Rust: Add type inference inconsistency counts to the stats summary

Author: paldepind

rust/ql/integration-tests/hello-project/summary.expected

@@ -6,9 +6,9 @@
 | Files extracted - without errors % | 80 |
 | Inconsistencies - AST | 0 |
 | Inconsistencies - CFG | 0 |
+| Inconsistencies - Data flow | 0 |
 | Inconsistencies - Path resolution | 0 |
 | Inconsistencies - SSA | 0 |
-| Inconsistencies - data flow | 0 |
 | Lines of code extracted | 6 |
 | Lines of user code extracted | 6 |
 | Macro calls - resolved | 2 |

rust/ql/integration-tests/hello-workspace/summary.cargo.expected

@@ -6,9 +6,9 @@
 | Files extracted - without errors % | 100 |
 | Inconsistencies - AST | 0 |
 | Inconsistencies - CFG | 0 |
+| Inconsistencies - Data flow | 0 |
 | Inconsistencies - Path resolution | 0 |
 | Inconsistencies - SSA | 0 |
-| Inconsistencies - data flow | 0 |
 | Lines of code extracted | 9 |
 | Lines of user code extracted | 9 |
 | Macro calls - resolved | 2 |

rust/ql/integration-tests/hello-workspace/summary.rust-project.expected

@@ -6,9 +6,9 @@
 | Files extracted - without errors % | 100 |
 | Inconsistencies - AST | 0 |
 | Inconsistencies - CFG | 0 |
+| Inconsistencies - Data flow | 0 |
 | Inconsistencies - Path resolution | 0 |
 | Inconsistencies - SSA | 0 |
-| Inconsistencies - data flow | 0 |
 | Lines of code extracted | 9 |
 | Lines of user code extracted | 9 |
 | Macro calls - resolved | 2 |

rust/ql/integration-tests/macro-expansion/summary.expected

@@ -6,9 +6,9 @@
 | Files extracted - without errors % | 100 |
 | Inconsistencies - AST | 0 |
 | Inconsistencies - CFG | 0 |
+| Inconsistencies - Data flow | 0 |
 | Inconsistencies - Path resolution | 0 |
 | Inconsistencies - SSA | 0 |
-| Inconsistencies - data flow | 0 |
 | Lines of code extracted | 29 |
 | Lines of user code extracted | 29 |
 | Macro calls - resolved | 52 |

rust/ql/lib/codeql/rust/internal/TypeInferenceConsistency.qll

@@ -2,4 +2,28 @@
  * Provides classes for recognizing type inference inconsistencies.
  */
 
+private import Type
+private import TypeMention
+private import TypeInference::Consistency as Consistency
 import TypeInference::Consistency
+
+query predicate illFormedTypeMention(TypeMention tm) {
+  Consistency::illFormedTypeMention(tm) and
+  // Only include inconsistencies in the source, as we otherwise get
+  // inconsistencies from library code in every project.
+  tm.fromSource()
+}
+
+int getTypeInferenceInconsistencyCounts(string type) {
+  type = "Missing type parameter ID" and
+  result = count(TypeParameter tp | missingTypeParameterId(tp) | tp)
+  or
+  type = "Non-functional type parameter ID" and
+  result = count(TypeParameter tp | nonFunctionalTypeParameterId(tp) | tp)
+  or
+  type = "Non-injective type parameter ID" and
+  result = count(TypeParameter tp | nonInjectiveTypeParameterId(tp, _) | tp)
+  or
+  type = "Ill-formed type mention" and
+  result = count(TypeMention tm | illFormedTypeMention(tm) | tm)
+}

rust/ql/src/queries/summary/Stats.qll

@@ -8,6 +8,7 @@ private import codeql.rust.dataflow.internal.DataFlowImpl
 private import codeql.rust.dataflow.internal.TaintTrackingImpl
 private import codeql.rust.internal.AstConsistency as AstConsistency
 private import codeql.rust.internal.PathResolutionConsistency as PathResolutionConsistency
+private import codeql.rust.internal.TypeInferenceConsistency as TypeInferenceConsistency
 private import codeql.rust.controlflow.internal.CfgConsistency as CfgConsistency
 private import codeql.rust.dataflow.internal.DataFlowConsistency as DataFlowConsistency
 private import codeql.rust.dataflow.internal.SsaImpl::Consistency as SsaConsistency
@@ -52,6 +53,13 @@ int getTotalPathResolutionInconsistencies() {
     sum(string type | | PathResolutionConsistency::getPathResolutionInconsistencyCounts(type))
 }
 
+/**
+ * Gets a count of the total number of type inference inconsistencies in the database.
+ */
+int getTotalTypeInferenceInconsistencies() {
+  result = sum(string type | | TypeInferenceConsistency::getTypeInferenceInconsistencyCounts(type))
+}
+
 /**
  * Gets a count of the total number of control flow graph inconsistencies in the database.
  */
@@ -156,7 +164,14 @@ predicate inconsistencyStats(string key, int value) {
   or
   key = "Inconsistencies - SSA" and value = getTotalSsaInconsistencies()
   or
-  key = "Inconsistencies - data flow" and value = getTotalDataFlowInconsistencies()
+  key = "Inconsistencies - Data flow" and value = getTotalDataFlowInconsistencies()
+}
+
+/**
+ * Gets summary statistics about inconsistencies related to type inference.
+ */
+predicate typeInferenceInconsistencyStats(string key, int value) {
+  key = "Inconsistencies - Type inference" and value = getTotalTypeInferenceInconsistencies()
 }
 
 /**

rust/ql/src/queries/summary/SummaryStats.ql

@@ -17,5 +17,7 @@ where
   or
   inconsistencyStats(key, value)
   or
+  typeInferenceInconsistencyStats(key, value)
+  or
   taintStats(key, value)
 select key, value order by key

rust/ql/test/query-tests/diagnostics/SummaryStatsReduced.expected

@@ -6,9 +6,9 @@
 | Files extracted - without errors % | 57 |
 | Inconsistencies - AST | 0 |
 | Inconsistencies - CFG | 0 |
+| Inconsistencies - Data flow | 0 |
 | Inconsistencies - Path resolution | 0 |
 | Inconsistencies - SSA | 0 |
-| Inconsistencies - data flow | 0 |
 | Lines of code extracted | 60 |
 | Lines of user code extracted | 60 |
 | Macro calls - resolved | 8 |

rust/ql/test/query-tests/security/CWE-089/CONSISTENCY/TypeInferenceConsistency.expected

@@ -0,0 +1,3 @@
+illFormedTypeMention
+| sqlx.rs:158:13:158:81 | ...::BoxDynError |
+| sqlx.rs:160:17:160:86 | ...::BoxDynError |