Skip to content

Commit 1d903c5

Browse files
geoffw0geoffw0
committed
Swift: Add a test with SecKeyCopyExternalRepresentation.
1 parent a5dd4a4 commit 1d903c5

File tree

3 files changed

+79
-49
lines changed

3 files changed

+79
-49
lines changed

‎swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,15 @@ edges
1414
| testSend.swift:86:7:86:7 | self | file://:0:0:0:0 | self |
1515
| testSend.swift:94:27:94:30 | .password | testSend.swift:86:7:86:7 | self |
1616
| testSend.swift:94:27:94:30 | .password | testSend.swift:94:27:94:39 | .value |
17-
| testURL.swift:17:50:17:50 | passwd | testURL.swift:17:18:17:50 | ... .+(_:_:) ... |
18-
| testURL.swift:19:51:19:51 | account_no | testURL.swift:19:18:19:51 | ... .+(_:_:) ... |
19-
| testURL.swift:20:51:20:51 | credit_card_no | testURL.swift:20:18:20:51 | ... .+(_:_:) ... |
20-
| testURL.swift:28:51:28:51 | e_mail | testURL.swift:28:18:28:51 | ... .+(_:_:) ... |
21-
| testURL.swift:30:53:30:53 | a_homeaddr_z | testURL.swift:30:18:30:53 | ... .+(_:_:) ... |
22-
| testURL.swift:32:51:32:51 | resident_ID | testURL.swift:32:18:32:51 | ... .+(_:_:) ... |
23-
| testURL.swift:51:52:51:67 | call to get_secret_key() | testURL.swift:51:18:51:67 | ... .+(_:_:) ... |
24-
| testURL.swift:53:53:53:69 | call to get_cert_string() | testURL.swift:53:18:53:69 | ... .+(_:_:) ... |
25-
| testURL.swift:74:51:74:51 | certificate | testURL.swift:74:18:74:18 | "..." |
17+
| testURL.swift:39:50:39:50 | passwd | testURL.swift:39:18:39:50 | ... .+(_:_:) ... |
18+
| testURL.swift:41:51:41:51 | account_no | testURL.swift:41:18:41:51 | ... .+(_:_:) ... |
19+
| testURL.swift:42:51:42:51 | credit_card_no | testURL.swift:42:18:42:51 | ... .+(_:_:) ... |
20+
| testURL.swift:50:51:50:51 | e_mail | testURL.swift:50:18:50:51 | ... .+(_:_:) ... |
21+
| testURL.swift:52:53:52:53 | a_homeaddr_z | testURL.swift:52:18:52:53 | ... .+(_:_:) ... |
22+
| testURL.swift:54:51:54:51 | resident_ID | testURL.swift:54:18:54:51 | ... .+(_:_:) ... |
23+
| testURL.swift:73:52:73:67 | call to get_secret_key() | testURL.swift:73:18:73:67 | ... .+(_:_:) ... |
24+
| testURL.swift:75:53:75:69 | call to get_cert_string() | testURL.swift:75:18:75:69 | ... .+(_:_:) ... |
25+
| testURL.swift:96:51:96:51 | certificate | testURL.swift:96:18:96:18 | "..." |
2626
nodes
2727
| file://:0:0:0:0 | .value | semmle.label | .value |
2828
| file://:0:0:0:0 | self | semmle.label | self |
@@ -55,25 +55,25 @@ nodes
5555
| testSend.swift:86:7:86:7 | self | semmle.label | self |
5656
| testSend.swift:94:27:94:30 | .password | semmle.label | .password |
5757
| testSend.swift:94:27:94:39 | .value | semmle.label | .value |
58-
| testURL.swift:17:18:17:50 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
59-
| testURL.swift:17:50:17:50 | passwd | semmle.label | passwd |
60-
| testURL.swift:19:18:19:51 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
61-
| testURL.swift:19:51:19:51 | account_no | semmle.label | account_no |
62-
| testURL.swift:20:18:20:51 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
63-
| testURL.swift:20:51:20:51 | credit_card_no | semmle.label | credit_card_no |
64-
| testURL.swift:24:22:24:22 | passwd | semmle.label | passwd |
65-
| testURL.swift:28:18:28:51 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
66-
| testURL.swift:28:51:28:51 | e_mail | semmle.label | e_mail |
67-
| testURL.swift:30:18:30:53 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
68-
| testURL.swift:30:53:30:53 | a_homeaddr_z | semmle.label | a_homeaddr_z |
69-
| testURL.swift:32:18:32:51 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
70-
| testURL.swift:32:51:32:51 | resident_ID | semmle.label | resident_ID |
71-
| testURL.swift:51:18:51:67 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
72-
| testURL.swift:51:52:51:67 | call to get_secret_key() | semmle.label | call to get_secret_key() |
73-
| testURL.swift:53:18:53:69 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
74-
| testURL.swift:53:53:53:69 | call to get_cert_string() | semmle.label | call to get_cert_string() |
75-
| testURL.swift:74:18:74:18 | "..." | semmle.label | "..." |
76-
| testURL.swift:74:51:74:51 | certificate | semmle.label | certificate |
58+
| testURL.swift:39:18:39:50 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
59+
| testURL.swift:39:50:39:50 | passwd | semmle.label | passwd |
60+
| testURL.swift:41:18:41:51 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
61+
| testURL.swift:41:51:41:51 | account_no | semmle.label | account_no |
62+
| testURL.swift:42:18:42:51 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
63+
| testURL.swift:42:51:42:51 | credit_card_no | semmle.label | credit_card_no |
64+
| testURL.swift:46:22:46:22 | passwd | semmle.label | passwd |
65+
| testURL.swift:50:18:50:51 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
66+
| testURL.swift:50:51:50:51 | e_mail | semmle.label | e_mail |
67+
| testURL.swift:52:18:52:53 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
68+
| testURL.swift:52:53:52:53 | a_homeaddr_z | semmle.label | a_homeaddr_z |
69+
| testURL.swift:54:18:54:51 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
70+
| testURL.swift:54:51:54:51 | resident_ID | semmle.label | resident_ID |
71+
| testURL.swift:73:18:73:67 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
72+
| testURL.swift:73:52:73:67 | call to get_secret_key() | semmle.label | call to get_secret_key() |
73+
| testURL.swift:75:18:75:69 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
74+
| testURL.swift:75:53:75:69 | call to get_cert_string() | semmle.label | call to get_cert_string() |
75+
| testURL.swift:96:18:96:18 | "..." | semmle.label | "..." |
76+
| testURL.swift:96:51:96:51 | certificate | semmle.label | certificate |
7777
subpaths
7878
