Skip to content

Commit 8281d92

Browse files
geoffw0geoffw0
committed
Swift: Add barriers for encryption.
1 parent 9683a95 commit 8281d92

File tree

7 files changed

+22
-40
lines changed

7 files changed

+22
-40
lines changed

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,3 +154,16 @@ class SensitiveExpr extends Expr {
154154
*/
155155
predicate isProbablySafe() { label.toLowerCase().regexpMatch(regexpProbablySafe()) }
156156
}
157+
158+
/**
159+
* An expression that may be protected with encryption, for example an
160+
* argument to a function called "encrypt".
161+
*/
162+
class EncryptedExpr extends Expr {
163+
EncryptedExpr() {
164+
exists(CallExpr call |
165+
call.getStaticTarget().getName().regexpMatch(".*(crypt|hash|encode|protect).*") and
166+
call.getAnArgument().getExpr() = this
167+
)
168+
}
169+
}

‎swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,9 @@ class CleartextStorageConfig extends TaintTracking::Configuration {
8282
override predicate isSanitizerIn(DataFlow::Node node) {
8383
// make sources barriers so that we only report the closest instance
8484
isSource(node)
85+
or
86+
// encryption barrier
87+
node.asExpr() instanceof EncryptedExpr
8588
}
8689

8790
override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {

‎swift/ql/src/queries/Security/CWE-311/CleartextTransmission.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,9 @@ class CleartextTransmissionConfig extends TaintTracking::Configuration {
7575
override predicate isSanitizerIn(DataFlow::Node node) {
7676
// make sources barriers so that we only report the closest instance
7777
isSource(node)
78+
or
79+
// encryption barrier
80+
node.asExpr() instanceof EncryptedExpr
7881
}
7982
}
8083

