Skip to content

Commit 0d4cd3e

Browse files
geoffw0geoffw0
committed
Swift: Add more sensitive data test cases.
1 parent 3f66b63 commit 0d4cd3e

File tree

3 files changed

+35
-1
lines changed

3 files changed

+35
-1
lines changed

‎swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,12 @@ edges
297297
| testRealm2.swift:18:2:18:2 | [post] o [data] | testRealm2.swift:18:2:18:2 | [post] o | provenance | |
298298
| testRealm2.swift:18:11:18:11 | myPassword | testRealm2.swift:13:6:13:6 | value | provenance | |
299299
| testRealm2.swift:18:11:18:11 | myPassword | testRealm2.swift:18:2:18:2 | [post] o [data] | provenance | |
300+
| testRealm2.swift:24:2:24:2 | [post] o [data] | testRealm2.swift:24:2:24:2 | [post] o | provenance | |
301+
| testRealm2.swift:24:11:24:11 | socialSecurityNumber | testRealm2.swift:13:6:13:6 | value | provenance | |
302+
| testRealm2.swift:24:11:24:11 | socialSecurityNumber | testRealm2.swift:24:2:24:2 | [post] o [data] | provenance | |
303+
| testRealm2.swift:32:2:32:2 | [post] o [data] | testRealm2.swift:32:2:32:2 | [post] o | provenance | |
304+
| testRealm2.swift:32:11:32:11 | creditCardNumber | testRealm2.swift:13:6:13:6 | value | provenance | |
305+
| testRealm2.swift:32:11:32:11 | creditCardNumber | testRealm2.swift:32:2:32:2 | [post] o [data] | provenance | |
300306
| testRealm.swift:27:6:27:6 | value | file://:0:0:0:0 | value | provenance | |
301307
| testRealm.swift:34:6:34:6 | value | file://:0:0:0:0 | value | provenance | |
302308
| testRealm.swift:41:2:41:2 | [post] a [data] | testRealm.swift:41:2:41:2 | [post] a | provenance | |
@@ -721,6 +727,12 @@ nodes
721727
| testRealm2.swift:18:2:18:2 | [post] o | semmle.label | [post] o |
722728
| testRealm2.swift:18:2:18:2 | [post] o [data] | semmle.label | [post] o [data] |
723729
| testRealm2.swift:18:11:18:11 | myPassword | semmle.label | myPassword |
730+
| testRealm2.swift:24:2:24:2 | [post] o | semmle.label | [post] o |
731+
| testRealm2.swift:24:2:24:2 | [post] o [data] | semmle.label | [post] o [data] |
732+
| testRealm2.swift:24:11:24:11 | socialSecurityNumber | semmle.label | socialSecurityNumber |
733+
| testRealm2.swift:32:2:32:2 | [post] o | semmle.label | [post] o |
734+
| testRealm2.swift:32:2:32:2 | [post] o [data] | semmle.label | [post] o [data] |
735+
| testRealm2.swift:32:11:32:11 | creditCardNumber | semmle.label | creditCardNumber |
724736
| testRealm.swift:27:6:27:6 | self [Return] [data] | semmle.label | self [Return] [data] |
725737
| testRealm.swift:27:6:27:6 | value | semmle.label | value |
726738
| testRealm.swift:34:6:34:6 | self [Return] [password] | semmle.label | self [Return] [password] |
@@ -756,6 +768,8 @@ subpaths
756768
| testCoreData2.swift:104:18:104:18 | e | testCoreData2.swift:70:9:70:9 | self | file://:0:0:0:0 | .value | testCoreData2.swift:104:18:104:20 | .value |
757769
| testCoreData2.swift:105:18:105:18 | e | testCoreData2.swift:71:9:71:9 | self | file://:0:0:0:0 | .value2 | testCoreData2.swift:105:18:105:20 | .value2 |
758770
| testRealm2.swift:18:11:18:11 | myPassword | testRealm2.swift:13:6:13:6 | value | testRealm2.swift:13:6:13:6 | self [Return] [data] | testRealm2.swift:18:2:18:2 | [post] o [data] |
771+
| testRealm2.swift:24:11:24:11 | socialSecurityNumber | testRealm2.swift:13:6:13:6 | value | testRealm2.swift:13:6:13:6 | self [Return] [data] | testRealm2.swift:24:2:24:2 | [post] o [data] |
772+
| testRealm2.swift:32:11:32:11 | creditCardNumber | testRealm2.swift:13:6:13:6 | value | testRealm2.swift:13:6:13:6 | self [Return] [data] | testRealm2.swift:32:2:32:2 | [post] o [data] |
759773
| testRealm.swift:41:11:41:11 | myPassword | testRealm.swift:27:6:27:6 | value | testRealm.swift:27:6:27:6 | self [Return] [data] | testRealm.swift:41:2:41:2 | [post] a [data] |
760774
| testRealm.swift:49:11:49:11 | myPassword | testRealm.swift:27:6:27:6 | value | testRealm.swift:27:6:27:6 | self [Return] [data] | testRealm.swift:49:2:49:2 | [post] c [data] |
761775
| testRealm.swift:59:12:59:12 | myPassword | testRealm.swift:27:6:27:6 | value | testRealm.swift:27:6:27:6 | self [Return] [data] | testRealm.swift:59:2:59:3 | [post] ...! [data] |
@@ -890,6 +904,8 @@ subpaths
890904
| testGRDB.swift:210:84:210:93 | [...] | testGRDB.swift:210:85:210:85 | password | testGRDB.swift:210:84:210:93 | [...] | This operation stores '[...]' in a database. It may contain unencrypted sensitive data from $@. | testGRDB.swift:210:85:210:85 | password | password |
891905
| testGRDB.swift:212:98:212:107 | [...] | testGRDB.swift:212:99:212:99 | password | testGRDB.swift:212:98:212:107 | [...] | This operation stores '[...]' in a database. It may contain unencrypted sensitive data from $@. | testGRDB.swift:212:99:212:99 | password | password |
892906
| testRealm2.swift:18:2:18:2 | o | testRealm2.swift:18:11:18:11 | myPassword | testRealm2.swift:18:2:18:2 | [post] o | This operation stores 'o' in a database. It may contain unencrypted sensitive data from $@. | testRealm2.swift:18:11:18:11 | myPassword | myPassword |
907+
| testRealm2.swift:24:2:24:2 | o | testRealm2.swift:24:11:24:11 | socialSecurityNumber | testRealm2.swift:24:2:24:2 | [post] o | This operation stores 'o' in a database. It may contain unencrypted sensitive data from $@. | testRealm2.swift:24:11:24:11 | socialSecurityNumber | socialSecurityNumber |
908+
| testRealm2.swift:32:2:32:2 | o | testRealm2.swift:32:11:32:11 | creditCardNumber | testRealm2.swift:32:2:32:2 | [post] o | This operation stores 'o' in a database. It may contain unencrypted sensitive data from $@. | testRealm2.swift:32:11:32:11 | creditCardNumber | creditCardNumber |
893909
| testRealm.swift:41:2:41:2 | a | testRealm.swift:41:11:41:11 | myPassword | testRealm.swift:41:2:41:2 | [post] a | This operation stores 'a' in a database. It may contain unencrypted sensitive data from $@. | testRealm.swift:41:11:41:11 | myPassword | myPassword |
894910
| testRealm.swift:49:2:49:2 | c | testRealm.swift:49:11:49:11 | myPassword | testRealm.swift:49:2:49:2 | [post] c | This operation stores 'c' in a database. It may contain unencrypted sensitive data from $@. | testRealm.swift:49:11:49:11 | myPassword | myPassword |
895911
| testRealm.swift:59:2:59:3 | ...! | testRealm.swift:59:12:59:12 | myPassword | testRealm.swift:59:2:59:3 | [post] ...! | This operation stores '...!' in a database. It may contain unencrypted sensitive data from $@. | testRealm.swift:59:12:59:12 | myPassword | myPassword |

