Rust: Handle Deref trait in type inference

rust/ql/consistency-queries/PathResolutionConsistency.ql

@@ -15,8 +15,8 @@ class SourceLocatable extends Locatable {
   SourceLocatable() { this.fromSource() }
 }
 
-query predicate multipleCallTargets(SourceLocatable a) {
-  PathResolutionConsistency::multipleCallTargets(a, _)
+query predicate multipleResolvedTargets(SourceLocatable a) {
+  PathResolutionConsistency::multipleResolvedTargets(a, _)
 }
 
 query predicate multiplePathResolutions(SourceLocatable a) {

rust/ql/lib/codeql/rust/elements/internal/OperationImpl.qll

@@ -30,6 +30,7 @@ module Impl {
       op = "!" and path = "core::ops::bit::Not" and method = "not" and borrows = 0
       or
       // Dereference
+      // todo: handle `core::ops::deref::DerefMut`
       op = "*" and path = "core::ops::deref::Deref" and method = "deref" and borrows = 1
     )
     or

rust/ql/lib/codeql/rust/frameworks/stdlib/Builtins.qll

@@ -162,15 +162,20 @@ class ArrayType extends BuiltinType {
   override string getDisplayName() { result = "[;]" }
 }
 
-/** The builtin reference type `&T`. */
-class RefType extends BuiltinType {
-  RefType() { this.getName() = "Ref" }
+/** A builtin reference type `&T` or `&mut T`. */
+abstract private class RefTypeImpl extends BuiltinType { }
+
+final class RefType = RefTypeImpl;
+
+/** The builtin shared reference type `&T`. */
+class RefSharedType extends RefTypeImpl {
+  RefSharedType() { this.getName() = "Ref" }
 
   override string getDisplayName() { result = "&" }
 }
 
-/** The builtin reference type `&mut T`. */
-class RefMutType extends BuiltinType {
+/** The builtin mutable reference type `&mut T`. */
+class RefMutType extends RefTypeImpl {
   RefMutType() { this.getName() = "RefMut" }
 
   override string getDisplayName() { result = "&mut" }

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -771,8 +771,12 @@ private TypeItemNode resolveBuiltin(TypeRepr tr) {
   tr instanceof ArrayTypeRepr and
   result instanceof Builtins::ArrayType
   or
-  tr instanceof RefTypeRepr and
-  result instanceof Builtins::RefType
+  tr =
+    any(RefTypeRepr rtr |
+      if rtr.isMut()
+      then result instanceof Builtins::RefMutType
+      else result instanceof Builtins::RefSharedType
+    )
   or
   tr.(PtrTypeRepr).isConst() and
   result instanceof Builtins::PtrConstType

rust/ql/lib/codeql/rust/internal/PathResolutionConsistency.qll

@@ -24,17 +24,10 @@ query predicate multiplePathResolutions(Path p, ItemNode i) {
   strictcount(ItemNode i0 | i0 = resolvePath(p) and not i0 instanceof Crate) > 1
 }
 
-// TODO: Take other calls into account
-abstract private class CallExprBase extends InvocationExpr { }
-
-private class CallExprCallExprBase extends CallExpr, CallExprBase { }
-
-private class MethodCallExprCallExprBase extends MethodCallExpr, CallExprBase { }
-
-/** Holds if `call` has multiple static call targets including `target`. */
-query predicate multipleCallTargets(CallExprBase call, Callable target) {
-  target = call.getResolvedTarget() and
-  strictcount(call.getResolvedTarget()) > 1
+/** Holds if `ie` has multiple resolved targets including `target`. */
+query predicate multipleResolvedTargets(InvocationExpr ie, Addressable target) {
+  target = ie.getResolvedTarget() and
+  strictcount(ie.getResolvedTarget()) > 1
 }
 
 /** Holds if `fe` resolves to multiple record fields including `field`. */
@@ -62,8 +55,8 @@ int getPathResolutionInconsistencyCounts(string type) {
   type = "Multiple path resolutions" and
   result = count(Path p | multiplePathResolutions(p, _) | p)
   or
-  type = "Multiple static call targets" and
-  result = count(CallExprBase call | multipleCallTargets(call, _) | call)
+  type = "Multiple resolved targets" and
+  result = count(InvocationExpr ie | multipleResolvedTargets(ie, _) | ie)
   or
   type = "Multiple record fields" and
   result = count(FieldExpr fe | multipleStructFields(fe, _) | fe)

rust/ql/lib/codeql/rust/internal/Type.qll

@@ -224,21 +224,33 @@ TypeParamTypeParameter getArrayTypeParameter() {
   result = any(ArrayType t).getPositionalTypeParameter(0)
 }
 
-/**
- * A reference type.
- *
- * Reference types like `& i64` are modeled as normal generic types
- * with a single type argument.
- */
-class RefType extends StructType {
-  RefType() { this.getStruct() instanceof Builtins::RefType }
+abstract class RefType extends StructType { }
+
+pragma[nomagic]
+TypeParamTypeParameter getRefTypeParameter() {
+  result = any(RefType t).getPositionalTypeParameter(0)
+}
+
+class RefMutType extends RefType {
+  RefMutType() { this.getStruct() instanceof Builtins::RefMutType }
+
+  override string toString() { result = "&mut" }
+}
+
+pragma[nomagic]
+TypeParamTypeParameter getRefMutTypeParameter() {
+  result = any(RefMutType t).getPositionalTypeParameter(0)
+}
+
+class RefSharedType extends RefType {
+  RefSharedType() { this.getStruct() instanceof Builtins::RefSharedType }
 
   override string toString() { result = "&" }
 }
 
 pragma[nomagic]
-TypeParamTypeParameter getRefTypeParameter() {
-  result = any(RefType t).getPositionalTypeParameter(0)
+TypeParamTypeParameter getRefSharedTypeParameter() {
+  result = any(RefSharedType t).getPositionalTypeParameter(0)
 }
 
 /**