Skip to content

Commit 539f8f0

Browse files
geoffw0geoffw0
committed
Swift: Add mid-level CryptoSwift sinks and prevent duplication that results. Overall this doesn't give us any new results in tests, but makes paths shorter, and in the real world I expect it to add reliability.
1 parent 51a62b5 commit 539f8f0

File tree

3 files changed

+17
-20
lines changed

3 files changed

+17
-20
lines changed

‎swift/ql/lib/codeql/swift/security/WeakSensitiveDataHashingExtensions.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ private class WeakHashingSinks extends SinkModelCsv {
5353
";SHA1;true;calculate(for:);;;Argument[0];weak-hash-input-SHA1",
5454
";SHA1;true;callAsFunction(_:);;;Argument[0];weak-hash-input-SHA1",
5555
";SHA1;true;update(withBytes:isLast:);;;Argument[0];weak-hash-input-SHA1",
56+
";Digest;true;md5(_:);;;Argument[0];weak-hash-input-MD5",
57+
";Digest;true;sha1(_:);;;Argument[0];weak-hash-input-SHA1",
5658
]
5759
}
5860
}

‎swift/ql/lib/codeql/swift/security/WeakSensitiveDataHashingQuery.qll

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ module WeakHashingConfig implements DataFlow::ConfigSig {
2525
isSource(node)
2626
}
2727

28+
predicate isBarrierOut(DataFlow::Node node) {
29+
// make sinks barriers so that we only report the closest instance
30+
isSink(node)
31+
}
32+
2833
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
2934
any(WeakSensitiveDataHashingAdditionalTaintStep s).step(nodeFrom, nodeTo)
3035
}