‎swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -2,24 +2,13 @@ edges
22
| file://:0:0:0:0 | value : | file://:0:0:0:0 | [post] self [data] : |
33
| testCoreData.swift:18:19:18:26 | value : | testCoreData.swift:19:12:19:12 | value |
44
| testCoreData.swift:31:3:31:3 | newValue : | testCoreData.swift:32:13:32:13 | newValue |
5-
| testCoreData.swift:37:14:37:22 | data : | testCoreData.swift:37:49:37:49 | data : |
6-
| testCoreData.swift:38:11:38:23 | data : | testCoreData.swift:38:1:38:33 | data[return] : |
75
| testCoreData.swift:61:25:61:25 | password : | testCoreData.swift:18:19:18:26 | value : |
86
| testCoreData.swift:64:16:64:16 | password : | testCoreData.swift:31:3:31:3 | newValue : |
97
| testCoreData.swift:77:24:77:24 | x : | testCoreData.swift:78:15:78:15 | x |
108
| testCoreData.swift:80:10:80:22 | call to getPassword() : | testCoreData.swift:81:15:81:15 | y |
119
| testCoreData.swift:91:10:91:10 | passwd : | testCoreData.swift:95:15:95:15 | x |
12-
| testCoreData.swift:91:10:91:10 | passwd : | testCoreData.swift:99:14:99:14 | x : |
1310
| testCoreData.swift:92:10:92:10 | passwd : | testCoreData.swift:96:15:96:15 | y |
14-
| testCoreData.swift:92:10:92:10 | passwd : | testCoreData.swift:100:13:100:14 | &... : |
15-
| testCoreData.swift:92:10:92:10 | passwd : | testCoreData.swift:104:15:104:15 | y |
1611
| testCoreData.swift:93:10:93:10 | passwd : | testCoreData.swift:97:15:97:15 | z |
17-
| testCoreData.swift:99:6:99:15 | call to encrypt(_:) : | testCoreData.swift:103:15:103:15 | x |
18-
| testCoreData.swift:99:14:99:14 | x : | testCoreData.swift:37:14:37:22 | data : |
19-
| testCoreData.swift:99:14:99:14 | x : | testCoreData.swift:99:6:99:15 | call to encrypt(_:) : |
20-
| testCoreData.swift:100:13:100:14 | &... : | testCoreData.swift:38:11:38:23 | data : |
21-
| testCoreData.swift:100:13:100:14 | &... : | testCoreData.swift:100:13:100:14 | [post] &... : |
22-
| testCoreData.swift:100:13:100:14 | [post] &... : | testCoreData.swift:104:15:104:15 | y |
2312
| testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | value : |
2413
| testRealm.swift:34:2:34:2 | [post] a [data] : | testRealm.swift:35:12:35:12 | a |
2514
| testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:16:6:16:6 | value : |
@@ -34,10 +23,6 @@ nodes
3423
| testCoreData.swift:19:12:19:12 | value | semmle.label | value |
3524
| testCoreData.swift:31:3:31:3 | newValue : | semmle.label | newValue : |
3625
| testCoreData.swift:32:13:32:13 | newValue | semmle.label | newValue |
37-
| testCoreData.swift:37:14:37:22 | data : | semmle.label | data : |
38-
| testCoreData.swift:37:49:37:49 | data : | semmle.label | data : |
39-
| testCoreData.swift:38:1:38:33 | data[return] : | semmle.label | data[return] : |
40-
| testCoreData.swift:38:11:38:23 | data : | semmle.label | data : |
4126
| testCoreData.swift:48:15:48:15 | password | semmle.label | password |
4227
| testCoreData.swift:51:24:51:24 | password | semmle.label | password |
4328
| testCoreData.swift:58:15:58:15 | password | semmle.label | password |
@@ -54,12 +39,6 @@ nodes
5439
| testCoreData.swift:95:15:95:15 | x | semmle.label | x |
5540
| testCoreData.swift:96:15:96:15 | y | semmle.label | y |
5641
| testCoreData.swift:97:15:97:15 | z | semmle.label | z |
57-
| testCoreData.swift:99:6:99:15 | call to encrypt(_:) : | semmle.label | call to encrypt(_:) : |
58-
| testCoreData.swift:99:14:99:14 | x : | semmle.label | x : |
59-
| testCoreData.swift:100:13:100:14 | &... : | semmle.label | &... : |
60-
| testCoreData.swift:100:13:100:14 | [post] &... : | semmle.label | [post] &... : |
61-
| testCoreData.swift:103:15:103:15 | x | semmle.label | x |
62-
| testCoreData.swift:104:15:104:15 | y | semmle.label | y |
6342
| testRealm.swift:16:6:16:6 | value : | semmle.label | value : |
6443
| testRealm.swift:34:2:34:2 | [post] a [data] : | semmle.label | [post] a [data] : |
6544
| testRealm.swift:34:11:34:11 | myPassword : | semmle.label | myPassword : |
@@ -68,8 +47,6 @@ nodes
6847
| testRealm.swift:42:11:42:11 | myPassword : | semmle.label | myPassword : |
6948
| testRealm.swift:43:47:43:47 | c | semmle.label | c |
7049
subpaths
71-
| testCoreData.swift:99:14:99:14 | x : | testCoreData.swift:37:14:37:22 | data : | testCoreData.swift:37:49:37:49 | data : | testCoreData.swift:99:6:99:15 | call to encrypt(_:) : |
72-
| testCoreData.swift:100:13:100:14 | &... : | testCoreData.swift:38:11:38:23 | data : | testCoreData.swift:38:1:38:33 | data[return] : | testCoreData.swift:100:13:100:14 | [post] &... : |
7350
| testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self [data] : | testRealm.swift:34:2:34:2 | [post] a [data] : |
7451
| testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self [data] : | testRealm.swift:42:2:42:2 | [post] c [data] : |
7552
#select
@@ -84,7 +61,5 @@ subpaths
8461
| testCoreData.swift:95:15:95:15 | x | testCoreData.swift:91:10:91:10 | passwd : | testCoreData.swift:95:15:95:15 | x | This operation stores 'x' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:91:10:91:10 | passwd : | passwd |
8562
| testCoreData.swift:96:15:96:15 | y | testCoreData.swift:92:10:92:10 | passwd : | testCoreData.swift:96:15:96:15 | y | This operation stores 'y' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:92:10:92:10 | passwd : | passwd |
8663
| testCoreData.swift:97:15:97:15 | z | testCoreData.swift:93:10:93:10 | passwd : | testCoreData.swift:97:15:97:15 | z | This operation stores 'z' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:93:10:93:10 | passwd : | passwd |
87-
| testCoreData.swift:103:15:103:15 | x | testCoreData.swift:91:10:91:10 | passwd : | testCoreData.swift:103:15:103:15 | x | This operation stores 'x' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:91:10:91:10 | passwd : | passwd |
88-
| testCoreData.swift:104:15:104:15 | y | testCoreData.swift:92:10:92:10 | passwd : | testCoreData.swift:104:15:104:15 | y | This operation stores 'y' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:92:10:92:10 | passwd : | passwd |
8964
| testRealm.swift:35:12:35:12 | a | testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:35:12:35:12 | a | This operation stores 'a' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:34:11:34:11 | myPassword : | myPassword |
9065
| testRealm.swift:43:47:43:47 | c | testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:43:47:43:47 | c | This operation stores 'c' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:42:11:42:11 | myPassword : | myPassword |

