Skip to content

Commit 4c5c6c6

Browse files
geoffw0geoffw0
authored
Merge pull request #17148 from geoffw0/hardkey
Swift: Additional test cases for swift/hardcoded-key
2 parents 3be219c + 4225774 commit 4c5c6c6

File tree

2 files changed

+79
-30
lines changed

2 files changed

+79
-30
lines changed

‎swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected

Lines changed: 52 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -39,18 +39,27 @@ edges
3939
| grdb.swift:23:18:23:33 | call to Data.init(_:) | grdb.swift:33:26:33:26 | constData | provenance | |
4040
| grdb.swift:23:23:23:23 | constArray | grdb.swift:23:18:23:33 | call to Data.init(_:) | provenance | |
4141
| misc.swift:30:7:30:7 | value | file://:0:0:0:0 | value | provenance | |
42-
| misc.swift:46:19:46:38 | call to Data.init(_:) | misc.swift:49:41:49:41 | myConstKey | provenance | |
43-
| misc.swift:46:19:46:38 | call to Data.init(_:) | misc.swift:53:25:53:25 | myConstKey | provenance | |
44-
| misc.swift:46:19:46:38 | call to Data.init(_:) | misc.swift:57:41:57:41 | myConstKey | provenance | |
45-
| misc.swift:46:24:46:24 | abcdef123456 | misc.swift:46:19:46:38 | call to Data.init(_:) | provenance | |
46-
| misc.swift:53:2:53:2 | [post] config [encryptionKey] | misc.swift:53:2:53:2 | [post] config | provenance | |
47-
| misc.swift:53:25:53:25 | myConstKey | misc.swift:30:7:30:7 | value | provenance | |
48-
| misc.swift:53:25:53:25 | myConstKey | misc.swift:53:2:53:2 | [post] config | provenance | |
49-
| misc.swift:53:25:53:25 | myConstKey | misc.swift:53:2:53:2 | [post] config [encryptionKey] | provenance | |
50-
| misc.swift:57:2:57:18 | [post] getter for .config [encryptionKey] | misc.swift:57:2:57:18 | [post] getter for .config | provenance | |
51-
| misc.swift:57:41:57:41 | myConstKey | misc.swift:30:7:30:7 | value | provenance | |
52-
| misc.swift:57:41:57:41 | myConstKey | misc.swift:57:2:57:18 | [post] getter for .config | provenance | |
53-
| misc.swift:57:41:57:41 | myConstKey | misc.swift:57:2:57:18 | [post] getter for .config [encryptionKey] | provenance | |
42+
| misc.swift:57:19:57:38 | call to Data.init(_:) | misc.swift:62:41:62:41 | myConstKey | provenance | |
43+
| misc.swift:57:19:57:38 | call to Data.init(_:) | misc.swift:66:25:66:25 | myConstKey | provenance | |
44+
| misc.swift:57:19:57:38 | call to Data.init(_:) | misc.swift:70:41:70:41 | myConstKey | provenance | |
45+
| misc.swift:57:24:57:24 | abcdef123456 | misc.swift:57:19:57:38 | call to Data.init(_:) | provenance | |
46+
| misc.swift:66:2:66:2 | [post] config [encryptionKey] | misc.swift:66:2:66:2 | [post] config | provenance | |
47+
| misc.swift:66:25:66:25 | myConstKey | misc.swift:30:7:30:7 | value | provenance | |
48+
| misc.swift:66:25:66:25 | myConstKey | misc.swift:66:2:66:2 | [post] config | provenance | |
49+
| misc.swift:66:25:66:25 | myConstKey | misc.swift:66:2:66:2 | [post] config [encryptionKey] | provenance | |
50+
| misc.swift:70:2:70:18 | [post] getter for .config [encryptionKey] | misc.swift:70:2:70:18 | [post] getter for .config | provenance | |
51+
| misc.swift:70:41:70:41 | myConstKey | misc.swift:30:7:30:7 | value | provenance | |
52+
| misc.swift:70:41:70:41 | myConstKey | misc.swift:70:2:70:18 | [post] getter for .config | provenance | |
53+
| misc.swift:70:41:70:41 | myConstKey | misc.swift:70:2:70:18 | [post] getter for .config [encryptionKey] | provenance | |
54+
| misc.swift:73:14:73:20 | k1 | misc.swift:76:26:76:29 | .utf8 | provenance | |
55+
| misc.swift:73:28:73:34 | k2 | misc.swift:77:26:77:29 | .utf8 | provenance | |
56+
| misc.swift:76:20:76:33 | call to Array<Element>.init(_:) [Collection element] | misc.swift:76:20:76:33 | call to Array<Element>.init(_:) | provenance | |
57+
