Skip to content

Commit 1d57663

Browse files
atorralbaatorralba
authored
Merge pull request #11345 from atorralba/atorralba/swift/data-models
Swift: Add taint models for the Data class
2 parents 32442a3 + e4e5291 commit 1d57663

File tree

9 files changed

+745
-23
lines changed

9 files changed

+745
-23
lines changed

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Data.qll

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,51 @@
11
import swift
22
private import codeql.swift.dataflow.ExternalFlow
33

4+
private class DataSources extends SourceModelCsv {
5+
override predicate row(string row) {
6+
row = ";Data;true;init(contentsOf:options:);;;ReturnValue;remote"
7+
}
8+
}
9+
410
private class DataSummaries extends SummaryModelCsv {
5-
override predicate row(string row) { row = ";Data;true;init(_:);;;Argument[0];ReturnValue;taint" }
11+
override predicate row(string row) {
12+
row =
13+
[
14+
";Data;true;init(_:);;;Argument[0];ReturnValue;taint",
15+
";Data;true;init(base64Encoded:options:);;;Argument[0];ReturnValue;taint",
16+
";Data;true;init(buffer:);;;Argument[0];ReturnValue;taint",
17+
";Data;true;init(bytes:count:);;;Argument[0];ReturnValue;taint",
18+
";Data;true;init(contentsOf:options:);;;Argument[0];ReturnValue;taint",
19+
";Data;true;init(bytesNoCopy:count:deallocator:);;;Argument[0];ReturnValue;taint",
20+
";Data;true;init(referencing:);;;Argument[0];ReturnValue;taint",
21+
";Data;true;append(_:);;;Argument[0];Argument[-1];taint",
22+
";Data;true;append(_:count:);;;Argument[0];Argument[-1];taint",
23+
";Data;true;append(contentsOf:);;;Argument[0];Argument[-1];taint",
24+
";Data;true;base64EncodedData(options:);;;Argument[-1];ReturnValue;taint",
25+
";Data;true;base64EncodedString(options:);;;Argument[-1];ReturnValue;taint",
26+
";Data;true;compactMap(_:);;;Argument[-1];ReturnValue;taint",
27+
";Data;true;copyBytes(to:);;;Argument[-1];Argument[0];taint",
28+
";Data;true;copyBytes(to:count:);;;Argument[-1];Argument[0];taint",
29+
";Data;true;copyBytes(to:from:);;;Argument[-1];Argument[0];taint",
30+
";Data;true;flatMap(_:);;;Argument[-1];ReturnValue;taint",
31+
";Data;true;insert(_:at:);;;Argument[0];Argument[-1];taint",
32+
";Data;true;insert(contentsOf:at:);;;Argument[0];Argument[-1];taint",
33+
";Data;true;map(_:);;;Argument[-1];ReturnValue;taint",
34+
";Data;true;reduce(into:_:);;;Argument[-1];ReturnValue;taint",
35+
";Data;true;replace(_:with:maxReplacements:);;;Argument[1];Argument[-1];taint",
36+
";Data;true;replaceSubrange(_:with:);;;Argument[1];Argument[-1];taint",
37+
";Data;true;replaceSubrange(_:with:count:);;;Argument[1];Argument[-1];taint",
38+
";Data;true;replacing(_:with:maxReplacements:);;;Argument[1];Argument[-1];taint",
39+
";Data;true;replacing(_:with:subrange:maxReplacements:);;;Argument[1];Argument[-1];taint",
40+
// TODO: this should be implemented by a model of BidirectionalCollection
41+
// ";Data;true;reversed();;;Argument[-1];ReturnValue;taint",
42+
";Data;true;sorted();;;Argument[-1];ReturnValue;taint",
43+
";Data;true;sorted(by:);;;Argument[-1];ReturnValue;taint",
44+
";Data;true;sorted(using:);;;Argument[-1];ReturnValue;taint",
45+
";Data;true;shuffled();;;Argument[-1];ReturnValue;taint",
46+
";Data;true;shuffled(using:);;;Argument[-1];ReturnValue;taint",
47+
";Data;true;trimmingPrefix(_:);;;Argument[-1];ReturnValue;taint",
48+
";Data;true;trimmingPrefix(while:);;;Argument[-1];ReturnValue;taint"
49+
]
50+
}
651
}

‎swift/ql/src/queries/Security/CWE-094/UnsafeJsEval.ql

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -108,10 +108,6 @@ class UnsafeJsEvalConfig extends TaintTracking::Configuration {
108108
])
109109
).getArgument(0)
110110
or
111-
arg =
112-
any(CallExpr ce | ce.getStaticTarget().(MethodDecl).hasQualifiedName("Data", "init(_:)"))
113-
.getArgument(0)
114-
or
115111
arg =
116112
any(CallExpr ce |
117113
ce.getStaticTarget().(MethodDecl).hasQualifiedName("String", "init(decoding:as:)")

‎swift/ql/test/library-tests/dataflow/flowsources/FlowSources.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
| customurlschemes.swift:38:52:38:62 | url | external |
44
| customurlschemes.swift:43:9:43:28 | ...[...] | Remote URL in UIApplicationDelegate.application.launchOptions |
55
| customurlschemes.swift:48:9:48:28 | ...[...] | Remote URL in UIApplicationDelegate.application.launchOptions |
6+
| data.swift:18:20:18:20 | call to init(contentsOf:options:) | external |
7+
| data.swift:18:20:18:54 | call to init(contentsOf:options:) | external |
68
| nsdata.swift:18:17:18:17 | call to init(contentsOf:) | external |
79
| nsdata.swift:18:17:18:40 | call to init(contentsOf:) | external |
810
| nsdata.swift:19:17:19:17 | call to init(contentsOf:options:) | external |

‎swift/ql/test/library-tests/dataflow/flowsources/data.swift

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
// --- stubs ---
2+
3+
struct URL
4+
{
5+
init?(string: String) {}
6+
}
7+
8+
9+
struct Data {
10+
struct ReadingOptions : OptionSet { let rawValue: Int }
11+
init(contentsOf: URL, options: ReadingOptions) {}
12+
}
13+
14+
// --- tests ---
15+
16+
func testData() {
17+
let url = URL(string: "http://example.com/")
18+
let data = try Data(contentsOf: url!, options: []) // SOURCE
19+
}

‎swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
| data.swift:195:58:195:58 | &... | data.swift:195:58:195:73 | ...[...] |
12
| nsdata.swift:139:15:139:15 | nsDataTainted24 | nsdata.swift:139:15:139:31 | .bytes |
23
| nsdata.swift:140:15:140:15 | nsDataTainted24 | nsdata.swift:140:15:140:31 | .description |
34
| nsmutabledata.swift:49:15:49:15 | nsMutableDataTainted6 | nsmutabledata.swift:49:15:49:37 | .mutableBytes |

0 commit comments

Comments
 (0)