Skip to content

Commit e98bdbf

Browse files
MathiasVPMathiasVP
authored
Merge pull request github#9773 from geoffw0/stringlengthconflation4
Swift: More improvements to swift/string-length-conflation
2 parents 563d273 + e38254c commit e98bdbf

File tree

3 files changed

+135
-40
lines changed

3 files changed

+135
-40
lines changed

‎swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,21 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
2323
StringLengthConflationConfiguration() { this = "StringLengthConflationConfiguration" }
2424

2525
override predicate isSource(DataFlow::Node node, string flowstate) {
26-
// result of a call to to `String.count`
26+
// result of a call to `String.count`
2727
exists(MemberRefExpr member |
2828
member.getBaseExpr().getType().getName() = "String" and
2929
member.getMember().(VarDecl).getName() = "count" and
3030
node.asExpr() = member and
3131
flowstate = "String"
3232
)
33+
or
34+
// result of a call to `NSString.length`
35+
exists(MemberRefExpr member |
36+
member.getBaseExpr().getType().getName() = ["NSString", "NSMutableString"] and
37+
member.getMember().(VarDecl).getName() = "length" and
38+
node.asExpr() = member and
39+
flowstate = "NSString"
40+
)
3341
}
3442

3543
override predicate isSink(DataFlow::Node node, string flowstate) {
@@ -83,12 +91,44 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
8391
call.getArgument(pragma[only_bind_into](arg)).getExpr() = node.asExpr() and
8492
flowstate = "String" // `String` length flowing into `NSString`
8593
)
94+
or
95+
// arguments to function calls...
96+
exists(string funcName, string paramName, CallExpr call, int arg |
97+
(
98+
// `String.dropFirst`, `String.dropLast`, `String.removeFirst`, `String.removeLast`
99+
funcName = ["dropFirst(_:)", "dropLast(_:)", "removeFirst(_:)", "removeLast(_:)"] and
100+
paramName = "k"
101+
or
102+
// `String.prefix`, `String.suffix`
103+
funcName = ["prefix(_:)", "suffix(_:)"] and
104+
paramName = "maxLength"
105+
or
106+
// `String.Index.init`
107+
funcName = "init(encodedOffset:)" and
108+
paramName = "offset"
109+
or
110+
// `String.index`
111+
funcName = ["index(_:offsetBy:)", "index(_:offsetBy:limitBy:)"] and
112+
paramName = "n"
113+
or
114+
// `String.formIndex`
115+
funcName = ["formIndex(_:offsetBy:)", "formIndex(_:offsetBy:limitBy:)"] and
116+
paramName = "distance"
117+
) and
118+
call.getFunction().(ApplyExpr).getStaticTarget().getName() = funcName and
119+
call.getFunction()
120+
.(ApplyExpr)
121+
.getStaticTarget()
122+
.getParam(pragma[only_bind_into](arg))
123+
.getName() = paramName and
124+
call.getArgument(pragma[only_bind_into](arg)).getExpr() = node.asExpr() and
125+
flowstate = "NSString" // `NSString` length flowing into `String`
126+
)
86127
}
87128

88129
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
89-
// allow flow through `+` and `-`.
90-
node2.asExpr().(AddExpr).getAnOperand() = node1.asExpr() or
91-
node2.asExpr().(SubExpr).getAnOperand() = node1.asExpr()
130+
// allow flow through `+`, `-`, `*` etc.
131+
node2.asExpr().(ArithmeticOperation).getAnOperand() = node1.asExpr()
92132
}
93133
}
94134