| misc.swift:76:26:76:29 | .utf8 | misc.swift:76:20:76:33 | call to Array<Element>.init(_:) [Collection element] | provenance | |
58+
| misc.swift:77:20:77:33 | call to Array<Element>.init(_:) [Collection element] | misc.swift:77:20:77:33 | call to Array<Element>.init(_:) | provenance | |
59+
| misc.swift:77:26:77:29 | .utf8 | misc.swift:77:20:77:33 | call to Array<Element>.init(_:) [Collection element] | provenance | |
60+
| misc.swift:82:10:82:10 | abc123 | misc.swift:73:14:73:20 | k1 | provenance | |
61+
| misc.swift:83:10:83:10 | abc123 | misc.swift:73:14:73:20 | k1 | provenance | |
62+
| misc.swift:83:20:83:20 | abc123 | misc.swift:73:28:73:34 | k2 | provenance | |
5463
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) | rncryptor.swift:65:73:65:73 | myConstKey | provenance | |
5564
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) | rncryptor.swift:66:73:66:73 | myConstKey | provenance | |
5665
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) | rncryptor.swift:67:73:67:73 | myConstKey | provenance | |
@@ -122,15 +131,26 @@ nodes
122131
| misc.swift:30:7:30:7 | self [Return] | semmle.label | self [Return] |
123132
| misc.swift:30:7:30:7 | self [Return] [encryptionKey] | semmle.label | self [Return] [encryptionKey] |
124133
| misc.swift:30:7:30:7 | value | semmle.label | value |
125-
| misc.swift:46:19:46:38 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
126-
| misc.swift:46:24:46:24 | abcdef123456 | semmle.label | abcdef123456 |
127-
| misc.swift:49:41:49:41 | myConstKey | semmle.label | myConstKey |
128-
| misc.swift:53:2:53:2 | [post] config | semmle.label | [post] config |
129-
| misc.swift:53:2:53:2 | [post] config [encryptionKey] | semmle.label | [post] config [encryptionKey] |
130-
| misc.swift:53:25:53:25 | myConstKey | semmle.label | myConstKey |
131-
| misc.swift:57:2:57:18 | [post] getter for .config | semmle.label | [post] getter for .config |
132-
| misc.swift:57:2:57:18 | [post] getter for .config [encryptionKey] | semmle.label | [post] getter for .config [encryptionKey] |
133-
| misc.swift:57:41:57:41 | myConstKey | semmle.label | myConstKey |
134+
| misc.swift:57:19:57:38 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
135+
| misc.swift:57:24:57:24 | abcdef123456 | semmle.label | abcdef123456 |
136+
| misc.swift:62:41:62:41 | myConstKey | semmle.label | myConstKey |
137+
| misc.swift:66:2:66:2 | [post] config | semmle.label | [post] config |
138+
| misc.swift:66:2:66:2 | [post] config [encryptionKey] | semmle.label | [post] config [encryptionKey] |
139+
| misc.swift:66:25:66:25 | myConstKey | semmle.label | myConstKey |
140+
| misc.swift:70:2:70:18 | [post] getter for .config | semmle.label | [post] getter for .config |
141+
| misc.swift:70:2:70:18 | [post] getter for .config [encryptionKey] | semmle.label | [post] getter for .config [encryptionKey] |
142+
| misc.swift:70:41:70:41 | myConstKey | semmle.label | myConstKey |
143+
| misc.swift:73:14:73:20 | k1 | semmle.label | k1 |
144+
| misc.swift:73:28:73:34 | k2 | semmle.label | k2 |
145+
| misc.swift:76:20:76:33 | call to Array<Element>.init(_:) | semmle.label | call to Array<Element>.init(_:) |
146+
| misc.swift:76:20:76:33 | call to Array<Element>.init(_:) [Collection element] | semmle.label | call to Array<Element>.init(_:) [Collection element] |
147+
| misc.swift:76:26:76:29 | .utf8 | semmle.label | .utf8 |
148+
| misc.swift:77:20:77:33 | call to Array<Element>.init(_:) | semmle.label | call to Array<Element>.init(_:) |
149+
| misc.swift:77:20:77:33 | call to Array<Element>.init(_:) [Collection element] | semmle.label | call to Array<Element>.init(_:) [Collection element] |
150+
| misc.swift:77:26:77:29 | .utf8 | semmle.label | .utf8 |
151+
| misc.swift:82:10:82:10 | abc123 | semmle.label | abc123 |
152+
