Skip to content

Commit 0741266

Browse files
geoffw0geoffw0
committed
Swift: Switch from isSanitizerIn to isSanitizer.
1 parent 8281d92 commit 0741266

File tree

4 files changed

+8
-27
lines changed

4 files changed

+8
-27
lines changed

‎swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,9 @@ class CleartextStorageConfig extends TaintTracking::Configuration {
8282
override predicate isSanitizerIn(DataFlow::Node node) {
8383
// make sources barriers so that we only report the closest instance
8484
isSource(node)
85-
or
85+
}
86+
87+
override predicate isSanitizer(DataFlow::Node node) {
8688
// encryption barrier
8789
node.asExpr() instanceof EncryptedExpr
8890
}

‎swift/ql/src/queries/Security/CWE-311/CleartextTransmission.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,9 @@ class CleartextTransmissionConfig extends TaintTracking::Configuration {
7575
override predicate isSanitizerIn(DataFlow::Node node) {
7676
// make sources barriers so that we only report the closest instance
7777
isSource(node)
78-
or
78+
}
79+
80+
override predicate isSanitizer(DataFlow::Node node) {
7981
// encryption barrier
8082
node.asExpr() instanceof EncryptedExpr
8183
}

‎swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,35 @@
11
edges
22
| testSend.swift:41:10:41:18 | data : | testSend.swift:41:45:41:45 | data : |
3-
| testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : |
43
| testSend.swift:45:13:45:13 | password : | testSend.swift:52:27:52:27 | str1 |
54
| testSend.swift:46:13:46:13 | password : | testSend.swift:53:27:53:27 | str2 |
65
| testSend.swift:47:13:47:25 | call to pad(_:) : | testSend.swift:54:27:54:27 | str3 |
76
| testSend.swift:47:17:47:17 | password : | testSend.swift:41:10:41:18 | data : |
87
| testSend.swift:47:17:47:17 | password : | testSend.swift:47:13:47:25 | call to pad(_:) : |
9-
| testSend.swift:48:13:48:31 | call to aes_crypt(_:) : | testSend.swift:55:27:55:27 | str4 |
10-
| testSend.swift:48:23:48:23 | password : | testSend.swift:42:16:42:24 | data : |
11-
| testSend.swift:48:23:48:23 | password : | testSend.swift:48:13:48:31 | call to aes_crypt(_:) : |
12-
| testSend.swift:49:13:49:36 | call to pad(_:) : | testSend.swift:56:27:56:27 | str5 |
13-
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | testSend.swift:41:10:41:18 | data : |
14-
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | testSend.swift:49:13:49:36 | call to pad(_:) : |
15-
| testSend.swift:49:27:49:27 | password : | testSend.swift:42:16:42:24 | data : |
16-
| testSend.swift:49:27:49:27 | password : | testSend.swift:49:17:49:35 | call to aes_crypt(_:) : |
178
| testURL.swift:13:54:13:54 | passwd : | testURL.swift:13:22:13:54 | ... .+(_:_:) ... |
189
| testURL.swift:16:55:16:55 | credit_card_no : | testURL.swift:16:22:16:55 | ... .+(_:_:) ... |
1910
nodes
2011
| testSend.swift:29:19:29:19 | passwordPlain | semmle.label | passwordPlain |
2112
| testSend.swift:41:10:41:18 | data : | semmle.label | data : |
2213
| testSend.swift:41:45:41:45 | data : | semmle.label | data : |
23-
| testSend.swift:42:16:42:24 | data : | semmle.label | data : |
24-
| testSend.swift:42:51:42:51 | data : | semmle.label | data : |
2514
| testSend.swift:45:13:45:13 | password : | semmle.label | password : |
2615
| testSend.swift:46:13:46:13 | password : | semmle.label | password : |
2716
| testSend.swift:47:13:47:25 | call to pad(_:) : | semmle.label | call to pad(_:) : |
2817
| testSend.swift:47:17:47:17 | password : | semmle.label | password : |
29-
| testSend.swift:48:13:48:31 | call to aes_crypt(_:) : | semmle.label | call to aes_crypt(_:) : |
30-
| testSend.swift:48:23:48:23 | password : | semmle.label | password : |
31-
| testSend.swift:49:13:49:36 | call to pad(_:) : | semmle.label | call to pad(_:) : |
32-
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | semmle.label | call to aes_crypt(_:) : |
33-
| testSend.swift:49:27:49:27 | password : | semmle.label | password : |
3418
| testSend.swift:52:27:52:27 | str1 | semmle.label | str1 |
3519
| testSend.swift:53:27:53:27 | str2 | semmle.label | str2 |
3620
| testSend.swift:54:27:54:27 | str3 | semmle.label | str3 |
37-
