Rust: Loops propagate CFG return completions but captures continue and break

Author: paldepind

rust/ql/lib/codeql/rust/controlflow/internal/Completion.qll

@@ -119,3 +119,9 @@ predicate completionIsSimple(Completion c) { c instanceof SimpleCompletion }
 
 /** Holds if `c` is a valid completion for `n`. */
 predicate completionIsValidFor(Completion c, AstNode n) { c.isValidFor(n) }
+
+/** Holds if `c` is a completion that interacts with a loop such as `loop`, `for`, `while`. */
+predicate isLoopCompletion(Completion c) {
+  c instanceof BreakCompletion or
+  c instanceof ContinueCompletion
+}

rust/ql/lib/codeql/rust/controlflow/internal/ControlFlowGraphImpl.qll

@@ -174,7 +174,7 @@ class LetStmtTree extends StandardPostOrderTree instanceof LetStmt {
 }
 
 class LoopExprTree extends PostOrderTree instanceof LoopExpr {
-  override predicate propagatesAbnormal(AstNode child) { child = super.getBody() }
+  override predicate propagatesAbnormal(AstNode child) { none() }
 
   override predicate first(AstNode node) { first(super.getBody(), node) }
 
@@ -189,6 +189,14 @@ class LoopExprTree extends PostOrderTree instanceof LoopExpr {
     c instanceof BreakCompletion and
     succ = this
   }
+
+  override predicate last(AstNode last, Completion c) {
+    super.last(last, c)
+    or
+    last(super.getBody(), last, c) and
+    not completionIsNormal(c) and
+    not isLoopCompletion(c)
+  }
 }
 
 class ReturnExprTree extends PostOrderTree instanceof ReturnExpr {