| misc.swift:83:10:83:10 | abc123 | semmle.label | abc123 |
153+
| misc.swift:83:20:83:20 | abc123 | semmle.label | abc123 |
134154
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
135155
| rncryptor.swift:60:24:60:24 | abcdef123456 | semmle.label | abcdef123456 |
136156
| rncryptor.swift:65:73:65:73 | myConstKey | semmle.label | myConstKey |
@@ -155,10 +175,10 @@ nodes
155175
| sqlite3_c_api.swift:49:36:49:36 | buffer | semmle.label | buffer |
156176
| sqlite3_c_api.swift:50:38:50:38 | buffer | semmle.label | buffer |
157177
subpaths
158-
| misc.swift:53:25:53:25 | myConstKey | misc.swift:30:7:30:7 | value | misc.swift:30:7:30:7 | self [Return] | misc.swift:53:2:53:2 | [post] config |
159-
| misc.swift:53:25:53:25 | myConstKey | misc.swift:30:7:30:7 | value | misc.swift:30:7:30:7 | self [Return] [encryptionKey] | misc.swift:53:2:53:2 | [post] config [encryptionKey] |
160-
| misc.swift:57:41:57:41 | myConstKey | misc.swift:30:7:30:7 | value | misc.swift:30:7:30:7 | self [Return] | misc.swift:57:2:57:18 | [post] getter for .config |
161-
| misc.swift:57:41:57:41 | myConstKey | misc.swift:30:7:30:7 | value | misc.swift:30:7:30:7 | self [Return] [encryptionKey] | misc.swift:57:2:57:18 | [post] getter for .config [encryptionKey] |
178+
| misc.swift:66:25:66:25 | myConstKey | misc.swift:30:7:30:7 | value | misc.swift:30:7:30:7 | self [Return] | misc.swift:66:2:66:2 | [post] config |
179+
| misc.swift:66:25:66:25 | myConstKey | misc.swift:30:7:30:7 | value | misc.swift:30:7:30:7 | self [Return] [encryptionKey] | misc.swift:66:2:66:2 | [post] config [encryptionKey] |
180+
| misc.swift:70:41:70:41 | myConstKey | misc.swift:30:7:30:7 | value | misc.swift:30:7:30:7 | self [Return] | misc.swift:70:2:70:18 | [post] getter for .config |
181+
| misc.swift:70:41:70:41 | myConstKey | misc.swift:30:7:30:7 | value | misc.swift:30:7:30:7 | self [Return] [encryptionKey] | misc.swift:70:2:70:18 | [post] getter for .config [encryptionKey] |
162182
#select
163183
| SQLite.swift:43:13:43:13 | hardcoded_key | SQLite.swift:43:13:43:13 | hardcoded_key | SQLite.swift:43:13:43:13 | hardcoded_key | The key 'hardcoded_key' has been initialized with hard-coded values from $@. | SQLite.swift:43:13:43:13 | hardcoded_key | hardcoded_key |
164184
| SQLite.swift:45:23:45:23 | hardcoded_key | SQLite.swift:45:23:45:23 | hardcoded_key | SQLite.swift:45:23:45:23 | hardcoded_key | The key 'hardcoded_key' has been initialized with hard-coded values from $@. | SQLite.swift:45:23:45:23 | hardcoded_key | hardcoded_key |
@@ -186,14 +206,17 @@ subpaths
186206
| cryptoswift.swift:164:24:164:24 | keyString | cryptoswift.swift:78:2:78:2 | this string is constant | cryptoswift.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:78:2:78:2 | this string is constant | this string is constant |
187207
| cryptoswift.swift:165:24:165:24 | key | cryptoswift.swift:92:26:92:121 | [...] | cryptoswift.swift:165:24:165:24 | key | The key 'key' has been initialized with hard-coded values from $@. | cryptoswift.swift:92:26:92:121 | [...] | [...] |
188208
| cryptoswift.swift:166:24:166:24 | keyString | cryptoswift.swift:78:2:78:2 | this string is constant | cryptoswift.swift:166:24:166:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:78:2:78:2 | this string is constant | this string is constant |
189-
| file://:0:0:0:0 | [post] self | misc.swift:46:24:46:24 | abcdef123456 | file://:0:0:0:0 | [post] self | The key '[post] self' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
209+
| file://:0:0:0:0 | [post] self | misc.swift:57:24:57:24 | abcdef123456 | file://:0:0:0:0 | [post] self | The key '[post] self' has been initialized with hard-coded values from $@. | misc.swift:57:24:57:24 | abcdef123456 | abcdef123456 |
190210
