Skip to content

Commit 1908033

Browse files
geoffw0geoffw0
committed
Swift: Add a few test cases.
1 parent e402c22 commit 1908033

File tree

2 files changed

+75
-0
lines changed

2 files changed

+75
-0
lines changed

‎swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.expected

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,18 @@ edges
1818
| StringLengthConflation.swift:137:34:137:36 | .count | StringLengthConflation.swift:137:34:137:44 | ... .-(_:_:) ... |
1919
| StringLengthConflation.swift:138:36:138:38 | .count | StringLengthConflation.swift:138:36:138:46 | ... .-(_:_:) ... |
2020
| StringLengthConflation.swift:144:28:144:30 | .count | StringLengthConflation.swift:144:28:144:38 | ... .-(_:_:) ... |
21+
| StringLengthConflation.swift:168:29:168:36 | .count | StringLengthConflation.swift:168:29:168:44 | ... .-(_:_:) ... |
22+
| StringLengthConflation.swift:169:29:169:37 | .count | StringLengthConflation.swift:169:29:169:45 | ... .-(_:_:) ... |
23+
| StringLengthConflation.swift:170:29:170:46 | .count | StringLengthConflation.swift:170:29:170:54 | ... .-(_:_:) ... |
24+
| StringLengthConflation.swift:171:29:171:32 | .length | StringLengthConflation.swift:171:29:171:41 | ... .-(_:_:) ... |
25+
| StringLengthConflation.swift:172:29:172:33 | .length | StringLengthConflation.swift:172:29:172:42 | ... .-(_:_:) ... |
26+
| StringLengthConflation.swift:174:35:174:42 | .count | StringLengthConflation.swift:174:35:174:50 | ... .-(_:_:) ... |
27+
| StringLengthConflation.swift:175:35:175:43 | .count | StringLengthConflation.swift:175:35:175:51 | ... .-(_:_:) ... |
28+
| StringLengthConflation.swift:176:35:176:52 | .count | StringLengthConflation.swift:176:35:176:60 | ... .-(_:_:) ... |
29+
| StringLengthConflation.swift:177:35:177:38 | .length | StringLengthConflation.swift:177:35:177:47 | ... .-(_:_:) ... |
30+
| StringLengthConflation.swift:178:35:178:39 | .length | StringLengthConflation.swift:178:35:178:48 | ... .-(_:_:) ... |
31+
| StringLengthConflation.swift:180:37:180:44 | .count | StringLengthConflation.swift:180:37:180:52 | ... .-(_:_:) ... |
32+
| StringLengthConflation.swift:182:37:182:45 | .count | StringLengthConflation.swift:182:37:182:53 | ... .-(_:_:) ... |
2133
| file://:0:0:0:0 | .length | StringLengthConflation.swift:53:43:53:46 | .length |
2234
| file://:0:0:0:0 | .length | StringLengthConflation.swift:60:47:60:50 | .length |
2335
| file://:0:0:0:0 | .length | StringLengthConflation.swift:66:33:66:36 | .length |
@@ -27,6 +39,10 @@ edges
2739
| file://:0:0:0:0 | .length | StringLengthConflation.swift:108:25:108:28 | .length |
2840
| file://:0:0:0:0 | .length | StringLengthConflation.swift:114:23:114:26 | .length |
2941
| file://:0:0:0:0 | .length | StringLengthConflation.swift:120:22:120:25 | .length |
42+
| file://:0:0:0:0 | .length | StringLengthConflation.swift:171:29:171:32 | .length |
43+
| file://:0:0:0:0 | .length | StringLengthConflation.swift:172:29:172:33 | .length |
44+
| file://:0:0:0:0 | .length | StringLengthConflation.swift:177:35:177:38 | .length |
45+
| file://:0:0:0:0 | .length | StringLengthConflation.swift:178:35:178:39 | .length |
3046
nodes
3147
| StringLengthConflation2.swift:35:36:35:38 | .count | semmle.label | .count |
3248
| StringLengthConflation2.swift:35:36:35:46 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
@@ -76,6 +92,30 @@ nodes
7692
| StringLengthConflation.swift:151:45:151:53 | .count | semmle.label | .count |
7793
| StringLengthConflation.swift:156:45:156:52 | .count | semmle.label | .count |
7894
| StringLengthConflation.swift:161:45:161:53 | .count | semmle.label | .count |
95+
| StringLengthConflation.swift:168:29:168:36 | .count | semmle.label | .count |
96+
| StringLengthConflation.swift:168:29:168:44 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
97+
| StringLengthConflation.swift:169:29:169:37 | .count | semmle.label | .count |
98+
| StringLengthConflation.swift:169:29:169:45 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
99+
| StringLengthConflation.swift:170:29:170:46 | .count | semmle.label | .count |
100+
| StringLengthConflation.swift:170:29:170:54 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
101+
| StringLengthConflation.swift:171:29:171:32 | .length | semmle.label | .length |
102+
| StringLengthConflation.swift:171:29:171:41 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
103+
| StringLengthConflation.swift:172:29:172:33 | .length | semmle.label | .length |
104+
| StringLengthConflation.swift:172:29:172:42 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
105+
| StringLengthConflation.swift:174:35:174:42 | .count | semmle.label | .count |
106+
| StringLengthConflation.swift:174:35:174:50 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
107+
| StringLengthConflation.swift:175:35:175:43 | .count | semmle.label | .count |
108+
| StringLengthConflation.swift:175:35:175:51 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
109+
| StringLengthConflation.swift:176:35:176:52 | .count | semmle.label | .count |
110+
| StringLengthConflation.swift:176:35:176:60 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
111+
| StringLengthConflation.swift:177:35:177:38 | .length | semmle.label | .length |
112+
| StringLengthConflation.swift:177:35:177:47 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
