Rust: reconstruct format-macro expansions on pre-1.94 toolchains - #22350
Merged
redsun82 merged 1 commit intoAug 17, 2026
Merged
Conversation
redsun82
force-pushed
the
redsun82-format-macro-flow-recovery
branch
from
August 14, 2026 17:35
962c659 to
da97573
Compare
`rust-analyzer` 0.0.347 no longer expands the format-family macros (`format!`, `println!`, `write!`, `panic!`, ...) against a pre-1.94 std, so flow through them and the security-query sinks keyed on their callees were lost. Rebuild each macro's real expansion (a `FormatArgsExpr` wrapped in its callee) from the argument tokens so both keep working. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7492ff50-9c8e-47ef-a70d-f2623b702c8f
redsun82
force-pushed
the
redsun82-format-macro-flow-recovery
branch
from
August 14, 2026 17:38
da97573 to
7faf81f
Compare
redsun82
marked this pull request as ready for review
August 17, 2026 06:55
Contributor
There was a problem hiding this comment.
Pull request overview
Adds fallback reconstruction for format-family macros on pre-1.94 Rust toolchains following the rust-analyzer upgrade.
Changes:
- Reconstructs format macro expansions and wrapping callees.
- Adds pinned Rust 1.93 integration coverage.
- Verifies taint flow, format nodes, and log-injection sinks.
Show a summary per file
| File | Description |
|---|---|
rust/extractor/src/translate/format_args.rs |
Builds fallback token trees. |
rust/extractor/src/translate/base.rs |
Orchestrates fallback expansion. |
rust/extractor/src/translate.rs |
Registers the new module. |
rust/ql/test/setup.sh |
Pre-installs Rust 1.93. |
rust/ql/test/.gitignore |
Allows the pinned toolchain file. |
rust/ql/test/library-tests/format-macros-legacy/rust-toolchain.toml |
Pins Rust 1.93. |
rust/ql/test/library-tests/format-macros-legacy/main.rs |
Provides format-macro fixtures. |
rust/ql/test/library-tests/format-macros-legacy/LogInjection.qlref |
Configures the security query. |
rust/ql/test/library-tests/format-macros-legacy/LogInjection.expected |
Records expected alerts. |
rust/ql/test/library-tests/format-macros-legacy/inline-taint-flow.ql |
Tests reconstructed taint flow. |
rust/ql/test/library-tests/format-macros-legacy/inline-taint-flow.expected |
Records expected flow paths. |
rust/ql/test/library-tests/format-macros-legacy/FormatArgs.ql |
Queries reconstructed format nodes. |
rust/ql/test/library-tests/format-macros-legacy/FormatArgs.expected |
Records expected format nodes. |
rust/ql/test/library-tests/format-macros-legacy/Cargo.lock |
Locks the test crate. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Suppressed comments (1)
rust/extractor/src/translate/format_args.rs:94
- The first raw top-level comma is not necessarily the separator after
$dst:expr: angle brackets are not token-tree delimiters, so valid code such aswrite!(make::<A, B>(), "{}", value)is split at the comma betweenAandB. The fallback then reconstructs a malformed or incorrect expansion. Determine the boundary by parsing the first Rust expression (equivalent to the macro's$dst:exprmatcher) rather than scanning token trees for a comma.
if let tt::TtElement::Leaf(tt::Leaf::Punct(punct)) = element
&& punct.char == ','
- Files reviewed: 13/14 changed files
- Comments generated: 4
- Review effort level: Balanced
Comment on lines
+809
to
+813
| let Some(name) = mcall | ||
| .path() | ||
| .and_then(|p| p.segment()) | ||
| .and_then(|s| s.name_ref()) | ||
| .map(|n| n.text().to_string()) |
| emitter.push_parenthesized_format_args(&mut builder, content); | ||
| } | ||
| Wrap::WriteMethod => { | ||
| builder.extend_with_tt(writer.expect("write! split always yields a writer")); |
| "format" => Wrap::Call(&["std", "fmt", "format"]), | ||
| "print" | "println" => Wrap::Call(&["std", "io", "_print"]), | ||
| "eprint" | "eprintln" => Wrap::Call(&["std", "io", "_eprint"]), | ||
| "panic" => Wrap::Call(&["core", "panicking", "panic_fmt"]), |
| # the extractor reconstructs the `FormatArgsExpr` itself. This test exercises that | ||
| # reconstruction path, which the default 1.95 test toolchain never hits. | ||
| # | ||
| # Any toolchain named here must also be pre-installed in `../setup.sh`, otherwise |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #22346 (RA 0.0.347 upgrade). Review/merge that first; this PR targets its branch.
Problem
rust-analyzer0.0.347 only expands the builtinformat_args!machinery against a std that carries the new lowering (roughly Rust >= 1.94). On older toolchains the format-family macros (format!,println!,write!,panic!, ...) fail to expand, soexpand_macro_callreturnsNoneand we get a bare unexpandedMacroCall. That drops:FormatArgsExprnode), andprintln!/eprintln!/panic!(std::io::stdio::_print/_eprint,core::panicking::panic_fmt).Fix
The syntactic lowering of these macros is a pure, sysroot-independent transform, so the extractor rebuilds the same token tree the real (>=1.94) expansion has, parses it, and registers the result as the macro expansion.
The reconstruction is faithful per macro rather than a blanket bare
FormatArgsExpr, so the callee that carries flow and the sink models is preserved:format_args!,const_format_args!,format_args_nl!format_args!(..)format!::std::fmt::format(format_args!(..))print!,println!::std::io::_print(format_args!(..))eprint!,eprintln!::std::io::_eprint(format_args!(..))panic!::core::panicking::panic_fmt(format_args!(..))write!,writeln!<dst>.write_fmt(format_args!(..))format_args_nl!'s trailing newline is dropped: it is irrelevant to flow and to the sinks keyed on the callee.The synthesized-token construction lives in a new
translate/format_args.rsmodule;base.rskeeps only the orchestration (tokenize, reconstruct, parse, emit).Testing
New
library-tests/format-macros-legacy/test, pinned to a pre-1.94 (1.93) toolchain so it actually hits the reconstruction path the default1.95test toolchain never reaches:format!(InlineFlowTest),println!/eprintln!/print!/eprint!(LogInjection.qlref), confirming the sinks survive on<1.94,FormatArgsExprnode presence for the rest of the family.setup.shpre-installs the1.93toolchain so the parallel QL tests do not race onrustupauto-install.Notes
write!/writeln!writer buffer is not recovered, but that matches native>=1.94behavior (there is noWrite::write_fmtcontent-to-self taint model). It is a pre-existing model gap, not a regression from this change, and is left for a follow-up.