| grdb.swift:27:23:27:23 | constString | grdb.swift:21:20:21:20 | abc123 | grdb.swift:27:23:27:23 | constString | The key 'constString' has been initialized with hard-coded values from $@. | grdb.swift:21:20:21:20 | abc123 | abc123 |
191211
| grdb.swift:29:23:29:23 | constData | grdb.swift:22:33:22:50 | [...] | grdb.swift:29:23:29:23 | constData | The key 'constData' has been initialized with hard-coded values from $@. | grdb.swift:22:33:22:50 | [...] | [...] |
192212
| grdb.swift:31:26:31:26 | constString | grdb.swift:21:20:21:20 | abc123 | grdb.swift:31:26:31:26 | constString | The key 'constString' has been initialized with hard-coded values from $@. | grdb.swift:21:20:21:20 | abc123 | abc123 |
193213
| grdb.swift:33:26:33:26 | constData | grdb.swift:22:33:22:50 | [...] | grdb.swift:33:26:33:26 | constData | The key 'constData' has been initialized with hard-coded values from $@. | grdb.swift:22:33:22:50 | [...] | [...] |
194-
| misc.swift:49:41:49:41 | myConstKey | misc.swift:46:24:46:24 | abcdef123456 | misc.swift:49:41:49:41 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
195-
| misc.swift:53:2:53:2 | [post] config | misc.swift:46:24:46:24 | abcdef123456 | misc.swift:53:2:53:2 | [post] config | The key '[post] config' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
196-
| misc.swift:57:2:57:18 | [post] getter for .config | misc.swift:46:24:46:24 | abcdef123456 | misc.swift:57:2:57:18 | [post] getter for .config | The key '[post] getter for .config' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
214+
| misc.swift:62:41:62:41 | myConstKey | misc.swift:57:24:57:24 | abcdef123456 | misc.swift:62:41:62:41 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | misc.swift:57:24:57:24 | abcdef123456 | abcdef123456 |
215+
| misc.swift:66:2:66:2 | [post] config | misc.swift:57:24:57:24 | abcdef123456 | misc.swift:66:2:66:2 | [post] config | The key '[post] config' has been initialized with hard-coded values from $@. | misc.swift:57:24:57:24 | abcdef123456 | abcdef123456 |
216+
| misc.swift:70:2:70:18 | [post] getter for .config | misc.swift:57:24:57:24 | abcdef123456 | misc.swift:70:2:70:18 | [post] getter for .config | The key '[post] getter for .config' has been initialized with hard-coded values from $@. | misc.swift:57:24:57:24 | abcdef123456 | abcdef123456 |
217+
| misc.swift:76:20:76:33 | call to Array<Element>.init(_:) | misc.swift:82:10:82:10 | abc123 | misc.swift:76:20:76:33 | call to Array<Element>.init(_:) | The key 'call to Array<Element>.init(_:)' has been initialized with hard-coded values from $@. | misc.swift:82:10:82:10 | abc123 | abc123 |
218+
| misc.swift:76:20:76:33 | call to Array<Element>.init(_:) | misc.swift:83:10:83:10 | abc123 | misc.swift:76:20:76:33 | call to Array<Element>.init(_:) | The key 'call to Array<Element>.init(_:)' has been initialized with hard-coded values from $@. | misc.swift:83:10:83:10 | abc123 | abc123 |
219+
| misc.swift:77:20:77:33 | call to Array<Element>.init(_:) | misc.swift:83:20:83:20 | abc123 | misc.swift:77:20:77:33 | call to Array<Element>.init(_:) | The key 'call to Array<Element>.init(_:)' has been initialized with hard-coded values from $@. | misc.swift:83:20:83:20 | abc123 | abc123 |
197220
| rncryptor.swift:65:73:65:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 | rncryptor.swift:65:73:65:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 | abcdef123456 |
198221
| rncryptor.swift:66:73:66:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 | rncryptor.swift:66:73:66:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 | abcdef123456 |
199222
| rncryptor.swift:67:73:67:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 | rncryptor.swift:67:73:67:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 | abcdef123456 |

