Rust: Address unsafe deserialization review feedback

Fix canonical deserialization model paths and JSON string payload handling. Add model and query-help regression coverage with generated expected results, mark known false positives, and correct query-help references.

Author: lcmangalagiri

rust/ql/lib/codeql/rust/frameworks/serde.model.yml

@@ -4,21 +4,22 @@ extensions:
       extensible: sinkModel
     data:
       # serde_json deserialization functions
-      - ["crate::serde_json::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
-      - ["crate::serde_json::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
-      - ["crate::serde_json::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
-      - ["crate::serde_json::from_value", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["serde_json::de::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["serde_json::de::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["serde_json::de::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["serde_json::value::from_value", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["serde_json::value::from_value", "Argument[0].Field[serde_json::value::Value::String(0)]", "unsafe-deserialization", "manual"]
       # bincode deserialization functions
-      - ["crate::bincode::deserialize", "Argument[0]", "unsafe-deserialization", "manual"]
-      - ["crate::bincode::deserialize_from", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["bincode::deserialize", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["bincode::deserialize_from", "Argument[0]", "unsafe-deserialization", "manual"]
       # rmp_serde (MessagePack) deserialization functions
-      - ["crate::rmp_serde::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
-      - ["crate::rmp_serde::from_read", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["rmp_serde::decode::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["rmp_serde::decode::from_read", "Argument[0]", "unsafe-deserialization", "manual"]
       # ciborium (CBOR) deserialization functions
-      - ["crate::ciborium::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["ciborium::de::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
       # serde_yaml deserialization functions
-      - ["crate::serde_yaml::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
-      - ["crate::serde_yaml::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
-      - ["crate::serde_yaml::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["serde_yaml::de::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["serde_yaml::de::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["serde_yaml::de::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
       # toml deserialization
-      - ["crate::toml::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["toml::de::from_str", "Argument[0]", "unsafe-deserialization", "manual"]

rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.qhelp

@@ -39,8 +39,7 @@ A safer approach validates the input size and uses strict deserialization settin
 </example>
 <references>
 
-<li>OWASP: <a href="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/16-Testing_for_HTTP_Incoming_Requests">Deserialization of untrusted data</a>.</li>
-<li>CWE-502: <a href="https://cwe.mitre.org/data/definitions/502.html">Deserialization of Untrusted Data</a>.</li>
+<li>OWASP: <a href="https://community.owasp.org/vulnerabilities/Deserialization_of_untrusted_data">Deserialization of untrusted data</a>.</li>
 
 </references>
 </qhelp>