| testSend.swift:60:17:60:17 | password | testSend.swift:41:10:41:18 | data | testSend.swift:41:45:41:45 | data | testSend.swift:60:13:60:25 | call to pad(_:) |
7979
| testSend.swift:94:27:94:30 | .password | testSend.swift:86:7:86:7 | self | file://:0:0:0:0 | .value | testSend.swift:94:27:94:39 | .value |
@@ -94,13 +94,13 @@ subpaths
9494
| testSend.swift:79:27:79:30 | .BankCardNo | testSend.swift:79:27:79:30 | .BankCardNo | testSend.swift:79:27:79:30 | .BankCardNo | This operation transmits '.BankCardNo', which may contain unencrypted sensitive data from $@. | testSend.swift:79:27:79:30 | .BankCardNo | .BankCardNo |
9595
| testSend.swift:80:27:80:30 | .MyCreditRating | testSend.swift:80:27:80:30 | .MyCreditRating | testSend.swift:80:27:80:30 | .MyCreditRating | This operation transmits '.MyCreditRating', which may contain unencrypted sensitive data from $@. | testSend.swift:80:27:80:30 | .MyCreditRating | .MyCreditRating |
9696
| testSend.swift:94:27:94:39 | .value | testSend.swift:94:27:94:30 | .password | testSend.swift:94:27:94:39 | .value | This operation transmits '.value', which may contain unencrypted sensitive data from $@. | testSend.swift:94:27:94:30 | .password | .password |
97-
| testURL.swift:17:18:17:50 | ... .+(_:_:) ... | testURL.swift:17:50:17:50 | passwd | testURL.swift:17:18:17:50 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:17:50:17:50 | passwd | passwd |
98-
| testURL.swift:19:18:19:51 | ... .+(_:_:) ... | testURL.swift:19:51:19:51 | account_no | testURL.swift:19:18:19:51 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:19:51:19:51 | account_no | account_no |
99-
| testURL.swift:20:18:20:51 | ... .+(_:_:) ... | testURL.swift:20:51:20:51 | credit_card_no | testURL.swift:20:18:20:51 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:20:51:20:51 | credit_card_no | credit_card_no |
100-
| testURL.swift:24:22:24:22 | passwd | testURL.swift:24:22:24:22 | passwd | testURL.swift:24:22:24:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@. | testURL.swift:24:22:24:22 | passwd | passwd |
101-
| testURL.swift:28:18:28:51 | ... .+(_:_:) ... | testURL.swift:28:51:28:51 | e_mail | testURL.swift:28:18:28:51 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:28:51:28:51 | e_mail | e_mail |
102-
| testURL.swift:30:18:30:53 | ... .+(_:_:) ... | testURL.swift:30:53:30:53 | a_homeaddr_z | testURL.swift:30:18:30:53 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:30:53:30:53 | a_homeaddr_z | a_homeaddr_z |
103-
| testURL.swift:32:18:32:51 | ... .+(_:_:) ... | testURL.swift:32:51:32:51 | resident_ID | testURL.swift:32:18:32:51 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:32:51:32:51 | resident_ID | resident_ID |
104-
| testURL.swift:51:18:51:67 | ... .+(_:_:) ... | testURL.swift:51:52:51:67 | call to get_secret_key() | testURL.swift:51:18:51:67 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:51:52:51:67 | call to get_secret_key() | call to get_secret_key() |
105-
| testURL.swift:53:18:53:69 | ... .+(_:_:) ... | testURL.swift:53:53:53:69 | call to get_cert_string() | testURL.swift:53:18:53:69 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:53:53:53:69 | call to get_cert_string() | call to get_cert_string() |
106-
| testURL.swift:74:18:74:18 | "..." | testURL.swift:74:51:74:51 | certificate | testURL.swift:74:18:74:18 | "..." | This operation transmits '"..."', which may contain unencrypted sensitive data from $@. | testURL.swift:74:51:74:51 | certificate | certificate |
97+
| testURL.swift:39:18:39:50 | ... .+(_:_:) ... | testURL.swift:39:50:39:50 | passwd | testURL.swift:39:18:39:50 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:39:50:39:50 | passwd | passwd |
98+
| testURL.swift:41:18:41:51 | ... .+(_:_:) ... | testURL.swift:41:51:41:51 | account_no | testURL.swift:41:18:41:51 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:41:51:41:51 | account_no | account_no |
99+
| testURL.swift:42:18:42:51 | ... .+(_:_:) ... | testURL.swift:42:51:42:51 | credit_card_no | testURL.swift:42:18:42:51 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:42:51:42:51 | credit_card_no | credit_card_no |
100+
| testURL.swift:46:22:46:22 | passwd | testURL.swift:46:22:46:22 | passwd | testURL.swift:46:22:46:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@. | testURL.swift:46:22:46:22 | passwd | passwd |
101+
| testURL.swift:50:18:50:51 | ... .+(_:_:) ... | testURL.swift:50:51:50:51 | e_mail | testURL.swift:50:18:50:51 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:50:51:50:51 | e_mail | e_mail |
102+
| testURL.swift:52:18:52:53 | ... .+(_:_:) ... | testURL.swift:52:53:52:53 | a_homeaddr_z | testURL.swift:52:18:52:53 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:52:53:52:53 | a_homeaddr_z | a_homeaddr_z |
103+
| testURL.swift:54:18:54:51 | ... .+(_:_:) ... | testURL.swift:54:51:54:51 | resident_ID | testURL.swift:54:18:54:51 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:54:51:54:51 | resident_ID | resident_ID |
104+
| testURL.swift:73:18:73:67 | ... .+(_:_:) ... | testURL.swift:73:52:73:67 | call to get_secret_key() | testURL.swift:73:18:73:67 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:73:52:73:67 | call to get_secret_key() | call to get_secret_key() |
105+
| testURL.swift:75:18:75:69 | ... .+(_:_:) ... | testURL.swift:75:53:75:69 | call to get_cert_string() | testURL.swift:75:18:75:69 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:75:53:75:69 | call to get_cert_string() | call to get_cert_string() |
106+
| testURL.swift:96:18:96:18 | "..." | testURL.swift:96:51:96:51 | certificate | testURL.swift:96:18:96:18 | "..." | This operation transmits '"..."', which may contain unencrypted sensitive data from $@. | testURL.swift:96:51:96:51 | certificate | certificate |

