Skip to content

Commit feccd30

Browse files
geoffw0geoffw0
committed
Swift: Add realm encryption-key sinks.
1 parent bfdaf69 commit feccd30

File tree

3 files changed

+24
-1
lines changed

3 files changed

+24
-1
lines changed

‎swift/ql/lib/codeql/swift/security/HardcodedEncryptionKeyExtensions.qll

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,18 @@ private class RnCryptorEncryptionKeySink extends HardcodedEncryptionKeySink {
6262
}
6363
}
6464

65+
private class EncryptionKeySinks extends SinkModelCsv {
66+
override predicate row(string row) {
67+
row =
68+
[
69+
// Realm database library.
70+
";Realm.Configuration;true;init(fileURL:inMemoryIdentifier:syncConfiguration:encryptionKey:readOnly:schemaVersion:migrationBlock:deleteRealmIfMigrationNeeded:shouldCompactOnLaunch:objectTypes:);;;Argument[3];encryption-key",
71+
";Realm.Configuration;true;init(fileURL:inMemoryIdentifier:syncConfiguration:encryptionKey:readOnly:schemaVersion:migrationBlock:deleteRealmIfMigrationNeeded:shouldCompactOnLaunch:objectTypes:seedFilePath:);;;Argument[3];encryption-key",
72+
";Realm.Configuration;true;encryptionKey;;;;encryption-key",
73+
]
74+
}
75+
}
76+
6577
/**
6678
* A sink defined in a CSV model.
6779
*/

‎swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ edges
1919
| cryptoswift.swift:92:18:92:36 | call to getConstantString() : | cryptoswift.swift:153:26:153:26 | keyString |
2020
| cryptoswift.swift:92:18:92:36 | call to getConstantString() : | cryptoswift.swift:162:24:162:24 | keyString |
2121
| cryptoswift.swift:92:18:92:36 | call to getConstantString() : | cryptoswift.swift:164:24:164:24 | keyString |
22+
| misc.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : |
23+
| misc.swift:38:19:38:38 | call to Data.init(_:) : | misc.swift:41:41:41:41 | myConstKey |
24+
| misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
25+
| misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:38:19:38:38 | call to Data.init(_:) : |
2226
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : |
2327
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:65:73:65:73 | myConstKey |
2428
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:66:73:66:73 | myConstKey |
@@ -60,6 +64,11 @@ nodes
6064
| cryptoswift.swift:163:24:163:24 | key | semmle.label | key |
6165
| cryptoswift.swift:164:24:164:24 | keyString | semmle.label | keyString |
6266
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : |
67+
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : |
68+
| misc.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | semmle.label | [summary param] 0 in Data.init(_:) : |
69+
| misc.swift:38:19:38:38 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
70+
| misc.swift:38:24:38:24 | abcdef123456 : | semmle.label | abcdef123456 : |
71+
| misc.swift:41:41:41:41 | myConstKey | semmle.label | myConstKey |
6372
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | semmle.label | [summary param] 0 in Data.init(_:) : |
6473
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
6574
| rncryptor.swift:60:24:60:24 | abcdef123456 : | semmle.label | abcdef123456 : |
@@ -78,6 +87,7 @@ nodes
7887
| rncryptor.swift:80:94:80:94 | myConstKey | semmle.label | myConstKey |
7988
| rncryptor.swift:81:102:81:102 | myConstKey | semmle.label | myConstKey |
8089
subpaths
90+
| misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | misc.swift:38:19:38:38 | call to Data.init(_:) : |
8191
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
8292
#select
8393
| cryptoswift.swift:108:21:108:21 | keyString | cryptoswift.swift:76:3:76:3 | this string is constant : | cryptoswift.swift:108:21:108:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:76:3:76:3 | this string is constant : | this string is constant |
@@ -99,6 +109,7 @@ subpaths
99109
| cryptoswift.swift:162:24:162:24 | keyString | cryptoswift.swift:76:3:76:3 | this string is constant : | cryptoswift.swift:162:24:162:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:76:3:76:3 | this string is constant : | this string is constant |
100110
| cryptoswift.swift:163:24:163:24 | key | cryptoswift.swift:90:26:90:121 | [...] : | cryptoswift.swift:163:24:163:24 | key | The key 'key' has been initialized with hard-coded values from $@. | cryptoswift.swift:90:26:90:121 | [...] : | [...] |
101111
| cryptoswift.swift:164:24:164:24 | keyString | cryptoswift.swift:76:3:76:3 | this string is constant : | cryptoswift.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:76:3:76:3 | this string is constant : | this string is constant |
112+
| misc.swift:41:41:41:41 | myConstKey | misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:41:41:41:41 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | misc.swift:38:24:38:24 | abcdef123456 : | abcdef123456 |
102113
| rncryptor.swift:65:73:65:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:65:73:65:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
103114
| rncryptor.swift:66:73:66:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:66:73:66:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
104115
| rncryptor.swift:67:73:67:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:67:73:67:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |

‎swift/ql/test/query-tests/Security/CWE-321/misc.swift

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ func test(myVarStr: String) {
3838
let myConstKey = Data("abcdef123456")
3939

4040
_ = Realm.Configuration(encryptionKey: myVarKey) // GOOD
41-
_ = Realm.Configuration(encryptionKey: myConstKey) // BAD [NOT DETECTED]
41+
_ = Realm.Configuration(encryptionKey: myConstKey) // BAD
4242

4343
var config = Realm.Configuration() // GOOD
4444
config.encryptionKey = myVarKey // GOOD

0 commit comments

Comments
 (0)