Skip to content

Rust: Add sinks for tracing - #22341

Open
geoffw0 wants to merge 7 commits into
github:mainfrom
geoffw0:logsinks
Open

Rust: Add sinks for tracing#22341
geoffw0 wants to merge 7 commits into
github:mainfrom
geoffw0:logsinks

Conversation

@geoffw0

@geoffw0 geoffw0 commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

Add sinks for the tracing crate. This is a popular logging library, an AI I was working with (Fable) suggested I add support for it - though I've cleaned up the solution it offered quite a bit. Sadly models-as-data sinks don't seem to be feasible in this case.

@geoffw0
geoffw0 requested review from a team as code owners August 13, 2026 16:27
Copilot AI balanced review requested due to automatic review settings August 13, 2026 16:27
@geoffw0 geoffw0 added the Rust Pull requests that update Rust code label Aug 13, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds Rust cleartext-logging and log-injection sink support for the tracing crate.

Changes:

  • Models tracing logging, event, and span macros as sinks.
  • Adds test cases and dependency updates.
  • Documents framework support and adds a change note.
Show a summary per file
File Description
LogInjectionExtensions.qll Defines tracing macro sinks.
CleartextLoggingExtensions.qll Reuses tracing sinks for cleartext logging.
test_logging.rs Adds tracing test cases.
options.yml Adds the tracing dependency.
Cargo.lock Locks updated dependencies.
CleartextLogging.expected Updates generated test results.
2026-08-13-cleartext-logging.md Records the analysis change.
supported-frameworks.rst Lists tracing support.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

  • Files reviewed: 6/8 changed files
  • Comments generated: 2
  • Review effort level: Balanced

m.getName().getText() = ["trace", "debug", "info", "warn", "error", "event", "span"] and
m.getLocation().getFile() = c.getASourceFile().getFile() and
mc.resolveMacro() = m and
this.asExpr().getParentNode*() = mc.getMacroCallExpansion()

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it would be better to avoid sink and result duplication here. I'm going to have to think about the best way to do this. If nothing else, we can make sink nodes isBarrierOut nodes to avoid duplicating results (though we will still have duplicate sinks with that strategy).

Performance seemed OK locally, but DCA will confirm.

Comment thread rust/ql/lib/codeql/rust/security/LogInjectionExtensions.qll
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Rust Pull requests that update Rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants