Merge pull request #20749 from github/copilot/add-secure-cookie-test-cases

Add test coverage for actix-web, poem, and http-types cookie secure attribute

Author: geoffw0

rust/ql/lib/change-notes/2025-11-05-poem.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added models for cookie methods in the `poem` crate.

rust/ql/lib/codeql/rust/frameworks/poem.model.yml

@@ -0,0 +1,22 @@
+extensions:
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: sinkModel
+    data:
+      - ["<poem::web::cookie::CookieJar>::add", "Argument[0]", "cookie-use", "manual"]
+      - ["<poem::web::cookie::SignedCookieJar>::add", "Argument[0]", "cookie-use", "manual"]
+      - ["<poem::web::cookie::PrivateCookieJar>::add", "Argument[0]", "cookie-use", "manual"]
+      - ["<poem::session::server_session::ServerSession>::new", "Argument[0]", "cookie-use", "manual"]
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: summaryModel
+    data:
+      - ["<poem::web::cookie::Cookie>::set_secure", "Argument[self].OptionalBarrier[cookie-secure-arg0]", "Argument[self]", "taint", "manual"]
+      - ["<poem::session::cookie_config::CookieConfig>::secure", "Argument[self].OptionalBarrier[cookie-secure-arg0]", "ReturnValue", "taint", "manual"]
+      - ["<poem::session::cookie_config::CookieConfig>::partitioned", "Argument[self].OptionalBarrier[cookie-partitioned-arg0]", "ReturnValue", "taint", "manual"]
+      - ["<poem::session::cookie_config::CookieConfig>::name", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["<poem::session::cookie_config::CookieConfig>::path", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["<poem::session::cookie_config::CookieConfig>::domain", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["<poem::session::cookie_config::CookieConfig>::http_only", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["<poem::session::cookie_config::CookieConfig>::same_site", "Argument[self]", "ReturnValue", "taint", "manual"]
+      - ["<poem::session::cookie_config::CookieConfig>::max_age", "Argument[self]", "ReturnValue", "taint", "manual"]

rust/ql/src/queries/security/CWE-614/InsecureCookie.ql

@@ -39,9 +39,9 @@ module InsecureCookieConfig implements DataFlow::ConfigSig {
     node instanceof Sink
   }
 
-  predicate isBarrier(DataFlow::Node node) {
-    // setting the 'secure' attribute to true
-    cookieSetNode(node, "secure", true)
+  predicate isBarrierIn(DataFlow::Node node) {
+    // setting the 'secure' attribute
+    cookieSetNode(node, "secure", _)
     or
     node instanceof Barrier
   }