‎swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.expected

Lines changed: 62 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,70 @@
11
edges
2-
| StringLengthConflation.swift:101:34:101:36 | .count : | StringLengthConflation.swift:101:34:101:44 | ... call to -(_:_:) ... |
3-
| StringLengthConflation.swift:102:36:102:38 | .count : | StringLengthConflation.swift:102:36:102:46 | ... call to -(_:_:) ... |
4-
| StringLengthConflation.swift:107:36:107:38 | .count : | StringLengthConflation.swift:107:36:107:46 | ... call to -(_:_:) ... |
5-
| StringLengthConflation.swift:108:38:108:40 | .count : | StringLengthConflation.swift:108:38:108:48 | ... call to -(_:_:) ... |
6-
| StringLengthConflation.swift:113:34:113:36 | .count : | StringLengthConflation.swift:113:34:113:44 | ... call to -(_:_:) ... |
7-
| StringLengthConflation.swift:114:36:114:38 | .count : | StringLengthConflation.swift:114:36:114:46 | ... call to -(_:_:) ... |
8-
| StringLengthConflation.swift:120:28:120:30 | .count : | StringLengthConflation.swift:120:28:120:38 | ... call to -(_:_:) ... |
2+
| StringLengthConflation.swift:60:47:60:50 | .length : | StringLengthConflation.swift:60:47:60:59 | ... call to /(_:_:) ... |
3+
| StringLengthConflation.swift:66:33:66:36 | .length : | StringLengthConflation.swift:66:33:66:45 | ... call to /(_:_:) ... |
4+
| StringLengthConflation.swift:93:28:93:31 | .length : | StringLengthConflation.swift:93:28:93:40 | ... call to -(_:_:) ... |
5+
| StringLengthConflation.swift:97:27:97:30 | .length : | StringLengthConflation.swift:97:27:97:39 | ... call to -(_:_:) ... |
6+
| StringLengthConflation.swift:101:25:101:28 | .length : | StringLengthConflation.swift:101:25:101:37 | ... call to -(_:_:) ... |
7+
| StringLengthConflation.swift:105:25:105:28 | .length : | StringLengthConflation.swift:105:25:105:37 | ... call to -(_:_:) ... |
8+
| StringLengthConflation.swift:111:23:111:26 | .length : | StringLengthConflation.swift:111:23:111:35 | ... call to -(_:_:) ... |
9+
| StringLengthConflation.swift:117:22:117:25 | .length : | StringLengthConflation.swift:117:22:117:34 | ... call to -(_:_:) ... |
10+
| StringLengthConflation.swift:122:34:122:36 | .count : | StringLengthConflation.swift:122:34:122:44 | ... call to -(_:_:) ... |
11+
| StringLengthConflation.swift:123:36:123:38 | .count : | StringLengthConflation.swift:123:36:123:46 | ... call to -(_:_:) ... |
12+
| StringLengthConflation.swift:128:36:128:38 | .count : | StringLengthConflation.swift:128:36:128:46 | ... call to -(_:_:) ... |
13+
| StringLengthConflation.swift:129:38:129:40 | .count : | StringLengthConflation.swift:129:38:129:48 | ... call to -(_:_:) ... |
14+
| StringLengthConflation.swift:134:34:134:36 | .count : | StringLengthConflation.swift:134:34:134:44 | ... call to -(_:_:) ... |
15+
| StringLengthConflation.swift:135:36:135:38 | .count : | StringLengthConflation.swift:135:36:135:46 | ... call to -(_:_:) ... |
16+
| StringLengthConflation.swift:141:28:141:30 | .count : | StringLengthConflation.swift:141:28:141:38 | ... call to -(_:_:) ... |
917
nodes
18+
| StringLengthConflation.swift:53:43:53:46 | .length | semmle.label | .length |
19+
| StringLengthConflation.swift:60:47:60:50 | .length : | semmle.label | .length : |
20+
| StringLengthConflation.swift:60:47:60:59 | ... call to /(_:_:) ... | semmle.label | ... call to /(_:_:) ... |
21+
| StringLengthConflation.swift:66:33:66:36 | .length : | semmle.label | .length : |
22+
| StringLengthConflation.swift:66:33:66:45 | ... call to /(_:_:) ... | semmle.label | ... call to /(_:_:) ... |
1023
| StringLengthConflation.swift:72:33:72:35 | .count | semmle.label | .count |
1124
| StringLengthConflation.swift:78:47:78:49 | .count | semmle.label | .count |
12-
| StringLengthConflation.swift:101:34:101:36 | .count : | semmle.label | .count : |
13-
| StringLengthConflation.swift:101:34:101:44 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
14-
| StringLengthConflation.swift:102:36:102:38 | .count : | semmle.label | .count : |
15-
| StringLengthConflation.swift:102:36:102:46 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
16-
| StringLengthConflation.swift:107:36:107:38 | .count : | semmle.label | .count : |
17-
| StringLengthConflation.swift:107:36:107:46 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
18-
| StringLengthConflation.swift:108:38:108:40 | .count : | semmle.label | .count : |
19-
| StringLengthConflation.swift:108:38:108:48 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
20-
