Rust: Handle short-circuiting logical binary operators

Author: paldepind

rust/ql/lib/codeql/rust/controlflow/internal/Completion.qll

@@ -64,7 +64,11 @@ abstract class ConditionalCompletion extends NormalCompletion {
 class BooleanCompletion extends ConditionalCompletion, TBooleanCompletion {
   BooleanCompletion() { this = TBooleanCompletion(value) }
 
-  override predicate isValidForSpecific(AstNode e) { e = any(IfExpr c).getCondition() }
+  override predicate isValidForSpecific(AstNode e) {
+    e = any(IfExpr c).getCondition()
+    or
+    exists(BinaryOpExpr expr | expr.getOp() = ["&&", "||"] and expr.getLhs() = e)
+  }
 
   /** Gets the dual Boolean completion. */
   override BooleanCompletion getDual() { result = TBooleanCompletion(value.booleanNot()) }

rust/ql/lib/codeql/rust/controlflow/internal/ControlFlowGraphImpl.qll

@@ -90,13 +90,57 @@ class CallExprTree extends StandardPostOrderTree instanceof CallExpr {
 }
 
 class BinaryOpExprTree extends StandardPostOrderTree instanceof BinaryOpExpr {
+  BinaryOpExprTree() { super.getOp() != "&&" and super.getOp() != "||" }
+
   override ControlFlowTree getChildNode(int i) {
     i = 0 and result = super.getLhs()
     or
     i = 1 and result = super.getRhs()
   }
 }
 
+class LogicalOrBinaryOpExprTree extends PostOrderTree instanceof BinaryOpExpr {
+  LogicalOrBinaryOpExprTree() { super.getOp() = "||" }
+
+  final override predicate propagatesAbnormal(AstNode child) {
+    child = [super.getRhs(), super.getLhs()]
+  }
+
+  override predicate first(AstNode node) { first(super.getLhs(), node) }
+
+  override predicate succ(AstNode pred, AstNode succ, Completion c) {
+    last(super.getLhs(), pred, c) and
+    (
+      succ = this and c.(BooleanCompletion).getValue() = true
+      or
+      first(super.getRhs(), succ) and c.(BooleanCompletion).getValue() = false
+    )
+    or
+    last(super.getRhs(), pred, c) and succ = this
+  }
+}
+
+class LogicalAndBinaryOpExprTree extends PostOrderTree instanceof BinaryOpExpr {
+  LogicalAndBinaryOpExprTree() { super.getOp() = "&&" }
+
+  final override predicate propagatesAbnormal(AstNode child) {
+    child = [super.getRhs(), super.getLhs()]
+  }
+
+  override predicate first(AstNode node) { first(super.getLhs(), node) }
+
+  override predicate succ(AstNode pred, AstNode succ, Completion c) {
+    last(super.getLhs(), pred, c) and
+    (
+      succ = this and c.(BooleanCompletion).getValue() = false
+      or
+      first(super.getRhs(), succ) and c.(BooleanCompletion).getValue() = true
+    )
+    or
+    last(super.getRhs(), pred, c) and succ = this
+  }
+}
+
 class IfExprTree extends PostOrderTree instanceof IfExpr {
   override predicate first(AstNode node) { first(super.getCondition(), node) }