From 9f08cb099ae0b75a9cef8d8e28e18a5028c784f1 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 1 Sep 2026 09:37:25 +0200
Subject: [PATCH 1/2] Rust: Add more `axum` tests

---
 .../TypeInferenceConsistency.expected         |   6 +-
 .../web_frameworks/InlineFlow.expected        | 160 +++++------
 .../web_frameworks/TaintSources.expected      | 248 +++++++++---------
 .../dataflow/sources/web_frameworks/test.rs   |  13 +-
 4 files changed, 226 insertions(+), 201 deletions(-)

diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/CONSISTENCY/TypeInferenceConsistency.expected b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/CONSISTENCY/TypeInferenceConsistency.expected
index f1bdb2cddbd6..d5b1af2b25cc 100644
--- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/CONSISTENCY/TypeInferenceConsistency.expected
+++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/CONSISTENCY/TypeInferenceConsistency.expected
@@ -1,4 +1,4 @@
 nonUniqueCertainType
-| test.rs:131:30:131:39 | ...::get(...) |  |
-| test.rs:132:34:132:43 | ...::get(...) |  |
-| test.rs:133:30:133:39 | ...::get(...) |  |
+| test.rs:132:30:132:39 | ...::get(...) |  |
+| test.rs:133:34:133:43 | ...::get(...) |  |
+| test.rs:134:30:134:39 | ...::get(...) |  |
diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected
index c1f6cce28888..237b4200d8af 100644
--- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected
+++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected
@@ -36,29 +36,31 @@ edges
 | test.rs:107:13:107:18 | TuplePat | test.rs:110:14:110:14 | b | provenance |  |
 | test.rs:107:22:107:25 | path | test.rs:107:22:107:38 | path.into_inner() | provenance | MaD:11 |
 | test.rs:107:22:107:38 | path.into_inner() | test.rs:107:13:107:18 | TuplePat | provenance |  |
-| test.rs:122:14:122:31 | my_actix_handler_4 | test.rs:123:17:123:20 | path | provenance | Src:MaD:1  |
-| test.rs:123:13:123:13 | a | test.rs:124:14:124:14 | a | provenance |  |
-| test.rs:123:17:123:20 | path | test.rs:123:17:123:33 | path.into_inner() | provenance | MaD:11 |
-| test.rs:123:17:123:33 | path.into_inner() | test.rs:123:13:123:13 | a | provenance |  |
-| test.rs:131:44:131:61 | my_actix_handler_1 | test.rs:98:17:98:20 | path | provenance | Src:MaD:2  |
-| test.rs:132:48:132:65 | my_actix_handler_2 | test.rs:107:22:107:25 | path | provenance | Src:MaD:2  |
-| test.rs:133:44:133:61 | my_actix_handler_3 | test.rs:116:14:116:14 | a | provenance | Src:MaD:2  |
-| test.rs:148:14:148:14 | a | test.rs:148:14:148:23 | a.as_str() | provenance | MaD:13 |
-| test.rs:149:14:149:14 | a | test.rs:149:14:149:25 | a.as_bytes() | provenance | MaD:12 |
-| test.rs:200:34:200:50 | my_axum_handler_1 | test.rs:148:14:148:14 | a | provenance | Src:MaD:8  |
-| test.rs:200:34:200:50 | my_axum_handler_1 | test.rs:149:14:149:14 | a | provenance | Src:MaD:8  |
-| test.rs:200:34:200:50 | my_axum_handler_1 | test.rs:150:14:150:14 | a | provenance | Src:MaD:8  |
-| test.rs:201:39:201:55 | my_axum_handler_2 | test.rs:156:14:156:14 | a | provenance | Src:MaD:9  |
-| test.rs:201:39:201:55 | my_axum_handler_2 | test.rs:157:14:157:14 | b | provenance | Src:MaD:9  |
-| test.rs:202:33:202:49 | my_axum_handler_3 | test.rs:164:18:164:20 | key | provenance | Src:MaD:10  |
-| test.rs:202:33:202:49 | my_axum_handler_3 | test.rs:165:18:165:22 | value | provenance | Src:MaD:10  |
-| test.rs:205:65:205:81 | my_axum_handler_5 | test.rs:181:14:181:20 | payload | provenance | Src:MaD:4  |
-| test.rs:207:33:207:49 | my_axum_handler_6 | test.rs:187:14:187:17 | body | provenance | Src:MaD:8  |
-| test.rs:207:56:207:72 | my_axum_handler_7 | test.rs:193:14:193:17 | body | provenance | Src:MaD:3  |
-| test.rs:222:37:227:9 | \|...\| ... | test.rs:224:18:224:18 | a | provenance | Src:MaD:6  |
-| test.rs:231:13:235:13 | \|...\| ... | test.rs:232:22:232:22 | a | provenance | Src:MaD:7  |
-| test.rs:240:13:248:9 | \|...\| ... | test.rs:243:22:243:23 | id | provenance | Src:MaD:5  |
-| test.rs:253:13:258:14 | \|...\| ... | test.rs:255:22:255:22 | a | provenance | Src:MaD:6  |
+| test.rs:123:14:123:31 | my_actix_handler_4 | test.rs:124:17:124:20 | path | provenance | Src:MaD:1  |
+| test.rs:124:13:124:13 | a | test.rs:125:14:125:14 | a | provenance |  |
+| test.rs:124:17:124:20 | path | test.rs:124:17:124:33 | path.into_inner() | provenance | MaD:11 |
+| test.rs:124:17:124:33 | path.into_inner() | test.rs:124:13:124:13 | a | provenance |  |
+| test.rs:132:44:132:61 | my_actix_handler_1 | test.rs:98:17:98:20 | path | provenance | Src:MaD:2  |
+| test.rs:133:48:133:65 | my_actix_handler_2 | test.rs:107:22:107:25 | path | provenance | Src:MaD:2  |
+| test.rs:134:44:134:61 | my_actix_handler_3 | test.rs:116:14:116:14 | a | provenance | Src:MaD:2  |
+| test.rs:149:14:149:14 | a | test.rs:149:14:149:23 | a.as_str() | provenance | MaD:13 |
+| test.rs:150:14:150:14 | a | test.rs:150:14:150:25 | a.as_bytes() | provenance | MaD:12 |
+| test.rs:208:34:208:50 | my_axum_handler_1 | test.rs:149:14:149:14 | a | provenance | Src:MaD:8  |
+| test.rs:208:34:208:50 | my_axum_handler_1 | test.rs:150:14:150:14 | a | provenance | Src:MaD:8  |
+| test.rs:208:34:208:50 | my_axum_handler_1 | test.rs:151:14:151:14 | a | provenance | Src:MaD:8  |
+| test.rs:209:39:209:55 | my_axum_handler_2 | test.rs:157:14:157:14 | a | provenance | Src:MaD:9  |
+| test.rs:209:39:209:55 | my_axum_handler_2 | test.rs:158:14:158:14 | b | provenance | Src:MaD:9  |
+| test.rs:210:33:210:49 | my_axum_handler_3 | test.rs:165:18:165:20 | key | provenance | Src:MaD:10  |
