Rust: Add command injection (CWE-078) and unsafe deserialization (CWE-502) queries

[lcmangalagiri]

Summary
Add two new security queries for Rust, which currently has no experimental queries.

1. Command Injection (CWE-078):

   • Detects user-controlled data flowing into std::process::Command and tokio::process::Command (both command name and arguments)
   • Includes models-as-data sinks for Command::new, .arg(), .args()
   • Query ID: rust/command-line-injection

2. Unsafe Deserialization (CWE-502):

   • Detects user-controlled data flowing into deserialization functions (serde_json, bincode, rmp_serde, ciborium, serde_yaml, toml)
   • Query ID: rust/unsafe-deserialization

Both queries include:

• Extension libraries with sources, sinks, and barriers
• Query help (.qhelp) with examples
• Test cases with inline expectations
• Models-as-data sink definitions

[geoffw0]

Initial thoughts:

• this is a really welcome contribution! 🎉
• broadly everything that should be here appears to be here (tests, docs etc), apart from change notes and updating the suites list (I can help with both later).
• the standard of CodeQL etc and consistency with the rest of the query suite appears to be good. 👍
• I'm doing some bulk runs (MRVA), so far its found a handful of good results for rust/command-line-injection. 👍

I'm guessing much of this was generated by Copilot or a similar tool, with some human review / guidance / iteration. Please correct me if my assumption is wrong. What kind of verification have you done? Are there any areas you're less confident about. How were the security-severity tags generated? All this should help us review effectively.

Also please could you split this pull request in two - one PR for each query. That should help review and will prevent one query from holding up the other.

[lcmangalagiri]

Yes. Code Comments, formatting and documentation are validated and auto-generated using tooling with thorough human review iterations from my end.

Also please find the below requested answers for your reference:

1. What verifications were done:

• Followed the exact structural patterns from existing Rust queries (SqlInjection, RequestForgery) for .ql, .qll, .qhelp, .qlref, options.yml, and test files
• Verified the sinkNode/barrierNode API matches the established pattern in other Extensions files
• Confirmed models-as-data YAML format matches existing files (fs.model.yml, etc.)
• Verified utils/test/InlineExpectationsTestQuery.ql and PrettyPrintModels.ql exist in the expected location
• Checked that no command injection or deserialization query already exists for Rust

2. Areas of Lower Confidence:

a) Area: .expected files missing
Concern: Tests need .expected files generated from a first run. These don't exist yet — the first test run will fail until they're created.
b) Area: Command::arg() as a sink
Concern: Flagging every .arg() call may produce false positives. A hardcoded command with user-controlled arguments (e.g., Command::new("grep").arg(user_input)) is less severe than user-controlled shell commands. The query doesn't distinguish these.

3. How security-severity was determined:

I copied the values from equivalent queries (rust/command-line-injection, rust/unsafe-deserialization) in other languages.
These are not empirically calibrated for Rust. The Rust memory safety model arguably makes deserialization less exploitable than in Java, so CWE-502 could reasonably be lowered to 7.5-8.0 for Rust. I kept 9.8 for consistency with other languages.