‎swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,6 @@ edges
1414
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | testSend.swift:49:13:49:36 | call to pad(_:) : |
1515
| testSend.swift:49:27:49:27 | password : | testSend.swift:42:16:42:24 | data : |
1616
| testSend.swift:49:27:49:27 | password : | testSend.swift:49:17:49:35 | call to aes_crypt(_:) : |
17-
| testSend.swift:50:13:50:36 | call to aes_crypt(_:) : | testSend.swift:57:27:57:27 | str6 |
18-
| testSend.swift:50:23:50:35 | call to pad(_:) : | testSend.swift:42:16:42:24 | data : |
19-
| testSend.swift:50:23:50:35 | call to pad(_:) : | testSend.swift:50:13:50:36 | call to aes_crypt(_:) : |
20-
| testSend.swift:50:27:50:27 | password : | testSend.swift:41:10:41:18 | data : |
21-
| testSend.swift:50:27:50:27 | password : | testSend.swift:50:23:50:35 | call to pad(_:) : |
2217
| testURL.swift:13:54:13:54 | passwd : | testURL.swift:13:22:13:54 | ... .+(_:_:) ... |
2318
| testURL.swift:16:55:16:55 | credit_card_no : | testURL.swift:16:22:16:55 | ... .+(_:_:) ... |
2419
nodes
@@ -36,15 +31,11 @@ nodes
3631
| testSend.swift:49:13:49:36 | call to pad(_:) : | semmle.label | call to pad(_:) : |
3732
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | semmle.label | call to aes_crypt(_:) : |
3833
| testSend.swift:49:27:49:27 | password : | semmle.label | password : |
39-
| testSend.swift:50:13:50:36 | call to aes_crypt(_:) : | semmle.label | call to aes_crypt(_:) : |
40-
| testSend.swift:50:23:50:35 | call to pad(_:) : | semmle.label | call to pad(_:) : |
41-
| testSend.swift:50:27:50:27 | password : | semmle.label | password : |
4234
| testSend.swift:52:27:52:27 | str1 | semmle.label | str1 |
4335
| testSend.swift:53:27:53:27 | str2 | semmle.label | str2 |
4436
| testSend.swift:54:27:54:27 | str3 | semmle.label | str3 |
4537
| testSend.swift:55:27:55:27 | str4 | semmle.label | str4 |
4638
| testSend.swift:56:27:56:27 | str5 | semmle.label | str5 |
47-
| testSend.swift:57:27:57:27 | str6 | semmle.label | str6 |
4839
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4940
| testURL.swift:13:54:13:54 | passwd : | semmle.label | passwd : |
5041
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
@@ -55,16 +46,13 @@ subpaths
5546
| testSend.swift:48:23:48:23 | password : | testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : | testSend.swift:48:13:48:31 | call to aes_crypt(_:) : |
5647
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | testSend.swift:41:10:41:18 | data : | testSend.swift:41:45:41:45 | data : | testSend.swift:49:13:49:36 | call to pad(_:) : |
5748
| testSend.swift:49:27:49:27 | password : | testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : | testSend.swift:49:17:49:35 | call to aes_crypt(_:) : |
58-
| testSend.swift:50:23:50:35 | call to pad(_:) : | testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : | testSend.swift:50:13:50:36 | call to aes_crypt(_:) : |
59-
| testSend.swift:50:27:50:27 | password : | testSend.swift:41:10:41:18 | data : | testSend.swift:41:45:41:45 | data : | testSend.swift:50:23:50:35 | call to pad(_:) : |
6049
#select
6150
| testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | This operation transmits 'passwordPlain', which may contain unencrypted sensitive data from $@ | testSend.swift:29:19:29:19 | passwordPlain | passwordPlain |
6251
| testSend.swift:52:27:52:27 | str1 | testSend.swift:45:13:45:13 | password : | testSend.swift:52:27:52:27 | str1 | This operation transmits 'str1', which may contain unencrypted sensitive data from $@ | testSend.swift:45:13:45:13 | password : | password |
6352
| testSend.swift:53:27:53:27 | str2 | testSend.swift:46:13:46:13 | password : | testSend.swift:53:27:53:27 | str2 | This operation transmits 'str2', which may contain unencrypted sensitive data from $@ | testSend.swift:46:13:46:13 | password : | password |
6453
| testSend.swift:54:27:54:27 | str3 | testSend.swift:47:17:47:17 | password : | testSend.swift:54:27:54:27 | str3 | This operation transmits 'str3', which may contain unencrypted sensitive data from $@ | testSend.swift:47:17:47:17 | password : | password |
6554
| testSend.swift:55:27:55:27 | str4 | testSend.swift:48:23:48:23 | password : | testSend.swift:55:27:55:27 | str4 | This operation transmits 'str4', which may contain unencrypted sensitive data from $@ | testSend.swift:48:23:48:23 | password : | password |
6655
| testSend.swift:56:27:56:27 | str5 | testSend.swift:49:27:49:27 | password : | testSend.swift:56:27:56:27 | str5 | This operation transmits 'str5', which may contain unencrypted sensitive data from $@ | testSend.swift:49:27:49:27 | password : | password |
67-
| testSend.swift:57:27:57:27 | str6 | testSend.swift:50:27:50:27 | password : | testSend.swift:57:27:57:27 | str6 | This operation transmits 'str6', which may contain unencrypted sensitive data from $@ | testSend.swift:50:27:50:27 | password : | password |
6856
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | testURL.swift:13:54:13:54 | passwd : | testURL.swift:13:22:13:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@ | testURL.swift:13:54:13:54 | passwd : | passwd |
6957
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | testURL.swift:16:55:16:55 | credit_card_no : | testURL.swift:16:22:16:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@ | testURL.swift:16:55:16:55 | credit_card_no : | credit_card_no |
7058
| testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@ | testURL.swift:20:22:20:22 | passwd | passwd |

