Skip to content

Commit da7f491

Browse files
geoffw0geoffw0
committed
Swift: Use dataflow.
1 parent 28d801f commit da7f491

File tree

2 files changed

+23
-55
lines changed

2 files changed

+23
-55
lines changed

‎swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@
1111
*/
1212

1313
import swift
14+
import codeql.swift.dataflow.DataFlow
15+
import DataFlow::PathGraph
1416

15-
predicate isSource(Expr e) {
17+
predicate isSource0(Expr e) {
1618
// result of a call to to `String.count`
1719
exists(MemberRefExpr member |
1820
member.getBaseExpr().getType().toString() = "String" and // TODO: use of toString
@@ -22,7 +24,7 @@ predicate isSource(Expr e) {
2224
// TODO: other sources such as NSString.length, with different set of sinks
2325
}
2426

25-
predicate isSink(Expr e) {
27+
predicate isSink0(Expr e) {
2628
// arguments to method calls...
2729
exists(
2830
string className, string methodName, string argName, ClassDecl c, AbstractFunctionDecl f,
@@ -75,13 +77,18 @@ predicate isSink(Expr e) {
7577
)
7678
}
7779

78-
string describe(Element e) {
79-
isSource(e) and result = "isSource"
80-
or
81-
isSink(e) and result = "isSink"
82-
or
83-
isSource(e) and isSink(e) and result = "***RESULT***"
80+
class StringLengthConflationConfiguration extends DataFlow::Configuration {
81+
StringLengthConflationConfiguration() { this = "StringLengthConflationConfiguration" }
82+
83+
override predicate isSource(DataFlow::Node node, string flowstate) {
84+
isSource0(node.asExpr()) and flowstate = "String"
85+
}
86+
87+
override predicate isSink(DataFlow::Node node, string flowstate) {
88+
isSink0(node.asExpr()) and flowstate = "String"
89+
}
8490
}
8591

86-
from Locatable e
87-
select e.getLocation(), e, strictconcat(describe(e), ", ")
92+
from StringLengthConflationConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
93+
where config.hasFlowPath(source, sink)
94+
select sink, source, sink, "RESULT"