+| test.rs:210:33:210:49 | my_axum_handler_3 | test.rs:166:18:166:22 | value | provenance | Src:MaD:10  |
+| test.rs:213:65:213:81 | my_axum_handler_5 | test.rs:182:14:182:20 | payload | provenance | Src:MaD:4  |
+| test.rs:215:33:215:49 | my_axum_handler_6 | test.rs:188:14:188:17 | body | provenance | Src:MaD:8  |
+| test.rs:215:56:215:72 | my_axum_handler_7 | test.rs:194:14:194:17 | body | provenance | Src:MaD:3  |
+| test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:200:14:200:20 | state.0 | provenance | Src:MaD:8  |
+| test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:201:14:201:17 | body | provenance | Src:MaD:8  |
+| test.rs:231:37:236:9 | \|...\| ... | test.rs:233:18:233:18 | a | provenance | Src:MaD:6  |
+| test.rs:240:13:244:13 | \|...\| ... | test.rs:241:22:241:22 | a | provenance | Src:MaD:7  |
+| test.rs:249:13:257:9 | \|...\| ... | test.rs:252:22:252:23 | id | provenance | Src:MaD:5  |
+| test.rs:262:13:267:14 | \|...\| ... | test.rs:264:22:264:22 | a | provenance | Src:MaD:6  |
 nodes
 | test.rs:11:31:11:31 | a | semmle.label | a |
 | test.rs:13:14:13:14 | a | semmle.label | a |
@@ -91,40 +93,44 @@ nodes
 | test.rs:109:14:109:14 | a | semmle.label | a |
 | test.rs:110:14:110:14 | b | semmle.label | b |
 | test.rs:116:14:116:14 | a | semmle.label | a |
-| test.rs:122:14:122:31 | my_actix_handler_4 | semmle.label | my_actix_handler_4 |
-| test.rs:123:13:123:13 | a | semmle.label | a |
-| test.rs:123:17:123:20 | path | semmle.label | path |
-| test.rs:123:17:123:33 | path.into_inner() | semmle.label | path.into_inner() |
-| test.rs:124:14:124:14 | a | semmle.label | a |
-| test.rs:131:44:131:61 | my_actix_handler_1 | semmle.label | my_actix_handler_1 |
-| test.rs:132:48:132:65 | my_actix_handler_2 | semmle.label | my_actix_handler_2 |
-| test.rs:133:44:133:61 | my_actix_handler_3 | semmle.label | my_actix_handler_3 |
-| test.rs:148:14:148:14 | a | semmle.label | a |
-| test.rs:148:14:148:23 | a.as_str() | semmle.label | a.as_str() |
+| test.rs:123:14:123:31 | my_actix_handler_4 | semmle.label | my_actix_handler_4 |
+| test.rs:124:13:124:13 | a | semmle.label | a |
+| test.rs:124:17:124:20 | path | semmle.label | path |
+| test.rs:124:17:124:33 | path.into_inner() | semmle.label | path.into_inner() |
+| test.rs:125:14:125:14 | a | semmle.label | a |
+| test.rs:132:44:132:61 | my_actix_handler_1 | semmle.label | my_actix_handler_1 |
+| test.rs:133:48:133:65 | my_actix_handler_2 | semmle.label | my_actix_handler_2 |
+| test.rs:134:44:134:61 | my_actix_handler_3 | semmle.label | my_actix_handler_3 |
 | test.rs:149:14:149:14 | a | semmle.label | a |
-| test.rs:149:14:149:25 | a.as_bytes() | semmle.label | a.as_bytes() |
+| test.rs:149:14:149:23 | a.as_str() | semmle.label | a.as_str() |
 | test.rs:150:14:150:14 | a | semmle.label | a |
-| test.rs:156:14:156:14 | a | semmle.label | a |
-| test.rs:157:14:157:14 | b | semmle.label | b |
-| test.rs:164:18:164:20 | key | semmle.label | key |
-| test.rs:165:18:165:22 | value | semmle.label | value |
-| test.rs:181:14:181:20 | payload | semmle.label | payload |
-| test.rs:187:14:187:17 | body | semmle.label | body |
-| test.rs:193:14:193:17 | body | semmle.label | body |
-| test.rs:200:34:200:50 | my_axum_handler_1 | semmle.label | my_axum_handler_1 |
-| test.rs:201:39:201:55 | my_axum_handler_2 | semmle.label | my_axum_handler_2 |
-| test.rs:202:33:202:49 | my_axum_handler_3 | semmle.label | my_axum_handler_3 |
-| test.rs:205:65:205:81 | my_axum_handler_5 | semmle.label | my_axum_handler_5 |
-| test.rs:207:33:207:49 | my_axum_handler_6 | semmle.label | my_axum_handler_6 |
-| test.rs:207:56:207:72 | my_axum_handler_7 | semmle.label | my_axum_handler_7 |
-| test.rs:222:37:227:9 | \|...\| ... | semmle.label | \|...\| ... |
-| test.rs:224:18:224:18 | a | semmle.label | a |
-| test.rs:231:13:235:13 | \|...\| ... | semmle.label | \|...\| ... |
-| test.rs:232:22:232:22 | a | semmle.label | a |
-| test.rs:240:13:248:9 | \|...\| ... | semmle.label | \|...\| ... |
-| test.rs:243:22:243:23 | id | semmle.label | id |
-| test.rs:253:13:258:14 | \|...\| ... | semmle.label | \|...\| ... |
-| test.rs:255:22:255:22 | a | semmle.label | a |
+| test.rs:150:14:150:25 | a.as_bytes() | semmle.label | a.as_bytes() |
+| test.rs:151:14:151:14 | a | semmle.label | a |
+| test.rs:157:14:157:14 | a | semmle.label | a |
+| test.rs:158:14:158:14 | b | semmle.label | b |
+| test.rs:165:18:165:20 | key | semmle.label | key |
+| test.rs:166:18:166:22 | value | semmle.label | value |
+| test.rs:182:14:182:20 | payload | semmle.label | payload |
+| test.rs:188:14:188:17 | body | semmle.label | body |
+| test.rs:194:14:194:17 | body | semmle.label | body |
+| test.rs:200:14:200:20 | state.0 | semmle.label | state.0 |
+| test.rs:201:14:201:17 | body | semmle.label | body |
+| test.rs:208:34:208:50 | my_axum_handler_1 | semmle.label | my_axum_handler_1 |
+| test.rs:209:39:209:55 | my_axum_handler_2 | semmle.label | my_axum_handler_2 |
+| test.rs:210:33:210:49 | my_axum_handler_3 | semmle.label | my_axum_handler_3 |
+| test.rs:213:65:213:81 | my_axum_handler_5 | semmle.label | my_axum_handler_5 |
+| test.rs:215:33:215:49 | my_axum_handler_6 | semmle.label | my_axum_handler_6 |
+| test.rs:215:56:215:72 | my_axum_handler_7 | semmle.label | my_axum_handler_7 |
+| test.rs:216:33:216:49 | my_axum_handler_8 | semmle.label | my_axum_handler_8 |
+| test.rs:216:33:216:49 | my_axum_handler_8 | semmle.label | my_axum_handler_8 |