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -165,13 +165,13 @@
165165
| testSend.swift:79:27:79:30 | .BankCardNo | label:BankCardNo, type:private information |
166166
| testSend.swift:80:27:80:30 | .MyCreditRating | label:MyCreditRating, type:private information |
167167
| testSend.swift:94:27:94:30 | .password | label:password, type:credential |
168-
| testURL.swift:17:50:17:50 | passwd | label:passwd, type:credential |
169-
| testURL.swift:19:51:19:51 | account_no | label:account_no, type:private information |
170-
| testURL.swift:20:51:20:51 | credit_card_no | label:credit_card_no, type:private information |
171-
| testURL.swift:24:22:24:22 | passwd | label:passwd, type:credential |
172-
| testURL.swift:28:51:28:51 | e_mail | label:e_mail, type:private information |
173-
| testURL.swift:30:53:30:53 | a_homeaddr_z | label:a_homeaddr_z, type:private information |
174-
| testURL.swift:32:51:32:51 | resident_ID | label:resident_ID, type:private information |
175-
| testURL.swift:51:52:51:67 | call to get_secret_key() | label:get_secret_key, type:credential |
176-
| testURL.swift:53:53:53:69 | call to get_cert_string() | label:get_cert_string, type:credential |
177-
| testURL.swift:74:51:74:51 | certificate | label:certificate, type:credential |
168+
| testURL.swift:39:50:39:50 | passwd | label:passwd, type:credential |
169+
| testURL.swift:41:51:41:51 | account_no | label:account_no, type:private information |
170+
| testURL.swift:42:51:42:51 | credit_card_no | label:credit_card_no, type:private information |
171+
| testURL.swift:46:22:46:22 | passwd | label:passwd, type:credential |
172+
| testURL.swift:50:51:50:51 | e_mail | label:e_mail, type:private information |
173+
| testURL.swift:52:53:52:53 | a_homeaddr_z | label:a_homeaddr_z, type:private information |
174+
| testURL.swift:54:51:54:51 | resident_ID | label:resident_ID, type:private information |
175+
| testURL.swift:73:52:73:67 | call to get_secret_key() | label:get_secret_key, type:credential |
176+
| testURL.swift:75:53:75:69 | call to get_cert_string() | label:get_cert_string, type:credential |
177+
| testURL.swift:96:51:96:51 | certificate | label:certificate, type:credential |

