Rust: Adjust the inferred type of string literals

hvitved · hvitved · commit d93e5164ad5e · 2025-07-08T10:55:55.000+02:00
diff --git a/rust/ql/lib/codeql/rust/internal/TypeInference.qll b/rust/ql/lib/codeql/rust/internal/TypeInference.qll
@@ -1020,14 +1020,12 @@ private Type inferTryExprType(TryExpr te, TypePath path) {
 }
 
 pragma[nomagic]
-private StructType inferLiteralType(LiteralExpr le) {
+private Type inferLiteralType(LiteralExpr le, TypePath path) {
+  path.isEmpty() and
   exists(Builtins::BuiltinType t | result = TStruct(t) |
     le instanceof CharLiteralExpr and
     t instanceof Builtins::Char
     or
-    le instanceof StringLiteralExpr and
-    t instanceof Builtins::Str
-    or
     le =
       any(NumberLiteralExpr ne |
         t.getName() = ne.getSuffix()
@@ -1045,6 +1043,14 @@ private StructType inferLiteralType(LiteralExpr le) {
     le instanceof BooleanLiteralExpr and
     t instanceof Builtins::Bool
   )
+  or
+  le instanceof StringLiteralExpr and
+  (
+    path.isEmpty() and result = TRefType()
+    or
+    path = TypePath::singleton(TRefTypeParameter()) and
+    result = TStruct(any(Builtins::Str s))
+  )
 }
 
 pragma[nomagic]
@@ -1578,8 +1584,7 @@ private module Cached {
     or
     result = inferTryExprType(n, path)
     or
-    result = inferLiteralType(n) and
-    path.isEmpty()
+    result = inferLiteralType(n, path)
     or
     result = inferAsyncBlockExprRootType(n) and
     path.isEmpty()
diff --git a/rust/ql/test/library-tests/type-inference/main.rs b/rust/ql/test/library-tests/type-inference/main.rs
@@ -1413,7 +1413,7 @@ mod builtins {
         let z = x + y; // $ type=z:i32 method=add
         let z = x.abs(); // $ method=abs $ type=z:i32
         let c = 'c'; // $ type=c:char
-        let hello = "Hello"; // $ type=hello:str
+        let hello = "Hello"; // $ type=hello:&T.str
         let f = 123.0f64; // $ type=f:f64
         let t = true; // $ type=t:bool
         let f = false; // $ type=f:bool
@@ -2086,10 +2086,10 @@ mod loops {
         let vals4: [u64; 3] = [1; 3]; // $ type=vals4:[T;...].u64
         for u in vals4 {} // $ type=u:u64
 
-        let mut strings1 = ["foo", "bar", "baz"]; // $ type=strings1:[T;...].str
+        let mut strings1 = ["foo", "bar", "baz"]; // $ type=strings1:[T;...].&T.str
         for s in &strings1 {} // $ MISSING: type=s:&T.str
         for s in &mut strings1 {} // $ MISSING: type=s:&T.str
-        for s in strings1 {} // $ type=s:str
+        for s in strings1 {} // $ type=s:&T.str
 
         let strings2 = // $ type=strings2:[T;...].String
         [
diff --git a/rust/ql/test/library-tests/type-inference/type-inference.expected b/rust/ql/test/library-tests/type-inference/type-inference.expected