113+
| StringLengthConflation.swift:178:35:178:39 | .length | semmle.label | .length |
114+
| StringLengthConflation.swift:178:35:178:48 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
115+
| StringLengthConflation.swift:180:37:180:44 | .count | semmle.label | .count |
116+
| StringLengthConflation.swift:180:37:180:52 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
117+
| StringLengthConflation.swift:182:37:182:45 | .count | semmle.label | .count |
118+
| StringLengthConflation.swift:182:37:182:53 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
79119
| file://:0:0:0:0 | .length | semmle.label | .length |
80120
subpaths
81121
#select
@@ -117,3 +157,19 @@ subpaths
117157
| StringLengthConflation.swift:151:45:151:53 | .count | StringLengthConflation.swift:151:45:151:53 | .count | StringLengthConflation.swift:151:45:151:53 | .count | This String.unicodeScalars length is used in a String, but it may not be equivalent. |
118158
| StringLengthConflation.swift:156:45:156:52 | .count | StringLengthConflation.swift:156:45:156:52 | .count | StringLengthConflation.swift:156:45:156:52 | .count | This String.utf8 length is used in a String, but it may not be equivalent. |
119159
| StringLengthConflation.swift:161:45:161:53 | .count | StringLengthConflation.swift:161:45:161:53 | .count | StringLengthConflation.swift:161:45:161:53 | .count | This String.utf16 length is used in a String, but it may not be equivalent. |
160+
| StringLengthConflation.swift:168:29:168:44 | ... .-(_:_:) ... | StringLengthConflation.swift:168:29:168:36 | .count | StringLengthConflation.swift:168:29:168:44 | ... .-(_:_:) ... | This String.utf8 length is used in a String, but it may not be equivalent. |
161+
| StringLengthConflation.swift:169:29:169:45 | ... .-(_:_:) ... | StringLengthConflation.swift:169:29:169:37 | .count | StringLengthConflation.swift:169:29:169:45 | ... .-(_:_:) ... | This String.utf16 length is used in a String, but it may not be equivalent. |
162+
| StringLengthConflation.swift:170:29:170:54 | ... .-(_:_:) ... | StringLengthConflation.swift:170:29:170:46 | .count | StringLengthConflation.swift:170:29:170:54 | ... .-(_:_:) ... | This String.unicodeScalars length is used in a String, but it may not be equivalent. |
163+
| StringLengthConflation.swift:171:29:171:41 | ... .-(_:_:) ... | StringLengthConflation.swift:171:29:171:32 | .length | StringLengthConflation.swift:171:29:171:41 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
164+
| StringLengthConflation.swift:171:29:171:41 | ... .-(_:_:) ... | file://:0:0:0:0 | .length | StringLengthConflation.swift:171:29:171:41 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
165+
| StringLengthConflation.swift:172:29:172:42 | ... .-(_:_:) ... | StringLengthConflation.swift:172:29:172:33 | .length | StringLengthConflation.swift:172:29:172:42 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
166+
| StringLengthConflation.swift:172:29:172:42 | ... .-(_:_:) ... | file://:0:0:0:0 | .length | StringLengthConflation.swift:172:29:172:42 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
167+
| StringLengthConflation.swift:174:35:174:50 | ... .-(_:_:) ... | StringLengthConflation.swift:174:35:174:42 | .count | StringLengthConflation.swift:174:35:174:50 | ... .-(_:_:) ... | This String.utf8 length is used in a String, but it may not be equivalent. |
168+
| StringLengthConflation.swift:175:35:175:51 | ... .-(_:_:) ... | StringLengthConflation.swift:175:35:175:43 | .count | StringLengthConflation.swift:175:35:175:51 | ... .-(_:_:) ... | This String.utf16 length is used in a String, but it may not be equivalent. |
169+
| StringLengthConflation.swift:176:35:176:60 | ... .-(_:_:) ... | StringLengthConflation.swift:176:35:176:52 | .count | StringLengthConflation.swift:176:35:176:60 | ... .-(_:_:) ... | This String.unicodeScalars length is used in a String, but it may not be equivalent. |
170+
| StringLengthConflation.swift:177:35:177:47 | ... .-(_:_:) ... | StringLengthConflation.swift:177:35:177:38 | .length | StringLengthConflation.swift:177:35:177:47 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
171+
| StringLengthConflation.swift:177:35:177:47 | ... .-(_:_:) ... | file://:0:0:0:0 | .length | StringLengthConflation.swift:177:35:177:47 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
172+
| StringLengthConflation.swift:178:35:178:48 | ... .-(_:_:) ... | StringLengthConflation.swift:178:35:178:39 | .length | StringLengthConflation.swift:178:35:178:48 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
173+
| StringLengthConflation.swift:178:35:178:48 | ... .-(_:_:) ... | file://:0:0:0:0 | .length | StringLengthConflation.swift:178:35:178:48 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
174+
| StringLengthConflation.swift:180:37:180:52 | ... .-(_:_:) ... | StringLengthConflation.swift:180:37:180:44 | .count | StringLengthConflation.swift:180:37:180:52 | ... .-(_:_:) ... | This String.utf8 length is used in a String, but it may not be equivalent. |
175+
| StringLengthConflation.swift:182:37:182:53 | ... .-(_:_:) ... | StringLengthConflation.swift:182:37:182:45 | .count | StringLengthConflation.swift:182:37:182:53 | ... .-(_:_:) ... | This String.utf16 length is used in a String, but it may not be equivalent. |

