Skip to content

Commit 62b0ebf

Browse files
geoffw0geoffw0
authored
Merge pull request #14407 from geoffw0/grdbsinks
Swift: Add sinks for the GRDB database library to swift/hardcoded-key
2 parents 4a0ab4a + 8a73252 commit 62b0ebf

File tree

4 files changed

+59
-0
lines changed

4 files changed

+59
-0
lines changed

‎swift/ql/lib/codeql/swift/security/HardcodedEncryptionKeyExtensions.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,9 @@ private class EncryptionKeySinks extends SinkModelCsv {
7171
";Realm.Configuration;true;init(fileURL:inMemoryIdentifier:syncConfiguration:encryptionKey:readOnly:schemaVersion:migrationBlock:deleteRealmIfMigrationNeeded:shouldCompactOnLaunch:objectTypes:);;;Argument[3];encryption-key",
7272
";Realm.Configuration;true;init(fileURL:inMemoryIdentifier:syncConfiguration:encryptionKey:readOnly:schemaVersion:migrationBlock:deleteRealmIfMigrationNeeded:shouldCompactOnLaunch:objectTypes:seedFilePath:);;;Argument[3];encryption-key",
7373
";Realm.Configuration;true;encryptionKey;;;PostUpdate;encryption-key",
74+
// GRDB
75+
";Database;true;usePassphrase(_:);;;Argument[0];encryption-key",
76+
";Database;true;changePassphrase(_:);;;Argument[0];encryption-key",
7477
]
7578
}
7679
}

‎swift/ql/src/change-notes/2023-10-06-const-key-sinks.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added sinks for the GRDB database library to the `swift/hardcoded-key` query.

