Rust: Add sinks for tracing

docs/codeql/reusables/supported-frameworks.rst

@@ -357,6 +357,7 @@ and the CodeQL library pack ``codeql/rust-all`` (`changelog <https://github.com/
    `sqlx <https://crates.io/crates/sqlx>`__, Database
    `tokio <https://crates.io/crates/tokio>`__, Asynchronous IO
    `tokio-postgres <https://crates.io/crates/tokio-postgres>`__, Database
+   `tracing <https://crates.io/crates/tracing>`__, Logging library
    `url <https://crates.io/crates/url>`__, Utility library
    `warp <https://crates.io/crates/warp>`__, Web framework
 

rust/ql/lib/codeql/rust/security/CleartextLoggingExtensions.qll

@@ -10,6 +10,7 @@ private import codeql.rust.dataflow.FlowSink
 private import codeql.rust.security.SensitiveData
 private import codeql.rust.Concepts
 private import codeql.rust.security.Barriers as Barriers
+private import codeql.rust.security.LogInjectionExtensions
 
 /**
  * Provides default sources, sinks and barriers for detecting cleartext logging
@@ -45,6 +46,11 @@ module CleartextLogging {
     ModelsAsDataSink() { sinkNode(this, "log-injection") }
   }
 
+  /**
+   * A sink for the logging macros of the `tracing` crate.
+   */
+  private class TracingMacroSink extends Sink instanceof LogInjection::TracingMacroSink { }
+
   /**
    * A barrier for logging from model data.
    */

rust/ql/lib/codeql/rust/security/LogInjectionExtensions.qll

@@ -44,6 +44,34 @@ module LogInjection {
     ModelsAsDataSink() { sinkNode(this, "log-injection") }
   }
 
+  /**
+   * A sink for the logging macros of the `tracing` crate, such as
+   * `tracing::info!`. The underlying function calls are difficult to
+   * identify reliably, so we treat any expression inside the expansion
+   * of such a macro call as a sink.
+   */
+  class TracingMacroSink extends Sink {
+    TracingMacroSink() {
+      exists(Crate c, MacroRules m, MacroCall mc |
+        // `c` is a tracing macro of interest
+        c.getName() = "tracing" and
+        m.getName().getText() = ["event", "span"] and
+        m.getLocation().getFile() = c.getASourceFile().getFile() and
+        // candidate sinks are expressions inside the expansion of a call to `c`
+        mc.resolveMacro() = m and
+        this.asExpr().getParentNode*() = mc.getMacroCallExpansion() and
+        // limit sinks to places that may have to do with producing a log message
+        (
+          this.asExpr().getParentNode() instanceof FormatArgsArg
+          or
+          this.asExpr().getParentNode() instanceof FormatArgsExpr
+          or
+          exists(ArgList al | al.getAnArg() = this.asExpr().getParentNode())
+        )
+      )
+    }
+  }
+
   /**
    * A barrier for log-injection from model data.
    */

rust/ql/src/change-notes/2026-08-13-cleartext-logging.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added cleartext logging flow sink models for the "tracing" crate. This may cause additional results to be found for the "Cleartext logging of sensitive information" (`rust/cleartext-logging`) and "Log injection" (`rust/log-injection`) queries.

rust/ql/test/query-tests/security/CWE-117/CONSISTENCY/PathResolutionConsistency.expected

@@ -1,2 +1,21 @@
 multipleResolvedTargets
-| main.rs:123:28:123:48 | ...::from(...) |
+| main.rs:128:28:128:48 | ...::from(...) |
+multiplePathResolutions
+| main.rs:122:9:122:23 | ...::__macro_support |
+| main.rs:122:9:122:23 | ...::__macro_support |
+| main.rs:122:9:122:23 | ...::__macro_support |
+| main.rs:122:9:122:23 | ...::__macro_support |
+| main.rs:122:9:122:23 | ...::__macro_support |
+| main.rs:122:9:122:23 | ...::field |
+| main.rs:123:9:123:22 | ...::__macro_support |
+| main.rs:123:9:123:22 | ...::__macro_support |
+| main.rs:123:9:123:22 | ...::__macro_support |
+| main.rs:123:9:123:22 | ...::__macro_support |
+| main.rs:123:9:123:22 | ...::__macro_support |
+| main.rs:123:9:123:22 | ...::field |
+| main.rs:124:9:124:23 | ...::__macro_support |
+| main.rs:124:9:124:23 | ...::__macro_support |
+| main.rs:124:9:124:23 | ...::__macro_support |
+| main.rs:124:9:124:23 | ...::__macro_support |
+| main.rs:124:9:124:23 | ...::__macro_support |
+| main.rs:124:9:124:23 | ...::field |

rust/ql/test/query-tests/security/CWE-117/CONSISTENCY/VariableCaptureConsistency.expected

@@ -0,0 +1,6 @@
+uniqueCfgNode
+| main.rs:122:9:122:23 | (...) | Expr has no cfg node |
+| main.rs:123:9:123:22 | (...) | Expr has no cfg node |
+| main.rs:124:25:124:44 | (...) | Expr has no cfg node |
+consistencyOverview
+| Expr has no cfg node | 3 |