Skip to content

Commit c8438c3

Browse files
geoffw0geoffw0
committed
Swift: Tests for string appending with swift/constant-salt.
1 parent 69c18f9 commit c8438c3

File tree

2 files changed

+93
-0
lines changed

2 files changed

+93
-0
lines changed

‎swift/ql/test/query-tests/Security/CWE-760/ConstantSalt.expected

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,30 @@ edges
1111
| rncryptor.swift:60:24:60:30 | call to Data.init(_:) | rncryptor.swift:76:152:76:152 | myConstantSalt2 | provenance | |
1212
| rncryptor.swift:60:24:60:30 | call to Data.init(_:) | rncryptor.swift:79:160:79:160 | myConstantSalt2 | provenance | |
1313
| rncryptor.swift:60:29:60:29 | 0 | rncryptor.swift:60:24:60:30 | call to Data.init(_:) | provenance | |
14+
| rncryptor.swift:83:62:83:62 | 123 | rncryptor.swift:83:62:83:87 | ... .+(_:_:) ... | provenance | |
15+
| rncryptor.swift:83:62:83:87 | ... .+(_:_:) ... | rncryptor.swift:83:57:83:88 | call to Data.init(_:) | provenance | |
16+
| rncryptor.swift:84:62:84:83 | ... .+(_:_:) ... | rncryptor.swift:84:57:84:88 | call to Data.init(_:) | provenance | |
17+
| rncryptor.swift:84:83:84:83 | abc | rncryptor.swift:84:62:84:83 | ... .+(_:_:) ... | provenance | |
18+
| rncryptor.swift:85:62:85:62 | 123 | rncryptor.swift:85:62:85:70 | ... .+(_:_:) ... | provenance | |
19+
| rncryptor.swift:85:62:85:70 | ... .+(_:_:) ... | rncryptor.swift:85:57:85:75 | call to Data.init(_:) | provenance | |
20+
| rncryptor.swift:85:70:85:70 | abc | rncryptor.swift:85:62:85:70 | ... .+(_:_:) ... | provenance | |
21+
| rncryptor.swift:86:62:86:62 | 123 | rncryptor.swift:86:62:86:62 | "..." | provenance | |
22+
| rncryptor.swift:86:62:86:62 | "..." | rncryptor.swift:86:57:86:91 | call to Data.init(_:) | provenance | |
23+
| rncryptor.swift:86:87:86:87 | abc | rncryptor.swift:86:62:86:62 | "..." | provenance | |
24+
| rncryptor.swift:87:62:87:62 | 123 | rncryptor.swift:87:62:87:62 | "..." | provenance | |
25+
| rncryptor.swift:87:62:87:62 | "..." | rncryptor.swift:87:57:87:81 | call to Data.init(_:) | provenance | |
26+
| rncryptor.swift:87:68:87:68 | const | rncryptor.swift:87:62:87:62 | "..." | provenance | |
27+
| rncryptor.swift:87:76:87:76 | )abc | rncryptor.swift:87:62:87:62 | "..." | provenance | |
28+
| rncryptor.swift:89:25:89:25 | 123 | rncryptor.swift:91:62:91:62 | myMutableString1 | provenance | |
29+
| rncryptor.swift:91:62:91:62 | myMutableString1 | rncryptor.swift:91:57:91:78 | call to Data.init(_:) | provenance | |
30+
| rncryptor.swift:94:2:94:2 | [post] myMutableString2 | rncryptor.swift:95:62:95:62 | myMutableString2 | provenance | |
31+
| rncryptor.swift:94:26:94:26 | abc | rncryptor.swift:94:2:94:2 | [post] myMutableString2 | provenance | |
32+
| rncryptor.swift:94:26:94:26 | abc | rncryptor.swift:95:62:95:62 | myMutableString2 | provenance | AdditionalTaintStep |
33+
| rncryptor.swift:95:62:95:62 | myMutableString2 | rncryptor.swift:95:57:95:78 | call to Data.init(_:) | provenance | |
34+
| rncryptor.swift:97:25:97:25 | 123 | rncryptor.swift:99:62:99:62 | myMutableString3 | provenance | |
35+
| rncryptor.swift:99:62:99:62 | myMutableString3 | rncryptor.swift:99:57:99:78 | call to Data.init(_:) | provenance | |
36+
| rncryptor.swift:102:22:102:22 | abc | rncryptor.swift:103:62:103:62 | myMutableString4 | provenance | |
37+
| rncryptor.swift:103:62:103:62 | myMutableString4 | rncryptor.swift:103:57:103:78 | call to Data.init(_:) | provenance | |
1438
| test.swift:29:3:29:3 | this string is constant | test.swift:33:10:33:28 | call to getConstantString() | provenance | |
1539
| test.swift:33:2:33:34 | call to Array<Element>.init(_:) [Collection element] | test.swift:44:27:44:44 | call to getConstantArray() [Collection element] | provenance | |
1640
| test.swift:33:10:33:28 | call to getConstantString() | test.swift:33:10:33:30 | .utf8 | provenance | |
@@ -38,6 +62,38 @@ nodes
3862
| rncryptor.swift:76:152:76:152 | myConstantSalt2 | semmle.label | myConstantSalt2 |
3963
| rncryptor.swift:78:135:78:135 | myConstantSalt1 | semmle.label | myConstantSalt1 |
4064
| rncryptor.swift:79:160:79:160 | myConstantSalt2 | semmle.label | myConstantSalt2 |
