` at `rust/ql/src/qlpack.yml` already depends on `codeql/util`, so no dependency changes are needed.
### Motivation
Without this, there is no way to suppress false positives inline for Rust. The only workaround is dismissing alerts via the GitHub API or UI, which doesn't persist reliably across code changes.
Hướng dẫn đóng góp
Hướng nghiên cứu
Bắt đầu với mẫu được đề xuất trong python/ql/src/AlertSuppression.ql, sau đó đọc shared/util/codeql/util/suppression/AlertSuppression.qll cùng các tệp Rust Comment.qll và AstNode.qll. Thêm rust/ql/src/AlertSuppression.ql và xác nhận rằng các chú thích // codeql[...] và // lgtm[...] tạo ra các suppression cảnh báo Rust mà không thay đổi rust/ql/src/qlpack.yml.
Do mô hình lập chỉ mục viết ra từ nội dung của issue.
Đánh giá
- Công nghệ
- rust
- Lĩnh vực
- security
- Loại issue
- Tính năng
- Độ khó
- 2/5
- Thời gian dự kiến
- 1-3 giờ
- Mức độ hoạt động
- Ít trao đổi
- Độ rõ ràng
- Đặc tả rõ ràng
- Mức phù hợp với người mới
- 78/100