From b4e2188d2a23bd2360ffccd8d1ca1ee834c0857c Mon Sep 17 00:00:00 2001
From: LucaCappelletti94 <cappelletti.luca94@gmail.com>
Date: Thu, 22 Oct 2026 10:26:58 +0200
Subject: [PATCH] Rust: Add neutral models for spurious Vec and VecDeque sink
 models

---
 .../2026-10-22-neutral-models-vec-vecdeque.md |  4 +++
 .../rust/frameworks/stdlib/alloc.model.yml    | 26 +++++++++++++++++++
 .../security/CWE-312/test_logging.rs          | 21 +++++++++++++++
 3 files changed, 51 insertions(+)
 create mode 100644 rust/ql/lib/change-notes/2026-10-22-neutral-models-vec-vecdeque.md

diff --git a/rust/ql/lib/change-notes/2026-10-22-neutral-models-vec-vecdeque.md b/rust/ql/lib/change-notes/2026-10-22-neutral-models-vec-vecdeque.md
new file mode 100644
index 000000000000..53ebd1cc4d3f
--- /dev/null
+++ b/rust/ql/lib/change-notes/2026-10-22-neutral-models-vec-vecdeque.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added neutral models to inhibit spurious generated sink models for `Vec` and `VecDeque` methods such as `insert`, `remove` and `push_back`. This fixes some false positive results from queries such as `rust/cleartext-logging`.
diff --git a/rust/ql/lib/codeql/rust/frameworks/stdlib/alloc.model.yml b/rust/ql/lib/codeql/rust/frameworks/stdlib/alloc.model.yml
index 67edf4eadfaf..21909e7a428e 100644
--- a/rust/ql/lib/codeql/rust/frameworks/stdlib/alloc.model.yml
+++ b/rust/ql/lib/codeql/rust/frameworks/stdlib/alloc.model.yml
@@ -70,3 +70,29 @@ extensions:
       - ["<alloc::rc::Rc as core::convert::From>::from", "sink", "manual"]
       - ["<alloc::string::String>::split_off", "sink", "manual"]
       - ["<alloc::vec::Vec>::split_off", "sink", "manual"]
+      - ["<alloc::vec::Vec>::insert", "sink", "manual"]
+      - ["<alloc::vec::Vec>::insert_mut", "sink", "manual"]
+      - ["<alloc::vec::Vec>::remove", "sink", "manual"]
+      - ["<alloc::vec::Vec>::swap_remove", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as alloc::collections::vec_deque::spec_extend::SpecExtend>::spec_extend", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as core::iter::traits::collect::Extend>::extend_one", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as core::iter::traits::collect::Extend>::extend_reserve", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as std::io::Write>::write_all_vectored", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque as std::io::Write>::write_vectored", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::append", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::insert", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::insert_mut", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::make_contiguous", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::push_back", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::push_back_mut", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::push_front", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::push_front_mut", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::remove", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::reserve", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::reserve_exact", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::rotate_left", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::rotate_right", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::shrink_to", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::shrink_to_fit", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::try_reserve", "sink", "manual"]
+      - ["<alloc::collections::vec_deque::VecDeque>::try_reserve_exact", "sink", "manual"]
diff --git a/rust/ql/test/query-tests/security/CWE-312/test_logging.rs b/rust/ql/test/query-tests/security/CWE-312/test_logging.rs
index d9dc9952086a..2936cb4f538b 100644
--- a/rust/ql/test/query-tests/security/CWE-312/test_logging.rs
+++ b/rust/ql/test/query-tests/security/CWE-312/test_logging.rs
@@ -251,6 +251,26 @@ fn test_std(password: String, i: i32, opt_i: Option<i32>) {
     err.write(format!("message = {}\n", password).as_bytes()); // $ Alert[rust/cleartext-logging]
 }
 
+fn test_collections(harmless: String) {
+    // collection operations are not logging
+    let mut passwords = Vec::new();
+    passwords.insert(0, harmless.clone());
+    passwords.insert(1, harmless.clone());
+    _ = passwords.remove(1);
+    _ = passwords.swap_remove(0);
+
+    let mut password_queue = std::collections::VecDeque::new();
+    password_queue.push_back(harmless.clone());
+    password_queue.push_front(harmless.clone());
+    password_queue.insert(1, harmless.clone());
+    password_queue.append(&mut std::collections::VecDeque::from([harmless]));
+    password_queue.reserve(1);
+    password_queue.rotate_left(1);
+    password_queue.shrink_to(1);
+    _ = password_queue.remove(1);
+    password_queue.make_contiguous();
+}
+
 fn main() {
     simple_logger::SimpleLogger::new().init().unwrap();
 
@@ -260,4 +280,5 @@ fn main() {
         "[encrypted]".to_string(),
     );
     test_std("123456".to_string(), 0, None);
+    test_collections("harmless".to_string());
 }