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,8 @@
141141
| testGRDB.swift:210:85:210:85 | password | label:password, type:password |
142142
| testGRDB.swift:212:99:212:99 | password | label:password, type:password |
143143
| testRealm2.swift:18:11:18:11 | myPassword | label:myPassword, type:password |
144+
| testRealm2.swift:24:11:24:11 | socialSecurityNumber | label:socialSecurityNumber, type:private information |
145+
| testRealm2.swift:32:11:32:11 | creditCardNumber | label:creditCardNumber, type:private information |
144146
| testRealm.swift:31:20:31:20 | .password | label:password, type:password |
145147
| testRealm.swift:41:11:41:11 | myPassword | label:myPassword, type:password |
146148
| testRealm.swift:49:11:49:11 | myPassword | label:myPassword, type:password |

‎swift/ql/test/query-tests/Security/CWE-311/testRealm2.swift

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,25 @@ class MyRealmSwiftObject3 : Object {
1313
var data: String
1414
}
1515

16-
func test1(o: MyRealmSwiftObject3, myHarmless: String, myPassword : String) {
16+
func test1(o: MyRealmSwiftObject3, myHarmless: String, myPassword: String) {
1717
// ...
1818
o.data = myPassword // BAD
1919
o.data = myHarmless
2020
// ...
2121
}
22+
23+
func test2(o: MyRealmSwiftObject3, ccn: String, socialSecurityNumber: String, ssn: String, ssn_int: Int, userSSN: String, classno: String) {
24+
o.data = socialSecurityNumber // BAD
25+
o.data = ssn // BAD [NOT DETECTED]
26+
o.data = String(ssn_int) // BAD [NOT DETECTED]
27+
o.data = userSSN // BAD [NOT DETECTED]
28+
o.data = classno // GOOD
29+
}
30+
31+
func test3(o: MyRealmSwiftObject3, ccn: String, creditCardNumber: String, CCN: String, int_ccn: Int, userCcn: String, succnode: String) {
32+
o.data = creditCardNumber // BAD
33+
o.data = CCN // BAD [NOT DETECTED]
34+
o.data = String(int_ccn) // BAD [NOT DETECTED]
35+
o.data = userCcn // BAD [NOT DETECTED]
36+
o.data = succnode // GOOD
37+
}

0 commit comments

Comments
 (0)