| StringLengthConflation.swift:113:34:113:36 | .count : | semmle.label | .count : |
21-
| StringLengthConflation.swift:113:34:113:44 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
22-
| StringLengthConflation.swift:114:36:114:38 | .count : | semmle.label | .count : |
23-
| StringLengthConflation.swift:114:36:114:46 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
24-
| StringLengthConflation.swift:120:28:120:30 | .count : | semmle.label | .count : |
25-
| StringLengthConflation.swift:120:28:120:38 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
25+
| StringLengthConflation.swift:93:28:93:31 | .length : | semmle.label | .length : |
26+
| StringLengthConflation.swift:93:28:93:40 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
27+
| StringLengthConflation.swift:97:27:97:30 | .length : | semmle.label | .length : |
28+
| StringLengthConflation.swift:97:27:97:39 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
29+
| StringLengthConflation.swift:101:25:101:28 | .length : | semmle.label | .length : |
30+
| StringLengthConflation.swift:101:25:101:37 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
31+
| StringLengthConflation.swift:105:25:105:28 | .length : | semmle.label | .length : |
32+
| StringLengthConflation.swift:105:25:105:37 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
33+
| StringLengthConflation.swift:111:23:111:26 | .length : | semmle.label | .length : |
34+
| StringLengthConflation.swift:111:23:111:35 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
35+
| StringLengthConflation.swift:117:22:117:25 | .length : | semmle.label | .length : |
36+
| StringLengthConflation.swift:117:22:117:34 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
37+
| StringLengthConflation.swift:122:34:122:36 | .count : | semmle.label | .count : |
38+
| StringLengthConflation.swift:122:34:122:44 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
39+
| StringLengthConflation.swift:123:36:123:38 | .count : | semmle.label | .count : |
40+
| StringLengthConflation.swift:123:36:123:46 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
41+
| StringLengthConflation.swift:128:36:128:38 | .count : | semmle.label | .count : |
42+
| StringLengthConflation.swift:128:36:128:46 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
43+
| StringLengthConflation.swift:129:38:129:40 | .count : | semmle.label | .count : |
44+
| StringLengthConflation.swift:129:38:129:48 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
45+
| StringLengthConflation.swift:134:34:134:36 | .count : | semmle.label | .count : |
46+
| StringLengthConflation.swift:134:34:134:44 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
47+
| StringLengthConflation.swift:135:36:135:38 | .count : | semmle.label | .count : |
48+
| StringLengthConflation.swift:135:36:135:46 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
49+
| StringLengthConflation.swift:141:28:141:30 | .count : | semmle.label | .count : |
50+
| StringLengthConflation.swift:141:28:141:38 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
2651
subpaths
2752
#select
53+
| StringLengthConflation.swift:53:43:53:46 | .length | StringLengthConflation.swift:53:43:53:46 | .length | StringLengthConflation.swift:53:43:53:46 | .length | This NSString length is used in a String, but it may not be equivalent. |
54+
| StringLengthConflation.swift:60:47:60:59 | ... call to /(_:_:) ... | StringLengthConflation.swift:60:47:60:50 | .length : | StringLengthConflation.swift:60:47:60:59 | ... call to /(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
55+
| StringLengthConflation.swift:66:33:66:45 | ... call to /(_:_:) ... | StringLengthConflation.swift:66:33:66:36 | .length : | StringLengthConflation.swift:66:33:66:45 | ... call to /(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
2856
| StringLengthConflation.swift:72:33:72:35 | .count | StringLengthConflation.swift:72:33:72:35 | .count | StringLengthConflation.swift:72:33:72:35 | .count | This String length is used in an NSString, but it may not be equivalent. |
2957
| StringLengthConflation.swift:78:47:78:49 | .count | StringLengthConflation.swift:78:47:78:49 | .count | StringLengthConflation.swift:78:47:78:49 | .count | This String length is used in an NSString, but it may not be equivalent. |
30-
| StringLengthConflation.swift:101:34:101:44 | ... call to -(_:_:) ... | StringLengthConflation.swift:101:34:101:36 | .count : | StringLengthConflation.swift:101:34:101:44 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
