Rust: Exclude self parameter accesses from rust/access-after-lifetime-ended

[geoffw0]

Exclude self parameter accesses from being sources in rust/access-after-lifetime-ended. The analysis in this query doesn't make any attempt to track object lifetimes, the (occasional) inclusion of self parameters was accidental, and the results we got from this path weren't great.

A smarter solution might figure out the actual variable(s) self can refer to (in the test, obj) and use the existing query logic from there.

TODO:

• I'm expecting some changes on the DCA run.
• change note.
• create a follow-up issue.

[Copilot]

Pull request overview

This PR refines the rust/access-after-lifetime-ended query by excluding self parameter accesses from being treated as sources. The query doesn't attempt to track object lifetimes, so including self parameters was unintended and produced suboptimal results.

Changes:

• Modified the query logic to filter out self parameters when identifying potential lifetime-ending variable accesses
• Added a comprehensive test case demonstrating methods with both &self and self parameters that return pointers to internal fields
• Updated the test runner to execute the new test case

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
rust/ql/lib/codeql/rust/security/AccessAfterLifetimeExtensions.qll	Added not var.getParameter() instanceof SelfParam condition to exclude self parameters from source identification
rust/ql/test/query-tests/security/CWE-825/lifetime.rs	Added test_get_self() function and MyObjectWithGetters struct to test the exclusion of self parameter accesses
rust/ql/test/query-tests/security/CWE-825/main.rs	Added call to test_get_self() in the main test execution function

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.