+| test.rs:231:37:236:9 | \|...\| ... | semmle.label | \|...\| ... |
+| test.rs:233:18:233:18 | a | semmle.label | a |
+| test.rs:240:13:244:13 | \|...\| ... | semmle.label | \|...\| ... |
+| test.rs:241:22:241:22 | a | semmle.label | a |
+| test.rs:249:13:257:9 | \|...\| ... | semmle.label | \|...\| ... |
+| test.rs:252:22:252:23 | id | semmle.label | id |
+| test.rs:262:13:267:14 | \|...\| ... | semmle.label | \|...\| ... |
+| test.rs:264:22:264:22 | a | semmle.label | a |
 subpaths
 testFailures
 #select
@@ -138,24 +144,26 @@ testFailures
 | test.rs:60:14:60:17 | ms.a | test.rs:58:14:58:15 | ms | test.rs:60:14:60:17 | ms.a | $@ | test.rs:58:14:58:15 | ms | ms |
 | test.rs:61:14:61:17 | ms.b | test.rs:58:14:58:15 | ms | test.rs:61:14:61:17 | ms.b | $@ | test.rs:58:14:58:15 | ms | ms |
 | test.rs:70:14:70:14 | a | test.rs:68:15:68:15 | a | test.rs:70:14:70:14 | a | $@ | test.rs:68:15:68:15 | a | a |
-| test.rs:99:14:99:23 | a.as_str() | test.rs:131:44:131:61 | my_actix_handler_1 | test.rs:99:14:99:23 | a.as_str() | $@ | test.rs:131:44:131:61 | my_actix_handler_1 | my_actix_handler_1 |
-| test.rs:100:14:100:25 | a.as_bytes() | test.rs:131:44:131:61 | my_actix_handler_1 | test.rs:100:14:100:25 | a.as_bytes() | $@ | test.rs:131:44:131:61 | my_actix_handler_1 | my_actix_handler_1 |
-| test.rs:101:14:101:14 | a | test.rs:131:44:131:61 | my_actix_handler_1 | test.rs:101:14:101:14 | a | $@ | test.rs:131:44:131:61 | my_actix_handler_1 | my_actix_handler_1 |
-| test.rs:109:14:109:14 | a | test.rs:132:48:132:65 | my_actix_handler_2 | test.rs:109:14:109:14 | a | $@ | test.rs:132:48:132:65 | my_actix_handler_2 | my_actix_handler_2 |
-| test.rs:110:14:110:14 | b | test.rs:132:48:132:65 | my_actix_handler_2 | test.rs:110:14:110:14 | b | $@ | test.rs:132:48:132:65 | my_actix_handler_2 | my_actix_handler_2 |
-| test.rs:116:14:116:14 | a | test.rs:133:44:133:61 | my_actix_handler_3 | test.rs:116:14:116:14 | a | $@ | test.rs:133:44:133:61 | my_actix_handler_3 | my_actix_handler_3 |
-| test.rs:124:14:124:14 | a | test.rs:122:14:122:31 | my_actix_handler_4 | test.rs:124:14:124:14 | a | $@ | test.rs:122:14:122:31 | my_actix_handler_4 | my_actix_handler_4 |
-| test.rs:148:14:148:23 | a.as_str() | test.rs:200:34:200:50 | my_axum_handler_1 | test.rs:148:14:148:23 | a.as_str() | $@ | test.rs:200:34:200:50 | my_axum_handler_1 | my_axum_handler_1 |
-| test.rs:149:14:149:25 | a.as_bytes() | test.rs:200:34:200:50 | my_axum_handler_1 | test.rs:149:14:149:25 | a.as_bytes() | $@ | test.rs:200:34:200:50 | my_axum_handler_1 | my_axum_handler_1 |
-| test.rs:150:14:150:14 | a | test.rs:200:34:200:50 | my_axum_handler_1 | test.rs:150:14:150:14 | a | $@ | test.rs:200:34:200:50 | my_axum_handler_1 | my_axum_handler_1 |
-| test.rs:156:14:156:14 | a | test.rs:201:39:201:55 | my_axum_handler_2 | test.rs:156:14:156:14 | a | $@ | test.rs:201:39:201:55 | my_axum_handler_2 | my_axum_handler_2 |
-| test.rs:157:14:157:14 | b | test.rs:201:39:201:55 | my_axum_handler_2 | test.rs:157:14:157:14 | b | $@ | test.rs:201:39:201:55 | my_axum_handler_2 | my_axum_handler_2 |
-| test.rs:164:18:164:20 | key | test.rs:202:33:202:49 | my_axum_handler_3 | test.rs:164:18:164:20 | key | $@ | test.rs:202:33:202:49 | my_axum_handler_3 | my_axum_handler_3 |
-| test.rs:165:18:165:22 | value | test.rs:202:33:202:49 | my_axum_handler_3 | test.rs:165:18:165:22 | value | $@ | test.rs:202:33:202:49 | my_axum_handler_3 | my_axum_handler_3 |
-| test.rs:181:14:181:20 | payload | test.rs:205:65:205:81 | my_axum_handler_5 | test.rs:181:14:181:20 | payload | $@ | test.rs:205:65:205:81 | my_axum_handler_5 | my_axum_handler_5 |
-| test.rs:187:14:187:17 | body | test.rs:207:33:207:49 | my_axum_handler_6 | test.rs:187:14:187:17 | body | $@ | test.rs:207:33:207:49 | my_axum_handler_6 | my_axum_handler_6 |
-| test.rs:193:14:193:17 | body | test.rs:207:56:207:72 | my_axum_handler_7 | test.rs:193:14:193:17 | body | $@ | test.rs:207:56:207:72 | my_axum_handler_7 | my_axum_handler_7 |
-| test.rs:224:18:224:18 | a | test.rs:222:37:227:9 | \|...\| ... | test.rs:224:18:224:18 | a | $@ | test.rs:222:37:227:9 | \|...\| ... | \|...\| ... |
-| test.rs:232:22:232:22 | a | test.rs:231:13:235:13 | \|...\| ... | test.rs:232:22:232:22 | a | $@ | test.rs:231:13:235:13 | \|...\| ... | \|...\| ... |
-| test.rs:243:22:243:23 | id | test.rs:240:13:248:9 | \|...\| ... | test.rs:243:22:243:23 | id | $@ | test.rs:240:13:248:9 | \|...\| ... | \|...\| ... |
-| test.rs:255:22:255:22 | a | test.rs:253:13:258:14 | \|...\| ... | test.rs:255:22:255:22 | a | $@ | test.rs:253:13:258:14 | \|...\| ... | \|...\| ... |
+| test.rs:99:14:99:23 | a.as_str() | test.rs:132:44:132:61 | my_actix_handler_1 | test.rs:99:14:99:23 | a.as_str() | $@ | test.rs:132:44:132:61 | my_actix_handler_1 | my_actix_handler_1 |
+| test.rs:100:14:100:25 | a.as_bytes() | test.rs:132:44:132:61 | my_actix_handler_1 | test.rs:100:14:100:25 | a.as_bytes() | $@ | test.rs:132:44:132:61 | my_actix_handler_1 | my_actix_handler_1 |
+| test.rs:101:14:101:14 | a | test.rs:132:44:132:61 | my_actix_handler_1 | test.rs:101:14:101:14 | a | $@ | test.rs:132:44:132:61 | my_actix_handler_1 | my_actix_handler_1 |
+| test.rs:109:14:109:14 | a | test.rs:133:48:133:65 | my_actix_handler_2 | test.rs:109:14:109:14 | a | $@ | test.rs:133:48:133:65 | my_actix_handler_2 | my_actix_handler_2 |
+| test.rs:110:14:110:14 | b | test.rs:133:48:133:65 | my_actix_handler_2 | test.rs:110:14:110:14 | b | $@ | test.rs:133:48:133:65 | my_actix_handler_2 | my_actix_handler_2 |
