Skip to content

Commit 51a62b5

Browse files
geoffw0geoffw0
committed
Swift: Add low-level CryptoSwift sinks.
1 parent d299d92 commit 51a62b5

File tree

3 files changed

+43
-6
lines changed

3 files changed

+43
-6
lines changed

‎swift/ql/lib/codeql/swift/security/WeakSensitiveDataHashingExtensions.qll

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,13 @@ private class WeakHashingSinks extends SinkModelCsv {
4646
";Insecure.SHA1;true;hash(data:);;;Argument[0];weak-hash-input-SHA1",
4747
";Insecure.SHA1;true;update(data:);;;Argument[0];weak-hash-input-SHA1",
4848
";Insecure.SHA1;true;update(bufferPointer:);;;Argument[0];weak-hash-input-SHA1",
49+
// CryptoSwift
50+
";MD5;true;calculate(for:);;;Argument[0];weak-hash-input-MD5",
51+
";MD5;true;callAsFunction(_:);;;Argument[0];weak-hash-input-MD5",
52+
";MD5;true;update(withBytes:isLast:);;;Argument[0];weak-hash-input-MD5",
53+
";SHA1;true;calculate(for:);;;Argument[0];weak-hash-input-SHA1",
54+
";SHA1;true;callAsFunction(_:);;;Argument[0];weak-hash-input-SHA1",
55+
";SHA1;true;update(withBytes:isLast:);;;Argument[0];weak-hash-input-SHA1",
4956
]
5057
}
5158
}

‎swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,14 @@
11
edges
2+
| testCryptoSwift.swift:38:21:38:41 | bytes : | testCryptoSwift.swift:39:37:39:37 | bytes |
3+
| testCryptoSwift.swift:42:22:42:42 | bytes : | testCryptoSwift.swift:43:38:43:38 | bytes |
4+
| testCryptoSwift.swift:60:10:60:10 | self : | testCryptoSwift.swift:61:27:61:27 | self : |
5+
| testCryptoSwift.swift:61:27:61:27 | self : | testCryptoSwift.swift:38:21:38:41 | bytes : |
6+
| testCryptoSwift.swift:64:10:64:10 | self : | testCryptoSwift.swift:65:28:65:28 | self : |
7+
| testCryptoSwift.swift:65:28:65:28 | self : | testCryptoSwift.swift:42:22:42:42 | bytes : |
8+
| testCryptoSwift.swift:120:20:120:20 | passwdArray : | testCryptoSwift.swift:38:21:38:41 | bytes : |
9+
| testCryptoSwift.swift:122:21:122:21 | passwdArray : | testCryptoSwift.swift:42:22:42:42 | bytes : |
10+
| testCryptoSwift.swift:127:9:127:9 | passwdArray : | testCryptoSwift.swift:60:10:60:10 | self : |
11+
| testCryptoSwift.swift:129:9:129:9 | passwdArray : | testCryptoSwift.swift:64:10:64:10 | self : |
212
nodes
313
| testCryptoKit.swift:56:47:56:47 | passwd | semmle.label | passwd |
414
| testCryptoKit.swift:60:43:60:43 | credit_card_no | semmle.label | credit_card_no |
@@ -13,6 +23,20 @@ nodes
1323
| testCryptoKit.swift:136:32:136:32 | credit_card_no | semmle.label | credit_card_no |
1424
| testCryptoKit.swift:141:32:141:32 | passwd | semmle.label | passwd |
1525
| testCryptoKit.swift:145:32:145:32 | credit_card_no | semmle.label | credit_card_no |
26+
| testCryptoSwift.swift:38:21:38:41 | bytes : | semmle.label | bytes : |
27+
| testCryptoSwift.swift:39:37:39:37 | bytes | semmle.label | bytes |
28+
| testCryptoSwift.swift:42:22:42:42 | bytes : | semmle.label | bytes : |
29+
| testCryptoSwift.swift:43:38:43:38 | bytes | semmle.label | bytes |
30+
| testCryptoSwift.swift:60:10:60:10 | self : | semmle.label | self : |
31+
| testCryptoSwift.swift:61:27:61:27 | self : | semmle.label | self : |
32+
| testCryptoSwift.swift:64:10:64:10 | self : | semmle.label | self : |
33+
| testCryptoSwift.swift:65:28:65:28 | self : | semmle.label | self : |
34+
| testCryptoSwift.swift:113:30:113:30 | passwdArray | semmle.label | passwdArray |
35+
| testCryptoSwift.swift:115:31:115:31 | passwdArray | semmle.label | passwdArray |
36+
| testCryptoSwift.swift:120:20:120:20 | passwdArray : | semmle.label | passwdArray : |
37+
| testCryptoSwift.swift:122:21:122:21 | passwdArray : | semmle.label | passwdArray : |
38+
| testCryptoSwift.swift:127:9:127:9 | passwdArray : | semmle.label | passwdArray : |
39+
| testCryptoSwift.swift:129:9:129:9 | passwdArray : | semmle.label | passwdArray : |
1640
subpaths
1741
#select
1842
| testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:56:47:56:47 | passwd | sensitive data (credential passwd) |
@@ -28,3 +52,9 @@ subpaths
2852
| testCryptoKit.swift:136:32:136:32 | credit_card_no | testCryptoKit.swift:136:32:136:32 | credit_card_no | testCryptoKit.swift:136:32:136:32 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:136:32:136:32 | credit_card_no | sensitive data (private information credit_card_no) |
2953
| testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:141:32:141:32 | passwd | sensitive data (credential passwd) |
3054
| testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:145:32:145:32 | credit_card_no | sensitive data (private information credit_card_no) |
55+
| testCryptoSwift.swift:39:37:39:37 | bytes | testCryptoSwift.swift:120:20:120:20 | passwdArray : | testCryptoSwift.swift:39:37:39:37 | bytes | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:120:20:120:20 | passwdArray | sensitive data (credential passwdArray) |
56+
| testCryptoSwift.swift:39:37:39:37 | bytes | testCryptoSwift.swift:127:9:127:9 | passwdArray : | testCryptoSwift.swift:39:37:39:37 | bytes | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:127:9:127:9 | passwdArray | sensitive data (credential passwdArray) |
57+
| testCryptoSwift.swift:43:38:43:38 | bytes | testCryptoSwift.swift:122:21:122:21 | passwdArray : | testCryptoSwift.swift:43:38:43:38 | bytes | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:122:21:122:21 | passwdArray | sensitive data (credential passwdArray) |
58+
| testCryptoSwift.swift:43:38:43:38 | bytes | testCryptoSwift.swift:129:9:129:9 | passwdArray : | testCryptoSwift.swift:43:38:43:38 | bytes | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:129:9:129:9 | passwdArray | sensitive data (credential passwdArray) |
59+
| testCryptoSwift.swift:113:30:113:30 | passwdArray | testCryptoSwift.swift:113:30:113:30 | passwdArray | testCryptoSwift.swift:113:30:113:30 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:113:30:113:30 | passwdArray | sensitive data (credential passwdArray) |
60+
| testCryptoSwift.swift:115:31:115:31 | passwdArray | testCryptoSwift.swift:115:31:115:31 | passwdArray | testCryptoSwift.swift:115:31:115:31 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:115:31:115:31 | passwdArray | sensitive data (credential passwdArray) |