‎swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected

Lines changed: 10 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
edges
2-
| testCryptoSwift.swift:38:21:38:41 | bytes : | testCryptoSwift.swift:39:37:39:37 | bytes |
3-
| testCryptoSwift.swift:42:22:42:42 | bytes : | testCryptoSwift.swift:43:38:43:38 | bytes |
4-
| testCryptoSwift.swift:60:10:60:10 | self : | testCryptoSwift.swift:61:27:61:27 | self : |
5-
| testCryptoSwift.swift:61:27:61:27 | self : | testCryptoSwift.swift:38:21:38:41 | bytes : |
6-
| testCryptoSwift.swift:64:10:64:10 | self : | testCryptoSwift.swift:65:28:65:28 | self : |
7-
| testCryptoSwift.swift:65:28:65:28 | self : | testCryptoSwift.swift:42:22:42:42 | bytes : |
8-
| testCryptoSwift.swift:120:20:120:20 | passwdArray : | testCryptoSwift.swift:38:21:38:41 | bytes : |
9-
| testCryptoSwift.swift:122:21:122:21 | passwdArray : | testCryptoSwift.swift:42:22:42:42 | bytes : |
2+
| testCryptoSwift.swift:60:10:60:10 | self : | testCryptoSwift.swift:61:27:61:27 | self |
3+
| testCryptoSwift.swift:64:10:64:10 | self : | testCryptoSwift.swift:65:28:65:28 | self |
104
| testCryptoSwift.swift:127:9:127:9 | passwdArray : | testCryptoSwift.swift:60:10:60:10 | self : |
115
| testCryptoSwift.swift:129:9:129:9 | passwdArray : | testCryptoSwift.swift:64:10:64:10 | self : |
126
nodes
@@ -23,18 +17,14 @@ nodes
2317
| testCryptoKit.swift:136:32:136:32 | credit_card_no | semmle.label | credit_card_no |
2418
| testCryptoKit.swift:141:32:141:32 | passwd | semmle.label | passwd |
2519
| testCryptoKit.swift:145:32:145:32 | credit_card_no | semmle.label | credit_card_no |
26-
| testCryptoSwift.swift:38:21:38:41 | bytes : | semmle.label | bytes : |
27-
| testCryptoSwift.swift:39:37:39:37 | bytes | semmle.label | bytes |
28-
| testCryptoSwift.swift:42:22:42:42 | bytes : | semmle.label | bytes : |
29-
| testCryptoSwift.swift:43:38:43:38 | bytes | semmle.label | bytes |
3020
| testCryptoSwift.swift:60:10:60:10 | self : | semmle.label | self : |
31-
| testCryptoSwift.swift:61:27:61:27 | self : | semmle.label | self : |
21+
| testCryptoSwift.swift:61:27:61:27 | self | semmle.label | self |
3222
| testCryptoSwift.swift:64:10:64:10 | self : | semmle.label | self : |
33-
| testCryptoSwift.swift:65:28:65:28 | self : | semmle.label | self : |
23+
| testCryptoSwift.swift:65:28:65:28 | self | semmle.label | self |
3424
| testCryptoSwift.swift:113:30:113:30 | passwdArray | semmle.label | passwdArray |
3525
| testCryptoSwift.swift:115:31:115:31 | passwdArray | semmle.label | passwdArray |
36-
| testCryptoSwift.swift:120:20:120:20 | passwdArray : | semmle.label | passwdArray : |
37-
| testCryptoSwift.swift:122:21:122:21 | passwdArray : | semmle.label | passwdArray : |
26+
| testCryptoSwift.swift:120:20:120:20 | passwdArray | semmle.label | passwdArray |
27+
| testCryptoSwift.swift:122:21:122:21 | passwdArray | semmle.label | passwdArray |
3828
| testCryptoSwift.swift:127:9:127:9 | passwdArray : | semmle.label | passwdArray : |
3929
| testCryptoSwift.swift:129:9:129:9 | passwdArray : | semmle.label | passwdArray : |
4030
subpaths
@@ -52,9 +42,9 @@ subpaths
5242
| testCryptoKit.swift:136:32:136:32 | credit_card_no | testCryptoKit.swift:136:32:136:32 | credit_card_no | testCryptoKit.swift:136:32:136:32 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:136:32:136:32 | credit_card_no | sensitive data (private information credit_card_no) |
5343
| testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:141:32:141:32 | passwd | sensitive data (credential passwd) |
5444
| testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:145:32:145:32 | credit_card_no | sensitive data (private information credit_card_no) |
55-
| testCryptoSwift.swift:39:37:39:37 | bytes | testCryptoSwift.swift:120:20:120:20 | passwdArray : | testCryptoSwift.swift:39:37:39:37 | bytes | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:120:20:120:20 | passwdArray | sensitive data (credential passwdArray) |
56-
| testCryptoSwift.swift:39:37:39:37 | bytes | testCryptoSwift.swift:127:9:127:9 | passwdArray : | testCryptoSwift.swift:39:37:39:37 | bytes | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:127:9:127:9 | passwdArray | sensitive data (credential passwdArray) |
57-
| testCryptoSwift.swift:43:38:43:38 | bytes | testCryptoSwift.swift:122:21:122:21 | passwdArray : | testCryptoSwift.swift:43:38:43:38 | bytes | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:122:21:122:21 | passwdArray | sensitive data (credential passwdArray) |
58-
| testCryptoSwift.swift:43:38:43:38 | bytes | testCryptoSwift.swift:129:9:129:9 | passwdArray : | testCryptoSwift.swift:43:38:43:38 | bytes | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:129:9:129:9 | passwdArray | sensitive data (credential passwdArray) |
45+
| testCryptoSwift.swift:61:27:61:27 | self | testCryptoSwift.swift:127:9:127:9 | passwdArray : | testCryptoSwift.swift:61:27:61:27 | self | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:127:9:127:9 | passwdArray | sensitive data (credential passwdArray) |
46+
| testCryptoSwift.swift:65:28:65:28 | self | testCryptoSwift.swift:129:9:129:9 | passwdArray : | testCryptoSwift.swift:65:28:65:28 | self | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:129:9:129:9 | passwdArray | sensitive data (credential passwdArray) |
5947
| testCryptoSwift.swift:113:30:113:30 | passwdArray | testCryptoSwift.swift:113:30:113:30 | passwdArray | testCryptoSwift.swift:113:30:113:30 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:113:30:113:30 | passwdArray | sensitive data (credential passwdArray) |
6048
| testCryptoSwift.swift:115:31:115:31 | passwdArray | testCryptoSwift.swift:115:31:115:31 | passwdArray | testCryptoSwift.swift:115:31:115:31 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:115:31:115:31 | passwdArray | sensitive data (credential passwdArray) |
49+
| testCryptoSwift.swift:120:20:120:20 | passwdArray | testCryptoSwift.swift:120:20:120:20 | passwdArray | testCryptoSwift.swift:120:20:120:20 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:120:20:120:20 | passwdArray | sensitive data (credential passwdArray) |
50+
| testCryptoSwift.swift:122:21:122:21 | passwdArray | testCryptoSwift.swift:122:21:122:21 | passwdArray | testCryptoSwift.swift:122:21:122:21 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:122:21:122:21 | passwdArray | sensitive data (credential passwdArray) |

0 commit comments

Comments
 (0)