‎swift/ql/test/query-tests/Security/CWE-321/misc.swift

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
// --- stubs ---
33

4-
class Data {
4+
struct Data {
55
init<S>(_ elements: S) {}
66
}
77

@@ -31,6 +31,17 @@ extension Realm {
3131
}
3232
}
3333

34+
protocol BlockMode { }
35+
36+
struct CBC: BlockMode {
37+
init(iv: Array<UInt8>) { }
38+
}
39+
40+
class AES
41+
{
42+
init(key: Array<UInt8>, blockMode: BlockMode) { }
43+
}
44+
3445
// --- tests ---
3546

3647
class ConfigContainer {
@@ -45,6 +56,8 @@ func test(myVarStr: String) {
4556
let myVarKey = Data(myVarStr)
4657
let myConstKey = Data("abcdef123456")
4758

59+
// --- realm ---
60+
4861
_ = Realm.Configuration(encryptionKey: myVarKey) // GOOD
4962
_ = Realm.Configuration(encryptionKey: myConstKey) // BAD
5063

@@ -56,3 +69,16 @@ func test(myVarStr: String) {
5669
configContainer.config.encryptionKey = myVarKey // GOOD
5770
configContainer.config.encryptionKey = myConstKey // BAD
5871
}
72+
73+
func useKeys(_ k1: String, _ k2: String, _ k3: String, _ myIV: Array<UInt8>) {
74+
// --- cryptoswift ---
75+
76+
let a1 = AES(key: Array(k1.utf8), blockMode: CBC(iv: myIV)) // BAD
77+
let a2 = AES(key: Array(k2.utf8), blockMode: CBC(iv: myIV)) // BAD
78+
let a3 = AES(key: Array(k3.utf8), blockMode: CBC(iv: myIV)) // GOOD
79+
}
80+
81+
func caller(varString: String, myIV: Array<UInt8>) {
82+
useKeys("abc123", varString, varString, myIV)
83+
useKeys("abc123", "abc123", varString, myIV)
84+
}

0 commit comments

Comments
 (0)