| testSend.swift:55:27:55:27 | str4 | semmle.label | str4 |
38-
| testSend.swift:56:27:56:27 | str5 | semmle.label | str5 |
3921
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4022
| testURL.swift:13:54:13:54 | passwd : | semmle.label | passwd : |
4123
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4224
| testURL.swift:16:55:16:55 | credit_card_no : | semmle.label | credit_card_no : |
4325
| testURL.swift:20:22:20:22 | passwd | semmle.label | passwd |
4426
subpaths
4527
| testSend.swift:47:17:47:17 | password : | testSend.swift:41:10:41:18 | data : | testSend.swift:41:45:41:45 | data : | testSend.swift:47:13:47:25 | call to pad(_:) : |
46-
| testSend.swift:48:23:48:23 | password : | testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : | testSend.swift:48:13:48:31 | call to aes_crypt(_:) : |
47-
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | testSend.swift:41:10:41:18 | data : | testSend.swift:41:45:41:45 | data : | testSend.swift:49:13:49:36 | call to pad(_:) : |
48-
| testSend.swift:49:27:49:27 | password : | testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : | testSend.swift:49:17:49:35 | call to aes_crypt(_:) : |
4928
#select
5029
| testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | This operation transmits 'passwordPlain', which may contain unencrypted sensitive data from $@ | testSend.swift:29:19:29:19 | passwordPlain | passwordPlain |
5130
| testSend.swift:52:27:52:27 | str1 | testSend.swift:45:13:45:13 | password : | testSend.swift:52:27:52:27 | str1 | This operation transmits 'str1', which may contain unencrypted sensitive data from $@ | testSend.swift:45:13:45:13 | password : | password |
5231
| testSend.swift:53:27:53:27 | str2 | testSend.swift:46:13:46:13 | password : | testSend.swift:53:27:53:27 | str2 | This operation transmits 'str2', which may contain unencrypted sensitive data from $@ | testSend.swift:46:13:46:13 | password : | password |
5332
| testSend.swift:54:27:54:27 | str3 | testSend.swift:47:17:47:17 | password : | testSend.swift:54:27:54:27 | str3 | This operation transmits 'str3', which may contain unencrypted sensitive data from $@ | testSend.swift:47:17:47:17 | password : | password |
54-
| testSend.swift:55:27:55:27 | str4 | testSend.swift:48:23:48:23 | password : | testSend.swift:55:27:55:27 | str4 | This operation transmits 'str4', which may contain unencrypted sensitive data from $@ | testSend.swift:48:23:48:23 | password : | password |
55-
| testSend.swift:56:27:56:27 | str5 | testSend.swift:49:27:49:27 | password : | testSend.swift:56:27:56:27 | str5 | This operation transmits 'str5', which may contain unencrypted sensitive data from $@ | testSend.swift:49:27:49:27 | password : | password |
5633
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | testURL.swift:13:54:13:54 | passwd : | testURL.swift:13:22:13:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@ | testURL.swift:13:54:13:54 | passwd : | passwd |
5734
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | testURL.swift:16:55:16:55 | credit_card_no : | testURL.swift:16:22:16:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@ | testURL.swift:16:55:16:55 | credit_card_no : | credit_card_no |
5835
| testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@ | testURL.swift:20:22:20:22 | passwd | passwd |

‎swift/ql/test/query-tests/Security/CWE-311/testSend.swift

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ func test2(password : String, connection : NWConnection) {
5252
connection.send(content: str1, completion: .idempotent) // BAD
5353
connection.send(content: str2, completion: .idempotent) // BAD
5454
connection.send(content: str3, completion: .idempotent) // BAD
55-
connection.send(content: str4, completion: .idempotent) // GOOD (encrypted) [FALSE POSITIVE]
56-
connection.send(content: str5, completion: .idempotent) // GOOD (encrypted) [FALSE POSITIVE]
55+
connection.send(content: str4, completion: .idempotent) // GOOD (encrypted)
56+
connection.send(content: str5, completion: .idempotent) // GOOD (encrypted)
5757
connection.send(content: str6, completion: .idempotent) // GOOD (encrypted)
5858
}

0 commit comments

Comments
 (0)