‎swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.expected

Lines changed: 6 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,6 @@
1-
| StringLengthConflation.swift:10:37:10:44 | Location | StringLengthConflation.swift:10:37:10:44 | .count | isSource |
2-
| StringLengthConflation.swift:21:37:21:44 | Location | StringLengthConflation.swift:21:37:21:44 | .count | isSource |
3-
| StringLengthConflation.swift:38:80:38:80 | Location | StringLengthConflation.swift:38:80:38:80 | loc | isSink |
4-
| StringLengthConflation.swift:38:93:38:93 | Location | StringLengthConflation.swift:38:93:38:93 | len | isSink |
5-
| StringLengthConflation.swift:47:20:47:22 | Location | StringLengthConflation.swift:47:20:47:22 | .count | isSource |
6-
| StringLengthConflation.swift:52:43:52:45 | Location | StringLengthConflation.swift:52:43:52:45 | .count | isSource |
7-
| StringLengthConflation.swift:59:47:59:49 | Location | StringLengthConflation.swift:59:47:59:49 | .count | isSource |
8-
| StringLengthConflation.swift:64:33:64:35 | Location | StringLengthConflation.swift:64:33:64:35 | .count | isSource |
9-
| StringLengthConflation.swift:71:30:71:30 | Location | StringLengthConflation.swift:71:30:71:30 | 0 | isSink |
10-
| StringLengthConflation.swift:71:33:71:36 | Location | StringLengthConflation.swift:71:33:71:36 | .length | isSink |
11-
| StringLengthConflation.swift:72:30:72:30 | Location | StringLengthConflation.swift:72:30:72:30 | 0 | isSink |
12-
| StringLengthConflation.swift:72:33:72:35 | Location | StringLengthConflation.swift:72:33:72:35 | .count | ***RESULT***, isSink, isSource |
13-
| StringLengthConflation.swift:73:30:73:30 | Location | StringLengthConflation.swift:73:30:73:30 | 0 | isSink |
14-
| StringLengthConflation.swift:73:33:73:46 | Location | StringLengthConflation.swift:73:33:73:46 | .count | isSink |
15-
| StringLengthConflation.swift:74:30:74:30 | Location | StringLengthConflation.swift:74:30:74:30 | 0 | isSink |
16-
| StringLengthConflation.swift:74:33:74:78 | Location | StringLengthConflation.swift:74:33:74:78 | call to ... | isSink |
17-
| StringLengthConflation.swift:77:36:77:36 | Location | StringLengthConflation.swift:77:36:77:36 | 0 | isSink |
18-
| StringLengthConflation.swift:77:47:77:50 | Location | StringLengthConflation.swift:77:47:77:50 | .length | isSink |
19-
| StringLengthConflation.swift:78:36:78:36 | Location | StringLengthConflation.swift:78:36:78:36 | 0 | isSink |
20-
| StringLengthConflation.swift:78:47:78:49 | Location | StringLengthConflation.swift:78:47:78:49 | .count | ***RESULT***, isSink, isSource |
21-
| StringLengthConflation.swift:83:28:83:30 | Location | StringLengthConflation.swift:83:28:83:30 | .count | isSource |
22-
| StringLengthConflation.swift:87:27:87:29 | Location | StringLengthConflation.swift:87:27:87:29 | .count | isSource |
23-
| StringLengthConflation.swift:91:25:91:27 | Location | StringLengthConflation.swift:91:25:91:27 | .count | isSource |
24-
| StringLengthConflation.swift:95:25:95:27 | Location | StringLengthConflation.swift:95:25:95:27 | .count | isSource |
25-
| StringLengthConflation.swift:99:34:99:46 | Location | StringLengthConflation.swift:99:34:99:46 | ... call to - ... | isSink |
26-
| StringLengthConflation.swift:100:36:100:49 | Location | StringLengthConflation.swift:100:36:100:49 | ... call to - ... | isSink |
27-
| StringLengthConflation.swift:101:34:101:36 | Location | StringLengthConflation.swift:101:34:101:36 | .count | isSource |
28-
| StringLengthConflation.swift:101:34:101:44 | Location | StringLengthConflation.swift:101:34:101:44 | ... call to - ... | isSink |
29-
| StringLengthConflation.swift:102:36:102:38 | Location | StringLengthConflation.swift:102:36:102:38 | .count | isSource |
30-
| StringLengthConflation.swift:102:36:102:46 | Location | StringLengthConflation.swift:102:36:102:46 | ... call to - ... | isSink |
31-
| StringLengthConflation.swift:105:36:105:48 | Location | StringLengthConflation.swift:105:36:105:48 | ... call to - ... | isSink |
32-
| StringLengthConflation.swift:106:38:106:51 | Location | StringLengthConflation.swift:106:38:106:51 | ... call to - ... | isSink |
33-
| StringLengthConflation.swift:107:36:107:38 | Location | StringLengthConflation.swift:107:36:107:38 | .count | isSource |
34-
| StringLengthConflation.swift:107:36:107:46 | Location | StringLengthConflation.swift:107:36:107:46 | ... call to - ... | isSink |
35-
| StringLengthConflation.swift:108:38:108:40 | Location | StringLengthConflation.swift:108:38:108:40 | .count | isSource |
36-
| StringLengthConflation.swift:108:38:108:48 | Location | StringLengthConflation.swift:108:38:108:48 | ... call to - ... | isSink |
37-
| StringLengthConflation.swift:111:34:111:46 | Location | StringLengthConflation.swift:111:34:111:46 | ... call to - ... | isSink |
38-
| StringLengthConflation.swift:112:36:112:49 | Location | StringLengthConflation.swift:112:36:112:49 | ... call to - ... | isSink |
39-
| StringLengthConflation.swift:113:34:113:36 | Location | StringLengthConflation.swift:113:34:113:36 | .count | isSource |
40-
| StringLengthConflation.swift:113:34:113:44 | Location | StringLengthConflation.swift:113:34:113:44 | ... call to - ... | isSink |
41-
| StringLengthConflation.swift:114:36:114:38 | Location | StringLengthConflation.swift:114:36:114:38 | .count | isSource |
42-
| StringLengthConflation.swift:114:36:114:46 | Location | StringLengthConflation.swift:114:36:114:46 | ... call to - ... | isSink |
43-
| StringLengthConflation.swift:118:28:118:41 | Location | StringLengthConflation.swift:118:28:118:41 | ... call to - ... | isSink |
44-
| StringLengthConflation.swift:120:28:120:30 | Location | StringLengthConflation.swift:120:28:120:30 | .count | isSource |
45-
| StringLengthConflation.swift:120:28:120:38 | Location | StringLengthConflation.swift:120:28:120:38 | ... call to - ... | isSink |
1+
edges
2+
nodes
3+
| StringLengthConflation.swift:78:47:78:49 | .count | semmle.label | .count |
4+
subpaths
5+
#select
6+
| StringLengthConflation.swift:78:47:78:49 | .count | StringLengthConflation.swift:78:47:78:49 | .count | StringLengthConflation.swift:78:47:78:49 | .count | RESULT |

0 commit comments

Comments
 (0)