‎swift/ql/test/query-tests/Security/CWE-311/testURL.swift

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,28 @@ struct URL
77
init?(string: String, relativeTo: URL?) {}
88
}
99

10+
class Data {
11+
}
12+
13+
extension String {
14+
struct Encoding {
15+
static let utf8 = Encoding()
16+
}
17+
18+
init?(data: Data, encoding: Encoding) { self.init() }
19+
}
20+
21+
class SecKey {
22+
}
23+
24+
class CFData {
25+
}
26+
27+
class CFError {
28+
}
29+
30+
func SecKeyCopyExternalRepresentation(_ key: SecKey, _ error: UnsafeMutablePointer<Unmanaged<CFError>?>?) -> CFData? { return nil }
31+
1032
// --- tests ---
1133

1234
var myString = ""
@@ -51,7 +73,7 @@ func test2() {
5173
_ = URL(string: "http://example.com/login?key=" + get_secret_key()); // BAD
5274
_ = URL(string: "http://example.com/login?key=" + get_key_press()); // GOOD (not sensitive)
5375
_ = URL(string: "http://example.com/login?cert=" + get_cert_string()); // BAD
54-
_ = URL(string: "http://example.com/login?cert=" + get_certain()); // GOOD (not sensitive)
76+
_ = URL(string: "http://example.com/login?certain=" + get_certain()); // GOOD (not sensitive)
5577
}
5678

5779
func get_string() -> String { return "" }
@@ -77,3 +99,11 @@ func test3() {
7799
_ = URL(string: "http://example.com/login?tok=\(auth_token)"); // BAD [NOT DETECTED]
78100
_ = URL(string: "http://example.com/login?tok=\(next_token)"); // GOOD (not sensitive)
79101
}
102+
103+
func test4(key: SecKey) {
104+
if let data = SecKeyCopyExternalRepresentation(key, nil) as? Data {
105+
if let string = String(data: data, encoding: .utf8) {
106+
_ = URL(string: "http://example.com/login?tok=\(string)"); // BAD [NOT DETECTED]
107+
}
108+
}
109+
}

0 commit comments

Comments
 (0)