‎swift/ql/test/query-tests/Security/CWE-328/testCryptoSwift.swift

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -110,23 +110,23 @@ extension String {
110110

111111
func testArrays(harmlessArray: Array<UInt8>, passwdArray: Array<UInt8>) {
112112
_ = MD5().calculate(for: harmlessArray) // GOOD (not sensitive)
113-
_ = MD5().calculate(for: passwdArray) // BAD [NOT DETECTED]
113+
_ = MD5().calculate(for: passwdArray) // BAD
114114
_ = SHA1().calculate(for: harmlessArray) // GOOD (not sensitive)
115-
_ = SHA1().calculate(for: passwdArray) // BAD [NOT DETECTED]
115+
_ = SHA1().calculate(for: passwdArray) // BAD
116116
_ = SHA2(variant: .sha512).calculate(for: harmlessArray) // GOOD
117117
_ = SHA2(variant: .sha512).calculate(for: passwdArray) // GOOD
118118

119119
_ = Digest.md5(harmlessArray) // GOOD (not sensitive)
120-
_ = Digest.md5(passwdArray) // BAD [NOT DETECTED]
120+
_ = Digest.md5(passwdArray) // BAD
121121
_ = Digest.sha1(harmlessArray) // GOOD (not sensitive)
122-
_ = Digest.sha1(passwdArray) // BAD [NOT DETECTED]
122+
_ = Digest.sha1(passwdArray) // BAD
123123
_ = Digest.sha512(harmlessArray) // GOOD
124124
_ = Digest.sha512(passwdArray) // GOOD
125125

126126
_ = harmlessArray.md5() // GOOD (not sensitive)
127-
_ = passwdArray.md5() // BAD [NOT DETECTED]
127+
_ = passwdArray.md5() // BAD
128128
_ = harmlessArray.sha1() // GOOD (not sensitive)
129-
_ = passwdArray.sha1() // BAD [NOT DETECTED]
129+
_ = passwdArray.sha1() // BAD
130130
_ = harmlessArray.sha512() // GOOD
131131
_ = passwdArray.sha512() // GOOD
132132
}

0 commit comments

Comments
 (0)