+| test.rs:116:14:116:14 | a | test.rs:134:44:134:61 | my_actix_handler_3 | test.rs:116:14:116:14 | a | $@ | test.rs:134:44:134:61 | my_actix_handler_3 | my_actix_handler_3 |
+| test.rs:125:14:125:14 | a | test.rs:123:14:123:31 | my_actix_handler_4 | test.rs:125:14:125:14 | a | $@ | test.rs:123:14:123:31 | my_actix_handler_4 | my_actix_handler_4 |
+| test.rs:149:14:149:23 | a.as_str() | test.rs:208:34:208:50 | my_axum_handler_1 | test.rs:149:14:149:23 | a.as_str() | $@ | test.rs:208:34:208:50 | my_axum_handler_1 | my_axum_handler_1 |
+| test.rs:150:14:150:25 | a.as_bytes() | test.rs:208:34:208:50 | my_axum_handler_1 | test.rs:150:14:150:25 | a.as_bytes() | $@ | test.rs:208:34:208:50 | my_axum_handler_1 | my_axum_handler_1 |
+| test.rs:151:14:151:14 | a | test.rs:208:34:208:50 | my_axum_handler_1 | test.rs:151:14:151:14 | a | $@ | test.rs:208:34:208:50 | my_axum_handler_1 | my_axum_handler_1 |
+| test.rs:157:14:157:14 | a | test.rs:209:39:209:55 | my_axum_handler_2 | test.rs:157:14:157:14 | a | $@ | test.rs:209:39:209:55 | my_axum_handler_2 | my_axum_handler_2 |
+| test.rs:158:14:158:14 | b | test.rs:209:39:209:55 | my_axum_handler_2 | test.rs:158:14:158:14 | b | $@ | test.rs:209:39:209:55 | my_axum_handler_2 | my_axum_handler_2 |
+| test.rs:165:18:165:20 | key | test.rs:210:33:210:49 | my_axum_handler_3 | test.rs:165:18:165:20 | key | $@ | test.rs:210:33:210:49 | my_axum_handler_3 | my_axum_handler_3 |
+| test.rs:166:18:166:22 | value | test.rs:210:33:210:49 | my_axum_handler_3 | test.rs:166:18:166:22 | value | $@ | test.rs:210:33:210:49 | my_axum_handler_3 | my_axum_handler_3 |
+| test.rs:182:14:182:20 | payload | test.rs:213:65:213:81 | my_axum_handler_5 | test.rs:182:14:182:20 | payload | $@ | test.rs:213:65:213:81 | my_axum_handler_5 | my_axum_handler_5 |
+| test.rs:188:14:188:17 | body | test.rs:215:33:215:49 | my_axum_handler_6 | test.rs:188:14:188:17 | body | $@ | test.rs:215:33:215:49 | my_axum_handler_6 | my_axum_handler_6 |
+| test.rs:194:14:194:17 | body | test.rs:215:56:215:72 | my_axum_handler_7 | test.rs:194:14:194:17 | body | $@ | test.rs:215:56:215:72 | my_axum_handler_7 | my_axum_handler_7 |
+| test.rs:200:14:200:20 | state.0 | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:200:14:200:20 | state.0 | $@ | test.rs:216:33:216:49 | my_axum_handler_8 | my_axum_handler_8 |
+| test.rs:201:14:201:17 | body | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:201:14:201:17 | body | $@ | test.rs:216:33:216:49 | my_axum_handler_8 | my_axum_handler_8 |
+| test.rs:233:18:233:18 | a | test.rs:231:37:236:9 | \|...\| ... | test.rs:233:18:233:18 | a | $@ | test.rs:231:37:236:9 | \|...\| ... | \|...\| ... |
+| test.rs:241:22:241:22 | a | test.rs:240:13:244:13 | \|...\| ... | test.rs:241:22:241:22 | a | $@ | test.rs:240:13:244:13 | \|...\| ... | \|...\| ... |
+| test.rs:252:22:252:23 | id | test.rs:249:13:257:9 | \|...\| ... | test.rs:252:22:252:23 | id | $@ | test.rs:249:13:257:9 | \|...\| ... | \|...\| ... |
+| test.rs:264:22:264:22 | a | test.rs:262:13:267:14 | \|...\| ... | test.rs:264:22:264:22 | a | $@ | test.rs:262:13:267:14 | \|...\| ... | \|...\| ... |
diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/TaintSources.expected b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/TaintSources.expected
index 456ec4949bbe..ede8cb0d4ad0 100644
--- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/TaintSources.expected
+++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/TaintSources.expected
@@ -3,123 +3,131 @@
 | test.rs:48:14:48:30 | MyStruct {...} | Flow source 'RemoteSource' of type remote (DEFAULT). |
 | test.rs:58:14:58:15 | ms | Flow source 'RemoteSource' of type remote (DEFAULT). |
 | test.rs:68:15:68:15 | a | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:122:14:122:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:122:14:122:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:122:14:122:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:122:14:122:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:122:14:122:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:122:14:122:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:122:14:122:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:122:14:122:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:131:44:131:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:131:44:131:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:131:44:131:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:131:44:131:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:131:44:131:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:131:44:131:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:131:44:131:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:131:44:131:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:132:48:132:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:132:48:132:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:132:48:132:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:132:48:132:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:132:48:132:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:132:48:132:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:132:48:132:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:132:48:132:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:133:44:133:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:133:44:133:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