‎swift/ql/test/query-tests/Security/CWE-311/testCoreData.swift

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ func test4(obj : NSManagedObject, passwd : String) {
100100
hash(data: &y);
101101
z = "";
102102

103-
obj.setValue(x, forKey: "myKey") // GOOD (not sensitive) [FALSE POSITIVE]
104-
obj.setValue(y, forKey: "myKey") // GOOD (not sensitive) [FALSE POSITIVE]
103+
obj.setValue(x, forKey: "myKey") // GOOD (not sensitive)
104+
obj.setValue(y, forKey: "myKey") // GOOD (not sensitive)
105105
obj.setValue(z, forKey: "myKey") // GOOD (not sensitive)
106106
}

‎swift/ql/test/query-tests/Security/CWE-311/testSend.swift

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,5 +54,5 @@ func test2(password : String, connection : NWConnection) {
5454
connection.send(content: str3, completion: .idempotent) // BAD
5555
connection.send(content: str4, completion: .idempotent) // GOOD (encrypted) [FALSE POSITIVE]
5656
connection.send(content: str5, completion: .idempotent) // GOOD (encrypted) [FALSE POSITIVE]
57-
connection.send(content: str6, completion: .idempotent) // GOOD (encrypted) [FALSE POSITIVE]
57+
connection.send(content: str6, completion: .idempotent) // GOOD (encrypted)
5858
}

0 commit comments

Comments
 (0)