Rust: Address result duplication in rust/hard-coded-cryptographic-value

[geoffw0]

Small fix for a result duplication issue in rust/hard-coded-cryptographic-value. The issue is a match expression containing constants in each or many of the match arms, for example (from the test):

let str3 = match(val) {
    0 => "one", // constant
    1 => "two", // constant
    _ => "many" // constant
}

It turns out this can cause quite severe multiplication of results in rare cases (e.g. imagine the above but with 100 cases, and flowing to 20 sinks). The solution is to make the match expression itself the source, as it's close enough to see what's going on with just one result.

[Copilot]

Pull request overview

Collapses constant match-arm sources into the enclosing match expression, preventing duplicate cryptographic-value alerts.

Changes:

• Treats qualifying match expressions as constant sources.
• Adds regression coverage and updates expected results.
• Documents the analysis improvement.

Show a summary per file

File	Description
HardcodedCryptographicValueExtensions.qll	Adds match-expression source aggregation.
test_cookie.rs	Adds regression test coverage.
HardcodedCryptographicValue.expected	Updates generated expectations.
2026-08-25-hardcoded-cryptographic-match-expressions.md	Adds change note.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

[hvitved]

I suggest renaming this to hasConstant and updating the QL doc accordingly. Then you can also change the forex below with exists, which means that ["hello", "world", i] would also only have the entire array as a reported source instead of the two string constants.

[geoffw0]

I agree on both counts - hasConstant is a better name for exactly what this is, and the behaviour for arrays should be consistent with the behaviour for match arms. I've made both changes.