[LucaCappelletti94]

The generated standard library models mark VecDeque::push_back, append, insert, reserve and 18 other VecDeque methods, together with Vec::insert, Vec::remove and Vec::swap_remove, as log-injection sinks. They appear to come from the panic and out-of-memory messages inside those methods that print a length, capacity or index. As a result rust/cleartext-logging reports queue.push_back(x) as a write to a log file whenever queue is tainted by sensitive data.

This adds neutral sink models for those methods next to the existing split_off and From::from ones, as in #21375. The neutral rows mirror the generated rows one for one, and every method concerned has only log-injection sink models, so no other sink kind is suppressed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[geoffw0]

I think this is the right approach and the models LGTM. Test cases prove they work. I've started a DCA run (additional CI), which I suspect will show a few real-world FP results disappearing.

[geoffw0]

Looks good to me. We see a quite significant reduction in false positive results for the cleartext logging query.

Thank you for your contribution! 🚀