‎swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.swift

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,25 @@ func test(s: String) {
161161
let _ = s.index(s.startIndex, offsetBy: s_utf16.count) // BAD
162162
let _ = s_utf16.index(s_utf16.startIndex, offsetBy: scalars.count) // GOOD
163163
let _ = s_utf16.index(s_utf16.startIndex, offsetBy: s.count) // BAD [NOT DETECTED]
164+
165+
// --- methods provided by Sequence, Collection etc ---
166+
167+
let _ = String(s.prefix(s.count - 10)) // GOOD
168+
let _ = String(s.prefix(s.utf8.count - 10)) // BAD
169+
let _ = String(s.prefix(s.utf16.count - 10)) // BAD
170+
let _ = String(s.prefix(s.unicodeScalars.count - 10)) // BAD
171+
let _ = String(s.prefix(ns.length - 10)) // BAD
172+
let _ = String(s.prefix(nms.length - 10)) // BAD
173+
let _ = String(scalars.prefix(s.count - 10)) // BAD [NOT DETECTED]
174+
let _ = String(scalars.prefix(s.utf8.count - 10)) // BAD
175+
let _ = String(scalars.prefix(s.utf16.count - 10)) // BAD
176+
let _ = String(scalars.prefix(s.unicodeScalars.count - 10)) // GOOD [FALSE POSITIVE]
177+
let _ = String(scalars.prefix(ns.length - 10)) // BAD
178+
let _ = String(scalars.prefix(nms.length - 10)) // BAD
179+
let _ = String(s.utf8.dropFirst(s.count - 10)) // BAD [NOT DETECTED]
180+
let _ = String(s.utf8.dropFirst(s.utf8.count - 10)) // GOOD [FALSE POSITIVE]
181+
let _ = String(s.utf16.dropLast(s.count - 10)) // BAD [NOT DETECTED]
182+
let _ = String(s.utf16.dropLast(s.utf16.count - 10)) // GOOD [FALSE POSITIVE]
164183
}
165184

166185
// `begin :thumbsup: end`, with thumbs up emoji and skin tone modifier

0 commit comments

Comments
 (0)