:133:44:133:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:133:44:133:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:133:44:133:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:133:44:133:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:133:44:133:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:133:44:133:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:200:34:200:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:200:34:200:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:200:34:200:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:200:34:200:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:200:34:200:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:200:34:200:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:200:34:200:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:200:34:200:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:201:39:201:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:201:39:201:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:201:39:201:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:201:39:201:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:201:39:201:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:201:39:201:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:201:39:201:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:201:39:201:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:202:33:202:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:202:33:202:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:202:33:202:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:202:33:202:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:202:33:202:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:202:33:202:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:202:33:202:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:202:33:202:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:21:205:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:21:205:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:21:205:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:21:205:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:21:205:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:21:205:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:21:205:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:21:205:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:65:205:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:65:205:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:65:205:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:65:205:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:65:205:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:65:205:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:65:205:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:205:65:205:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:33:207:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:33:207:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:33:207:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:33:207:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:33:207:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:33:207:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:33:207:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:33:207:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:56:207:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:56:207:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:56:207:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:56:207:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:56:207:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:56:207:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:56:207:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:207:56:207:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:222:37:227:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:222:37:227:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:222:37:227:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:222:37:227:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:222:37:227:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:222:37:227:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:222:37:227:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:222:37:227:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:231:13:235:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:231:13:235:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:231:13:235:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:231:13:235:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:231:13:235:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:231:13:235:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:231:13:235:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:231:13:235:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:240:13:248:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:240:13:248:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:240:13:248:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:240:13:248:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:240:13:248:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:240:13:248:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:240:13:248:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:240:13:248:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:253:13:258:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:253:13:258:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:253:13:258:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:253:13:258:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:253:13:258:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:253:13:258:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:253:13:258:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
