Skip to content

Commit 9683a95

Browse files
geoffw0geoffw0
committed
Swift: Add a few more test cases.
1 parent 5f841f7 commit 9683a95

File tree

3 files changed

+79
-0
lines changed

3 files changed

+79
-0
lines changed

‎swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,70 @@
11
edges
2+
| testSend.swift:41:10:41:18 | data : | testSend.swift:41:45:41:45 | data : |
3+
| testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : |
4+
| testSend.swift:45:13:45:13 | password : | testSend.swift:52:27:52:27 | str1 |
5+
| testSend.swift:46:13:46:13 | password : | testSend.swift:53:27:53:27 | str2 |
6+
| testSend.swift:47:13:47:25 | call to pad(_:) : | testSend.swift:54:27:54:27 | str3 |
7+
| testSend.swift:47:17:47:17 | password : | testSend.swift:41:10:41:18 | data : |
8+
| testSend.swift:47:17:47:17 | password : | testSend.swift:47:13:47:25 | call to pad(_:) : |
9+
| testSend.swift:48:13:48:31 | call to aes_crypt(_:) : | testSend.swift:55:27:55:27 | str4 |
10+
| testSend.swift:48:23:48:23 | password : | testSend.swift:42:16:42:24 | data : |
11+
| testSend.swift:48:23:48:23 | password : | testSend.swift:48:13:48:31 | call to aes_crypt(_:) : |
12+
| testSend.swift:49:13:49:36 | call to pad(_:) : | testSend.swift:56:27:56:27 | str5 |
13+
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | testSend.swift:41:10:41:18 | data : |
14+
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | testSend.swift:49:13:49:36 | call to pad(_:) : |
15+
| testSend.swift:49:27:49:27 | password : | testSend.swift:42:16:42:24 | data : |
16+
| testSend.swift:49:27:49:27 | password : | testSend.swift:49:17:49:35 | call to aes_crypt(_:) : |
17+
| testSend.swift:50:13:50:36 | call to aes_crypt(_:) : | testSend.swift:57:27:57:27 | str6 |
18+
| testSend.swift:50:23:50:35 | call to pad(_:) : | testSend.swift:42:16:42:24 | data : |
19+
| testSend.swift:50:23:50:35 | call to pad(_:) : | testSend.swift:50:13:50:36 | call to aes_crypt(_:) : |
20+
| testSend.swift:50:27:50:27 | password : | testSend.swift:41:10:41:18 | data : |
21+
| testSend.swift:50:27:50:27 | password : | testSend.swift:50:23:50:35 | call to pad(_:) : |
222
| testURL.swift:13:54:13:54 | passwd : | testURL.swift:13:22:13:54 | ... .+(_:_:) ... |
323
| testURL.swift:16:55:16:55 | credit_card_no : | testURL.swift:16:22:16:55 | ... .+(_:_:) ... |
424
nodes
525
| testSend.swift:29:19:29:19 | passwordPlain | semmle.label | passwordPlain |
26+
| testSend.swift:41:10:41:18 | data : | semmle.label | data : |
27+
| testSend.swift:41:45:41:45 | data : | semmle.label | data : |
28+
| testSend.swift:42:16:42:24 | data : | semmle.label | data : |
29+
| testSend.swift:42:51:42:51 | data : | semmle.label | data : |
30+
| testSend.swift:45:13:45:13 | password : | semmle.label | password : |
31+
| testSend.swift:46:13:46:13 | password : | semmle.label | password : |
32+
| testSend.swift:47:13:47:25 | call to pad(_:) : | semmle.label | call to pad(_:) : |
33+
| testSend.swift:47:17:47:17 | password : | semmle.label | password : |
34+
| testSend.swift:48:13:48:31 | call to aes_crypt(_:) : | semmle.label | call to aes_crypt(_:) : |
35+
| testSend.swift:48:23:48:23 | password : | semmle.label | password : |
36+
| testSend.swift:49:13:49:36 | call to pad(_:) : | semmle.label | call to pad(_:) : |
37+
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | semmle.label | call to aes_crypt(_:) : |
38+
| testSend.swift:49:27:49:27 | password : | semmle.label | password : |
39+
| testSend.swift:50:13:50:36 | call to aes_crypt(_:) : | semmle.label | call to aes_crypt(_:) : |
40+
| testSend.swift:50:23:50:35 | call to pad(_:) : | semmle.label | call to pad(_:) : |
41+
| testSend.swift:50:27:50:27 | password : | semmle.label | password : |
42+
| testSend.swift:52:27:52:27 | str1 | semmle.label | str1 |
43+
| testSend.swift:53:27:53:27 | str2 | semmle.label | str2 |
44+
| testSend.swift:54:27:54:27 | str3 | semmle.label | str3 |
45+
| testSend.swift:55:27:55:27 | str4 | semmle.label | str4 |
46+
| testSend.swift:56:27:56:27 | str5 | semmle.label | str5 |
47+
| testSend.swift:57:27:57:27 | str6 | semmle.label | str6 |
648
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
749
| testURL.swift:13:54:13:54 | passwd : | semmle.label | passwd : |
850
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
951
| testURL.swift:16:55:16:55 | credit_card_no : | semmle.label | credit_card_no : |
1052
| testURL.swift:20:22:20:22 | passwd | semmle.label | passwd |
1153
subpaths
54+
| testSend.swift:47:17:47:17 | password : | testSend.swift:41:10:41:18 | data : | testSend.swift:41:45:41:45 | data : | testSend.swift:47:13:47:25 | call to pad(_:) : |
55+
| testSend.swift:48:23:48:23 | password : | testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : | testSend.swift:48:13:48:31 | call to aes_crypt(_:) : |
56+
| testSend.swift:49:17:49:35 | call to aes_crypt(_:) : | testSend.swift:41:10:41:18 | data : | testSend.swift:41:45:41:45 | data : | testSend.swift:49:13:49:36 | call to pad(_:) : |
57+
| testSend.swift:49:27:49:27 | password : | testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : | testSend.swift:49:17:49:35 | call to aes_crypt(_:) : |
58+
| testSend.swift:50:23:50:35 | call to pad(_:) : | testSend.swift:42:16:42:24 | data : | testSend.swift:42:51:42:51 | data : | testSend.swift:50:13:50:36 | call to aes_crypt(_:) : |
59+
| testSend.swift:50:27:50:27 | password : | testSend.swift:41:10:41:18 | data : | testSend.swift:41:45:41:45 | data : | testSend.swift:50:23:50:35 | call to pad(_:) : |
1260
#select
1361
| testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | This operation transmits 'passwordPlain', which may contain unencrypted sensitive data from $@ | testSend.swift:29:19:29:19 | passwordPlain | passwordPlain |
62+
| testSend.swift:52:27:52:27 | str1 | testSend.swift:45:13:45:13 | password : | testSend.swift:52:27:52:27 | str1 | This operation transmits 'str1', which may contain unencrypted sensitive data from $@ | testSend.swift:45:13:45:13 | password : | password |
63+
| testSend.swift:53:27:53:27 | str2 | testSend.swift:46:13:46:13 | password : | testSend.swift:53:27:53:27 | str2 | This operation transmits 'str2', which may contain unencrypted sensitive data from $@ | testSend.swift:46:13:46:13 | password : | password |
64+
| testSend.swift:54:27:54:27 | str3 | testSend.swift:47:17:47:17 | password : | testSend.swift:54:27:54:27 | str3 | This operation transmits 'str3', which may contain unencrypted sensitive data from $@ | testSend.swift:47:17:47:17 | password : | password |
65+
| testSend.swift:55:27:55:27 | str4 | testSend.swift:48:23:48:23 | password : | testSend.swift:55:27:55:27 | str4 | This operation transmits 'str4', which may contain unencrypted sensitive data from $@ | testSend.swift:48:23:48:23 | password : | password |
66+
| testSend.swift:56:27:56:27 | str5 | testSend.swift:49:27:49:27 | password : | testSend.swift:56:27:56:27 | str5 | This operation transmits 'str5', which may contain unencrypted sensitive data from $@ | testSend.swift:49:27:49:27 | password : | password |
67+
| testSend.swift:57:27:57:27 | str6 | testSend.swift:50:27:50:27 | password : | testSend.swift:57:27:57:27 | str6 | This operation transmits 'str6', which may contain unencrypted sensitive data from $@ | testSend.swift:50:27:50:27 | password : | password |
1468
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | testURL.swift:13:54:13:54 | passwd : | testURL.swift:13:22:13:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@ | testURL.swift:13:54:13:54 | passwd : | passwd |
1569
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | testURL.swift:16:55:16:55 | credit_card_no : | testURL.swift:16:22:16:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@ | testURL.swift:16:55:16:55 | credit_card_no : | credit_card_no |
1670
| testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@ | testURL.swift:20:22:20:22 | passwd | passwd |

