Rust: Fix near duplicate results.

Author: geoffw0

rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll

@@ -71,6 +71,11 @@ module HardcodedCryptographicValue {
     or
     isConstant(e.(ArrayRepeatExpr).getRepeatOperand()) // e.g. `[0; 10]`
     or
+    // a match expression with one or more constant arms; taint would reach here
+    // anyway, but we make it a source to avoid reporting many similar results
+    // on each match arm.
+    isConstant(e.(MatchExpr).getMatchArmList().getAnArm().getExpr())
+    or
     // e.g. `const MY_CONST: u64 = ...`
     // the constant initializer / body is the preferred source location for flow paths, when available.
     e = any(Const c).getBody()

rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected

@@ -8,9 +8,7 @@
 | test_cipher.rs:73:19:73:26 | [0u8; 32] | test_cipher.rs:73:19:73:26 | [0u8; 32] | test_cipher.rs:74:46:74:51 | const2 | This hard-coded value is used as $@. | test_cipher.rs:74:46:74:51 | const2 | a key |
 | test_cookie.rs:17:28:17:34 | [0; 64] | test_cookie.rs:17:28:17:34 | [0; 64] | test_cookie.rs:18:26:18:32 | &array1 | This hard-coded value is used as $@. | test_cookie.rs:18:26:18:32 | &array1 | a key |
 | test_cookie.rs:21:28:21:34 | [0; 64] | test_cookie.rs:21:28:21:34 | [0; 64] | test_cookie.rs:22:26:22:32 | &array2 | This hard-coded value is used as $@. | test_cookie.rs:22:26:22:32 | &array2 | a key |
-| test_cookie.rs:26:14:26:18 | "one" | test_cookie.rs:26:14:26:18 | "one" | test_cookie.rs:30:26:30:40 | str3.as_bytes() | This hard-coded value is used as $@. | test_cookie.rs:30:26:30:40 | str3.as_bytes() | a key |
-| test_cookie.rs:27:14:27:18 | "two" | test_cookie.rs:27:14:27:18 | "two" | test_cookie.rs:30:26:30:40 | str3.as_bytes() | This hard-coded value is used as $@. | test_cookie.rs:30:26:30:40 | str3.as_bytes() | a key |
-| test_cookie.rs:28:14:28:19 | "many" | test_cookie.rs:28:14:28:19 | "many" | test_cookie.rs:30:26:30:40 | str3.as_bytes() | This hard-coded value is used as $@. | test_cookie.rs:30:26:30:40 | str3.as_bytes() | a key |
+| test_cookie.rs:25:16:29:5 | match ... { ... } | test_cookie.rs:25:16:29:5 | match ... { ... } | test_cookie.rs:30:26:30:40 | str3.as_bytes() | This hard-coded value is used as $@. | test_cookie.rs:30:26:30:40 | str3.as_bytes() | a key |
 | test_cookie.rs:46:28:46:36 | [0u8; 64] | test_cookie.rs:46:28:46:36 | [0u8; 64] | test_cookie.rs:50:34:50:39 | array2 | This hard-coded value is used as $@. | test_cookie.rs:50:34:50:39 | array2 | a key |
 | test_cookie.rs:57:23:57:25 | 0u8 | test_cookie.rs:57:23:57:25 | 0u8 | test_cookie.rs:61:34:61:39 | array3 | This hard-coded value is used as $@. | test_cookie.rs:61:34:61:39 | array3 | a key |
 | test_heuristic.rs:38:25:38:30 | 0xFFFF | test_heuristic.rs:38:25:38:30 | 0xFFFF | test_heuristic.rs:81:22:81:31 | MY_CONST_1 | This hard-coded value is used as $@. | test_heuristic.rs:81:22:81:31 | MY_CONST_1 | a salt |
@@ -69,9 +67,7 @@ edges
 | test_cookie.rs:22:26:22:32 | &array2 [&ref] | test_cookie.rs:22:26:22:32 | &array2 | provenance | Sink:MaD:5 |
 | test_cookie.rs:22:27:22:32 | array2 | test_cookie.rs:22:26:22:32 | &array2 [&ref] | provenance |  |
 | test_cookie.rs:25:9:25:12 | str3 | test_cookie.rs:30:26:30:29 | str3 | provenance |  |
-| test_cookie.rs:26:14:26:18 | "one" | test_cookie.rs:25:9:25:12 | str3 | provenance |  |
-| test_cookie.rs:27:14:27:18 | "two" | test_cookie.rs:25:9:25:12 | str3 | provenance |  |
-| test_cookie.rs:28:14:28:19 | "many" | test_cookie.rs:25:9:25:12 | str3 | provenance |  |
+| test_cookie.rs:25:16:29:5 | match ... { ... } | test_cookie.rs:25:9:25:12 | str3 | provenance |  |
 | test_cookie.rs:30:26:30:29 | str3 | test_cookie.rs:30:26:30:40 | str3.as_bytes() [&ref] | provenance | MaD:13 |
 | test_cookie.rs:30:26:30:40 | str3.as_bytes() [&ref] | test_cookie.rs:30:26:30:40 | str3.as_bytes() | provenance | Sink:MaD:5 |
 | test_cookie.rs:46:9:46:14 | array2 | test_cookie.rs:50:34:50:39 | array2 | provenance | Sink:MaD:1 |
@@ -163,9 +159,7 @@ nodes
 | test_cookie.rs:22:26:22:32 | &array2 [&ref] | semmle.label | &array2 [&ref] |
 | test_cookie.rs:22:27:22:32 | array2 | semmle.label | array2 |
 | test_cookie.rs:25:9:25:12 | str3 | semmle.label | str3 |
-| test_cookie.rs:26:14:26:18 | "one" | semmle.label | "one" |
-| test_cookie.rs:27:14:27:18 | "two" | semmle.label | "two" |
-| test_cookie.rs:28:14:28:19 | "many" | semmle.label | "many" |
+| test_cookie.rs:25:16:29:5 | match ... { ... } | semmle.label | match ... { ... } |
 | test_cookie.rs:30:26:30:29 | str3 | semmle.label | str3 |
 | test_cookie.rs:30:26:30:40 | str3.as_bytes() | semmle.label | str3.as_bytes() |
 | test_cookie.rs:30:26:30:40 | str3.as_bytes() [&ref] | semmle.label | str3.as_bytes() [&ref] |

rust/ql/test/query-tests/security/CWE-798/test_cookie.rs

@@ -23,10 +23,10 @@ fn test_cookie_jar(array_var: &[u8], val: u64) {
     _ = jar.private_mut(&key2);
 
     let str3 = match(val) {
-        0 => "one", // $ Alert[rust/hard-coded-cryptographic-value]
-        1 => "two", // $ Alert[rust/hard-coded-cryptographic-value]
-        _ => "many" // $ Alert[rust/hard-coded-cryptographic-value]
-    };
+        0 => "one",
+        1 => "two",
+        _ => "many"
+    }; // $ Alert[rust/hard-coded-cryptographic-value]
     let key3 = Key::from(str3.as_bytes()); // $ Sink
     _ = jar.signed_mut(&key3);
 }