65+
| rncryptor.swift:83:57:83:88 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
66+
| rncryptor.swift:83:62:83:62 | 123 | semmle.label | 123 |
67+
| rncryptor.swift:83:62:83:87 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
68+
| rncryptor.swift:84:57:84:88 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
69+
| rncryptor.swift:84:62:84:83 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
70+
| rncryptor.swift:84:83:84:83 | abc | semmle.label | abc |
71+
| rncryptor.swift:85:57:85:75 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
72+
| rncryptor.swift:85:62:85:62 | 123 | semmle.label | 123 |
73+
| rncryptor.swift:85:62:85:70 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
74+
| rncryptor.swift:85:70:85:70 | abc | semmle.label | abc |
75+
| rncryptor.swift:86:57:86:91 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
76+
| rncryptor.swift:86:62:86:62 | 123 | semmle.label | 123 |
77+
| rncryptor.swift:86:62:86:62 | "..." | semmle.label | "..." |
78+
| rncryptor.swift:86:87:86:87 | abc | semmle.label | abc |
79+
| rncryptor.swift:87:57:87:81 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
80+
| rncryptor.swift:87:62:87:62 | 123 | semmle.label | 123 |
81+
| rncryptor.swift:87:62:87:62 | "..." | semmle.label | "..." |
82+
| rncryptor.swift:87:68:87:68 | const | semmle.label | const |
83+
| rncryptor.swift:87:76:87:76 | )abc | semmle.label | )abc |
84+
| rncryptor.swift:89:25:89:25 | 123 | semmle.label | 123 |
85+
| rncryptor.swift:91:57:91:78 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
86+
| rncryptor.swift:91:62:91:62 | myMutableString1 | semmle.label | myMutableString1 |
87+
| rncryptor.swift:94:2:94:2 | [post] myMutableString2 | semmle.label | [post] myMutableString2 |
88+
| rncryptor.swift:94:26:94:26 | abc | semmle.label | abc |
89+
| rncryptor.swift:95:57:95:78 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
90+
| rncryptor.swift:95:62:95:62 | myMutableString2 | semmle.label | myMutableString2 |
91+
| rncryptor.swift:97:25:97:25 | 123 | semmle.label | 123 |
92+
| rncryptor.swift:99:57:99:78 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
93+
| rncryptor.swift:99:62:99:62 | myMutableString3 | semmle.label | myMutableString3 |
94+
| rncryptor.swift:102:22:102:22 | abc | semmle.label | abc |
95+
| rncryptor.swift:103:57:103:78 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
96+
| rncryptor.swift:103:62:103:62 | myMutableString4 | semmle.label | myMutableString4 |
4197
| test.swift:29:3:29:3 | this string is constant | semmle.label | this string is constant |
4298
| test.swift:33:2:33:34 | call to Array<Element>.init(_:) [Collection element] | semmle.label | call to Array<Element>.init(_:) [Collection element] |
4399
| test.swift:33:10:33:28 | call to getConstantString() | semmle.label | call to getConstantString() |
@@ -64,6 +120,19 @@ subpaths
64120
| rncryptor.swift:76:152:76:152 | myConstantSalt2 | rncryptor.swift:60:29:60:29 | 0 | rncryptor.swift:76:152:76:152 | myConstantSalt2 | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:60:29:60:29 | 0 | 0 |
65121
| rncryptor.swift:78:135:78:135 | myConstantSalt1 | rncryptor.swift:59:29:59:29 | abcdef123456 | rncryptor.swift:78:135:78:135 | myConstantSalt1 | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:59:29:59:29 | abcdef123456 | abcdef123456 |
66122
| rncryptor.swift:79:160:79:160 | myConstantSalt2 | rncryptor.swift:60:29:60:29 | 0 | rncryptor.swift:79:160:79:160 | myConstantSalt2 | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:60:29:60:29 | 0 | 0 |
123+
| rncryptor.swift:83:57:83:88 | call to Data.init(_:) | rncryptor.swift:83:62:83:62 | 123 | rncryptor.swift:83:57:83:88 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:83:62:83:62 | 123 | 123 |
124+
| rncryptor.swift:84:57:84:88 | call to Data.init(_:) | rncryptor.swift:84:83:84:83 | abc | rncryptor.swift:84:57:84:88 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:84:83:84:83 | abc | abc |
125+
| rncryptor.swift:85:57:85:75 | call to Data.init(_:) | rncryptor.swift:85:62:85:62 | 123 | rncryptor.swift:85:57:85:75 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:85:62:85:62 | 123 | 123 |