-| test.rs:253:13:258:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:123:14:123:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:123:14:123:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:123:14:123:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:123:14:123:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:123:14:123:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:123:14:123:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:123:14:123:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:123:14:123:31 | my_actix_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:132:44:132:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:132:44:132:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:132:44:132:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:132:44:132:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:132:44:132:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:132:44:132:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:132:44:132:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:132:44:132:61 | my_actix_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:133:48:133:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:133:48:133:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:133:48:133:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:133:48:133:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:133:48:133:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:133:48:133:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:133:48:133:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:133:48:133:65 | my_actix_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:134:44:134:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:134:44:134:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:134:44:134:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:134:44:134:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:134:44:134:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:134:44:134:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:134:44:134:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:134:44:134:61 | my_actix_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:208:34:208:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:208:34:208:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:208:34:208:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:208:34:208:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:208:34:208:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:208:34:208:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:208:34:208:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:208:34:208:50 | my_axum_handler_1 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:209:39:209:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:209:39:209:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:209:39:209:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:209:39:209:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:209:39:209:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:209:39:209:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:209:39:209:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:209:39:209:55 | my_axum_handler_2 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:210:33:210:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:210:33:210:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:210:33:210:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:210:33:210:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:210:33:210:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:210:33:210:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:210:33:210:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:210:33:210:49 | my_axum_handler_3 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:21:213:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:21:213:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:21:213:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:21:213:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:21:213:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:21:213:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:21:213:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:21:213:37 | my_axum_handler_4 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:65:213:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:65:213:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:65:213:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:65:213:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:65:213:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:65:213:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:65:213:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:213:65:213:81 | my_axum_handler_5 