‎swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,12 @@ edges
2222
| file://:0:0:0:0 | [post] self [encryptionKey] | file://:0:0:0:0 | [post] self |
2323
| file://:0:0:0:0 | [post] self [encryptionKey] | file://:0:0:0:0 | [post] self |
2424
| file://:0:0:0:0 | value | file://:0:0:0:0 | [post] self [encryptionKey] |
25+
| grdb.swift:21:20:21:20 | abc123 | grdb.swift:27:23:27:23 | constString |
26+
| grdb.swift:21:20:21:20 | abc123 | grdb.swift:31:26:31:26 | constString |
27+
| grdb.swift:22:33:22:50 | [...] | grdb.swift:23:23:23:23 | constArray |
28+
| grdb.swift:23:18:23:33 | call to Data.init(_:) | grdb.swift:29:23:29:23 | constData |
29+
| grdb.swift:23:18:23:33 | call to Data.init(_:) | grdb.swift:33:26:33:26 | constData |
30+
| grdb.swift:23:23:23:23 | constArray | grdb.swift:23:18:23:33 | call to Data.init(_:) |
2531
| misc.swift:30:7:30:7 | value | file://:0:0:0:0 | value |
2632
| misc.swift:46:19:46:38 | call to Data.init(_:) | misc.swift:49:41:49:41 | myConstKey |
2733
| misc.swift:46:19:46:38 | call to Data.init(_:) | misc.swift:53:25:53:25 | myConstKey |
@@ -78,6 +84,14 @@ nodes
7884
| file://:0:0:0:0 | [post] self | semmle.label | [post] self |
7985
| file://:0:0:0:0 | [post] self [encryptionKey] | semmle.label | [post] self [encryptionKey] |
8086
| file://:0:0:0:0 | value | semmle.label | value |
87+
| grdb.swift:21:20:21:20 | abc123 | semmle.label | abc123 |
88+
| grdb.swift:22:33:22:50 | [...] | semmle.label | [...] |
89+
| grdb.swift:23:18:23:33 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
90+
| grdb.swift:23:23:23:23 | constArray | semmle.label | constArray |
91+
| grdb.swift:27:23:27:23 | constString | semmle.label | constString |
92+
| grdb.swift:29:23:29:23 | constData | semmle.label | constData |
93+
| grdb.swift:31:26:31:26 | constString | semmle.label | constString |
94+
| grdb.swift:33:26:33:26 | constData | semmle.label | constData |
8195
| misc.swift:30:7:30:7 | value | semmle.label | value |
8296
| misc.swift:46:19:46:38 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
8397
| misc.swift:46:24:46:24 | abcdef123456 | semmle.label | abcdef123456 |
@@ -131,6 +145,10 @@ subpaths
131145
| cryptoswift.swift:163:24:163:24 | key | cryptoswift.swift:90:26:90:121 | [...] | cryptoswift.swift:163:24:163:24 | key | The key 'key' has been initialized with hard-coded values from $@. | cryptoswift.swift:90:26:90:121 | [...] | [...] |
132146
| cryptoswift.swift:164:24:164:24 | keyString | cryptoswift.swift:76:3:76:3 | this string is constant | cryptoswift.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:76:3:76:3 | this string is constant | this string is constant |
133147
| file://:0:0:0:0 | [post] self | misc.swift:46:24:46:24 | abcdef123456 | file://:0:0:0:0 | [post] self | The key '[post] self' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
148+
| grdb.swift:27:23:27:23 | constString | grdb.swift:21:20:21:20 | abc123 | grdb.swift:27:23:27:23 | constString | The key 'constString' has been initialized with hard-coded values from $@. | grdb.swift:21:20:21:20 | abc123 | abc123 |
149+
| grdb.swift:29:23:29:23 | constData | grdb.swift:22:33:22:50 | [...] | grdb.swift:29:23:29:23 | constData | The key 'constData' has been initialized with hard-coded values from $@. | grdb.swift:22:33:22:50 | [...] | [...] |
150+
| grdb.swift:31:26:31:26 | constString | grdb.swift:21:20:21:20 | abc123 | grdb.swift:31:26:31:26 | constString | The key 'constString' has been initialized with hard-coded values from $@. | grdb.swift:21:20:21:20 | abc123 | abc123 |
151+
| grdb.swift:33:26:33:26 | constData | grdb.swift:22:33:22:50 | [...] | grdb.swift:33:26:33:26 | constData | The key 'constData' has been initialized with hard-coded values from $@. | grdb.swift:22:33:22:50 | [...] | [...] |
134152
| misc.swift:49:41:49:41 | myConstKey | misc.swift:46:24:46:24 | abcdef123456 | misc.swift:49:41:49:41 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
135153
| misc.swift:53:2:53:2 | [post] config | misc.swift:46:24:46:24 | abcdef123456 | misc.swift:53:2:53:2 | [post] config | The key '[post] config' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
136154
| misc.swift:57:2:57:18 | [post] getter for .config | misc.swift:46:24:46:24 | abcdef123456 | misc.swift:57:2:57:18 | [post] getter for .config | The key '[post] getter for .config' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |

‎swift/ql/test/query-tests/Security/CWE-321/grdb.swift

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
2+
// --- stubs ---
3+
4+
class Data {
5+
init<S>(_ elements: S) {}
6+
}
7+
8+
class Database {
9+
}
10+
11+
extension Database {
12+
func usePassphrase(_ passphrase: String) throws { }
13+
func usePassphrase(_ passphrase: Data) throws { }
14+
func changePassphrase(_ passphrase: String) throws { }
15+
func changePassphrase(_ passphrase: Data) throws { }
16+
}
17+
18+
// --- tests ---
19+
20+
func test(db: Database, varString: String, varArray: Array<UInt8>, varData: Data) throws {
21+
let constString = "abc123"
22+
let constArray: Array<UInt8> = [1, 2, 3, 4, 5, 6]
23+
let constData = Data(constArray)
24+
25+
// GRDB
26+
try db.usePassphrase(varString)
27+
try db.usePassphrase(constString) // BAD: constant key
28+
try db.usePassphrase(varData)
29+
try db.usePassphrase(constData) // BAD: constant key
30+
try db.changePassphrase(varString)
31+
try db.changePassphrase(constString) // BAD: constant key
32+
try db.changePassphrase(Data(varArray))
33+
try db.changePassphrase(constData) // BAD: constant key
34+
}

0 commit comments

Comments
 (0)