31-
| StringLengthConflation.swift:102:36:102:46 | ... call to -(_:_:) ... | StringLengthConflation.swift:102:36:102:38 | .count : | StringLengthConflation.swift:102:36:102:46 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
32-
| StringLengthConflation.swift:107:36:107:46 | ... call to -(_:_:) ... | StringLengthConflation.swift:107:36:107:38 | .count : | StringLengthConflation.swift:107:36:107:46 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
33-
| StringLengthConflation.swift:108:38:108:48 | ... call to -(_:_:) ... | StringLengthConflation.swift:108:38:108:40 | .count : | StringLengthConflation.swift:108:38:108:48 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
34-
| StringLengthConflation.swift:113:34:113:44 | ... call to -(_:_:) ... | StringLengthConflation.swift:113:34:113:36 | .count : | StringLengthConflation.swift:113:34:113:44 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
35-
| StringLengthConflation.swift:114:36:114:46 | ... call to -(_:_:) ... | StringLengthConflation.swift:114:36:114:38 | .count : | StringLengthConflation.swift:114:36:114:46 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
36-
| StringLengthConflation.swift:120:28:120:38 | ... call to -(_:_:) ... | StringLengthConflation.swift:120:28:120:30 | .count : | StringLengthConflation.swift:120:28:120:38 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
58+
| StringLengthConflation.swift:93:28:93:40 | ... call to -(_:_:) ... | StringLengthConflation.swift:93:28:93:31 | .length : | StringLengthConflation.swift:93:28:93:40 | ... call to -(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
59+
| StringLengthConflation.swift:97:27:97:39 | ... call to -(_:_:) ... | StringLengthConflation.swift:97:27:97:30 | .length : | StringLengthConflation.swift:97:27:97:39 | ... call to -(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
60+
| StringLengthConflation.swift:101:25:101:37 | ... call to -(_:_:) ... | StringLengthConflation.swift:101:25:101:28 | .length : | StringLengthConflation.swift:101:25:101:37 | ... call to -(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
61+
| StringLengthConflation.swift:105:25:105:37 | ... call to -(_:_:) ... | StringLengthConflation.swift:105:25:105:28 | .length : | StringLengthConflation.swift:105:25:105:37 | ... call to -(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
62+
| StringLengthConflation.swift:111:23:111:35 | ... call to -(_:_:) ... | StringLengthConflation.swift:111:23:111:26 | .length : | StringLengthConflation.swift:111:23:111:35 | ... call to -(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
63+
| StringLengthConflation.swift:117:22:117:34 | ... call to -(_:_:) ... | StringLengthConflation.swift:117:22:117:25 | .length : | StringLengthConflation.swift:117:22:117:34 | ... call to -(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
64+
| StringLengthConflation.swift:122:34:122:44 | ... call to -(_:_:) ... | StringLengthConflation.swift:122:34:122:36 | .count : | StringLengthConflation.swift:122:34:122:44 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
65+
| StringLengthConflation.swift:123:36:123:46 | ... call to -(_:_:) ... | StringLengthConflation.swift:123:36:123:38 | .count : | StringLengthConflation.swift:123:36:123:46 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
66+
| StringLengthConflation.swift:128:36:128:46 | ... call to -(_:_:) ... | StringLengthConflation.swift:128:36:128:38 | .count : | StringLengthConflation.swift:128:36:128:46 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
67+
| StringLengthConflation.swift:129:38:129:48 | ... call to -(_:_:) ... | StringLengthConflation.swift:129:38:129:40 | .count : | StringLengthConflation.swift:129:38:129:48 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
68+
| StringLengthConflation.swift:134:34:134:44 | ... call to -(_:_:) ... | StringLengthConflation.swift:134:34:134:36 | .count : | StringLengthConflation.swift:134:34:134:44 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
69+
| StringLengthConflation.swift:135:36:135:46 | ... call to -(_:_:) ... | StringLengthConflation.swift:135:36:135:38 | .count : | StringLengthConflation.swift:135:36:135:46 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
70+
| StringLengthConflation.swift:141:28:141:38 | ... call to -(_:_:) ... | StringLengthConflation.swift:141:28:141:30 | .count : | StringLengthConflation.swift:141:28:141:38 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |

0 commit comments

Comments
 (0)