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:33:215:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:33:215:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:33:215:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:33:215:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:33:215:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:33:215:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:33:215:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:33:215:49 | my_axum_handler_6 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:56:215:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:56:215:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:56:215:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:56:215:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:56:215:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:56:215:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:56:215:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:215:56:215:72 | my_axum_handler_7 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:216:33:216:49 | my_axum_handler_8 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:216:33:216:49 | my_axum_handler_8 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:216:33:216:49 | my_axum_handler_8 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:216:33:216:49 | my_axum_handler_8 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:216:33:216:49 | my_axum_handler_8 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:216:33:216:49 | my_axum_handler_8 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:216:33:216:49 | my_axum_handler_8 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:216:33:216:49 | my_axum_handler_8 | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:231:37:236:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:231:37:236:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:231:37:236:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:231:37:236:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:231:37:236:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:231:37:236:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:231:37:236:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:231:37:236:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:240:13:244:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:240:13:244:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:240:13:244:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:240:13:244:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:240:13:244:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:240:13:244:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:240:13:244:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:240:13:244:13 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:249:13:257:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:249:13:257:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:249:13:257:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:249:13:257:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:249:13:257:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:249:13:257:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:249:13:257:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:249:13:257:9 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:262:13:267:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:262:13:267:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:262:13:267:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:262:13:267:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:262:13:267:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:262:13:267:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:262:13:267:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
+| test.rs:262:13:267:14 | \|...\| ... | Flow source 'RemoteSource' of type remote (DEFAULT). |
diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs
index ab9f129dddbe..96fb7dc1b8d9 100644
--- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs
+++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs
@@ -118,6 +118,7 @@ mod actix_test {
         "".to_string()
     }
 
+    #[rustfmt::skip]
     #[get("/4/{a}")]
     async fn my_actix_handler_4(path: web::Path<String>) -> String { // $ Alert[rust/summary/taint-sources]
         let a = path.into_inner();
@@ -139,7 +140,7 @@ mod actix_test {
 
 mod axum_test {
     use super::sink;
-    use axum::extract::{Json, Path, Query, Request};
+    use axum::extract::{Json, Path, Query, Request, State};
     use axum::routing::{get, post, put, MethodFilter};
     use axum::Router;
     use std::collections::HashMap;
@@ -195,6 +196,13 @@ mod axum_test {
         ""
     }
 
+    async fn my_axum_handler_8(state: State<()>, body: String) -> &'static str {
+        sink(state.0); // $ SPURIOUS: hasTaintFlow=my_axum_handler_8
+        sink(body); // $ hasTaintFlow=my_axum_handler_8
+
+        ""
+    }
+
     async fn test_axum() {
         let app = Router::<()>::new()
             .route("/1/{a}", get(my_axum_handler_1)) // $ Alert[rust/summary/taint-sources])
@@ -204,7 +212,8 @@ mod axum_test {
                 "/4/:a",
                 get(my_axum_handler_4).on(MethodFilter::DELETE, my_axum_handler_5), // $ Alert[rust/summary/taint-sources])
             )
-            .route("/5/:a", get(my_axum_handler_6).get(my_axum_handler_7)); // $ Alert[rust/summary/taint-sources])
+            .route("/5/:a", get(my_axum_handler_6).get(my_axum_handler_7)) // $ Alert[rust/summary/taint-sources])
+            .route("/6/:a", get(my_axum_handler_8)); // $ Alert[rust/summary/taint-sources])
 
         // ...