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,12 @@
2525
| testSend.swift:30:19:30:19 | passwordHash | isProbablySafe, label:passwordHash, type:credential |
2626
| testSend.swift:33:19:33:19 | passwordPlain | label:passwordPlain, type:credential |
2727
| testSend.swift:34:19:34:19 | passwordHash | isProbablySafe, label:passwordHash, type:credential |
28+
| testSend.swift:45:13:45:13 | password | label:password, type:credential |
29+
| testSend.swift:46:13:46:13 | password | label:password, type:credential |
30+
| testSend.swift:47:17:47:17 | password | label:password, type:credential |
31+
| testSend.swift:48:23:48:23 | password | label:password, type:credential |
32+
| testSend.swift:49:27:49:27 | password | label:password, type:credential |
33+
| testSend.swift:50:27:50:27 | password | label:password, type:credential |
2834
| testURL.swift:13:54:13:54 | passwd | label:passwd, type:credential |
2935
| testURL.swift:14:54:14:54 | encrypted_passwd | isProbablySafe, label:encrypted_passwd, type:credential |
3036
| testURL.swift:16:55:16:55 | credit_card_no | label:credit_card_no, type:private information |

‎swift/ql/test/query-tests/Security/CWE-311/testSend.swift

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,22 @@ func test1(passwordPlain : String, passwordHash : String) {
3737
nw.send(content: data2, completion: .idempotent) // BAD [NOT DETECTED]
3838
nw.send(content: data3, completion: .idempotent) // GOOD (not sensitive)
3939
}
40+
41+
func pad(_ data: String) -> String { return data }
42+
func aes_crypt(_ data: String) -> String { return data }
43+
44+
func test2(password : String, connection : NWConnection) {
45+
let str1 = password
46+
let str2 = password + " "
47+
let str3 = pad(password)
48+
let str4 = aes_crypt(password)
49+
let str5 = pad(aes_crypt(password))
50+
let str6 = aes_crypt(pad(password))
51+
52+
connection.send(content: str1, completion: .idempotent) // BAD
53+
connection.send(content: str2, completion: .idempotent) // BAD
54+
connection.send(content: str3, completion: .idempotent) // BAD
55+
connection.send(content: str4, completion: .idempotent) // GOOD (encrypted) [FALSE POSITIVE]
56+
connection.send(content: str5, completion: .idempotent) // GOOD (encrypted) [FALSE POSITIVE]
57+
connection.send(content: str6, completion: .idempotent) // GOOD (encrypted) [FALSE POSITIVE]
58+
}

0 commit comments

Comments
 (0)