     }

From 1dea2772fc74dec5cbe1fefa4c7a3af58bc06a6b Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 31 Aug 2026 15:34:21 +0200
Subject: [PATCH 2/2] Rust: Exclude taint-read-steps for
 `axum::extract::state::State`

---
 rust/ql/lib/codeql/rust/frameworks/axum.model.yml          | 7 ++++++-
 .../dataflow/sources/web_frameworks/InlineFlow.expected    | 4 ----
 .../library-tests/dataflow/sources/web_frameworks/test.rs  | 2 +-
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/rust/ql/lib/codeql/rust/frameworks/axum.model.yml b/rust/ql/lib/codeql/rust/frameworks/axum.model.yml
index 7ae7dec36359..55783beebf41 100644
--- a/rust/ql/lib/codeql/rust/frameworks/axum.model.yml
+++ b/rust/ql/lib/codeql/rust/frameworks/axum.model.yml
@@ -20,4 +20,9 @@ extensions:
       - ["<axum::routing::method_routing::MethodRouter>::patch", "Argument[0].Parameter[0..7]", "remote", "manual"]
       # on
       - ["axum::routing::method_routing::on", "Argument[1].Parameter[0..7]", "remote", "manual"]
-      - ["<axum::routing::method_routing::MethodRouter>::on", "Argument[1].Parameter[0..7]", "remote", "manual"]
\ No newline at end of file
+      - ["<axum::routing::method_routing::MethodRouter>::on", "Argument[1].Parameter[0..7]", "remote", "manual"]
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: excludeFieldTaintStep
+    data:
+      - ["axum::extract::state::State(0)"]
diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected
index 237b4200d8af..20fcece033fa 100644
--- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected
+++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected
@@ -55,7 +55,6 @@ edges
 | test.rs:213:65:213:81 | my_axum_handler_5 | test.rs:182:14:182:20 | payload | provenance | Src:MaD:4  |
 | test.rs:215:33:215:49 | my_axum_handler_6 | test.rs:188:14:188:17 | body | provenance | Src:MaD:8  |
 | test.rs:215:56:215:72 | my_axum_handler_7 | test.rs:194:14:194:17 | body | provenance | Src:MaD:3  |
-| test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:200:14:200:20 | state.0 | provenance | Src:MaD:8  |
 | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:201:14:201:17 | body | provenance | Src:MaD:8  |
 | test.rs:231:37:236:9 | \|...\| ... | test.rs:233:18:233:18 | a | provenance | Src:MaD:6  |
 | test.rs:240:13:244:13 | \|...\| ... | test.rs:241:22:241:22 | a | provenance | Src:MaD:7  |
@@ -113,7 +112,6 @@ nodes
 | test.rs:182:14:182:20 | payload | semmle.label | payload |
 | test.rs:188:14:188:17 | body | semmle.label | body |
 | test.rs:194:14:194:17 | body | semmle.label | body |
-| test.rs:200:14:200:20 | state.0 | semmle.label | state.0 |
 | test.rs:201:14:201:17 | body | semmle.label | body |
 | test.rs:208:34:208:50 | my_axum_handler_1 | semmle.label | my_axum_handler_1 |
 | test.rs:209:39:209:55 | my_axum_handler_2 | semmle.label | my_axum_handler_2 |
@@ -122,7 +120,6 @@ nodes
 | test.rs:215:33:215:49 | my_axum_handler_6 | semmle.label | my_axum_handler_6 |
 | test.rs:215:56:215:72 | my_axum_handler_7 | semmle.label | my_axum_handler_7 |
 | test.rs:216:33:216:49 | my_axum_handler_8 | semmle.label | my_axum_handler_8 |
-| test.rs:216:33:216:49 | my_axum_handler_8 | semmle.label | my_axum_handler_8 |
 | test.rs:231:37:236:9 | \|...\| ... | semmle.label | \|...\| ... |
 | test.rs:233:18:233:18 | a | semmle.label | a |
 | test.rs:240:13:244:13 | \|...\| ... | semmle.label | \|...\| ... |
@@ -161,7 +158,6 @@ testFailures
 | test.rs:182:14:182:20 | payload | test.rs:213:65:213:81 | my_axum_handler_5 | test.rs:182:14:182:20 | payload | $@ | test.rs:213:65:213:81 | my_axum_handler_5 | my_axum_handler_5 |
 | test.rs:188:14:188:17 | body | test.rs:215:33:215:49 | my_axum_handler_6 | test.rs:188:14:188:17 | body | $@ | test.rs:215:33:215:49 | my_axum_handler_6 | my_axum_handler_6 |
 | test.rs:194:14:194:17 | body | test.rs:215:56:215:72 | my_axum_handler_7 | test.rs:194:14:194:17 | body | $@ | test.rs:215:56:215:72 | my_axum_handler_7 | my_axum_handler_7 |
-| test.rs:200:14:200:20 | state.0 | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:200:14:200:20 | state.0 | $@ | test.rs:216:33:216:49 | my_axum_handler_8 | my_axum_handler_8 |
 | test.rs:201:14:201:17 | body | test.rs:216:33:216:49 | my_axum_handler_8 | test.rs:201:14:201:17 | body | $@ | test.rs:216:33:216:49 | my_axum_handler_8 | my_axum_handler_8 |
 | test.rs:233:18:233:18 | a | test.rs:231:37:236:9 | \|...\| ... | test.rs:233:18:233:18 | a | $@ | test.rs:231:37:236:9 | \|...\| ... | \|...\| ... |
 | test.rs:241:22:241:22 | a | test.rs:240:13:244:13 | \|...\| ... | test.rs:241:22:241:22 | a | $@ | test.rs:240:13:244:13 | \|...\| ... | \|...\| ... |
diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs
index 96fb7dc1b8d9..b9d05a5816aa 100644
--- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs
+++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs
@@ -197,7 +197,7 @@ mod axum_test {
     }
 
     async fn my_axum_handler_8(state: State<()>, body: String) -> &'static str {
-        sink(state.0); // $ SPURIOUS: hasTaintFlow=my_axum_handler_8
+        sink(state.0);
         sink(body); // $ hasTaintFlow=my_axum_handler_8
 
         ""