126+
| rncryptor.swift:85:57:85:75 | call to Data.init(_:) | rncryptor.swift:85:70:85:70 | abc | rncryptor.swift:85:57:85:75 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:85:70:85:70 | abc | abc |
127+
| rncryptor.swift:86:57:86:91 | call to Data.init(_:) | rncryptor.swift:86:62:86:62 | 123 | rncryptor.swift:86:57:86:91 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:86:62:86:62 | 123 | 123 |
128+
| rncryptor.swift:86:57:86:91 | call to Data.init(_:) | rncryptor.swift:86:87:86:87 | abc | rncryptor.swift:86:57:86:91 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:86:87:86:87 | abc | abc |
129+
| rncryptor.swift:87:57:87:81 | call to Data.init(_:) | rncryptor.swift:87:62:87:62 | 123 | rncryptor.swift:87:57:87:81 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:87:62:87:62 | 123 | 123 |
130+
| rncryptor.swift:87:57:87:81 | call to Data.init(_:) | rncryptor.swift:87:68:87:68 | const | rncryptor.swift:87:57:87:81 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:87:68:87:68 | const | const |
131+
| rncryptor.swift:87:57:87:81 | call to Data.init(_:) | rncryptor.swift:87:76:87:76 | )abc | rncryptor.swift:87:57:87:81 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:87:76:87:76 | )abc | )abc |
132+
| rncryptor.swift:91:57:91:78 | call to Data.init(_:) | rncryptor.swift:89:25:89:25 | 123 | rncryptor.swift:91:57:91:78 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:89:25:89:25 | 123 | 123 |
133+
| rncryptor.swift:95:57:95:78 | call to Data.init(_:) | rncryptor.swift:94:26:94:26 | abc | rncryptor.swift:95:57:95:78 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:94:26:94:26 | abc | abc |
134+
| rncryptor.swift:99:57:99:78 | call to Data.init(_:) | rncryptor.swift:97:25:97:25 | 123 | rncryptor.swift:99:57:99:78 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:97:25:97:25 | 123 | 123 |
135+
| rncryptor.swift:103:57:103:78 | call to Data.init(_:) | rncryptor.swift:102:22:102:22 | abc | rncryptor.swift:103:57:103:78 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:102:22:102:22 | abc | abc |
67136
| test.swift:51:49:51:49 | constantSalt | test.swift:43:35:43:130 | [...] | test.swift:51:49:51:49 | constantSalt | The value '$@' is used as a constant, which is insecure for hashing passwords. | test.swift:43:35:43:130 | [...] | [...] |
68137
| test.swift:52:49:52:49 | constantStringSalt | test.swift:29:3:29:3 | this string is constant | test.swift:52:49:52:49 | constantStringSalt | The value '$@' is used as a constant, which is insecure for hashing passwords. | test.swift:29:3:29:3 | this string is constant | this string is constant |
69138
| test.swift:56:59:56:59 | constantSalt | test.swift:43:35:43:130 | [...] | test.swift:56:59:56:59 | constantSalt | The value '$@' is used as a constant, which is insecure for hashing passwords. | test.swift:43:35:43:130 | [...] | [...] |

‎swift/ql/test/query-tests/Security/CWE-760/rncryptor.swift

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,4 +77,28 @@ func test(myPassword: String) {
7777
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, password: myPassword, IV: myIV, encryptionSalt: myRandomSalt1, HMACSalt: myRandomSalt2) // GOOD
7878
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, password: myPassword, IV: myIV, encryptionSalt: myConstantSalt1, HMACSalt: myRandomSalt2) // BAD
7979
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, password: myPassword, IV: myIV, encryptionSalt: myRandomSalt1, HMACSalt: myConstantSalt2) // BAD
80+
81+
// appending constants
82+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data(getARandomString() + getARandomString()), settings: myKeyDerivationSettings) // GOOD
83+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data("123" + getARandomString()), settings: myKeyDerivationSettings) // GOOD [FALSE POSITIVE]
84+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data(getARandomString() + "abc"), settings: myKeyDerivationSettings) // GOOD [FALSE POSITIVE]
85+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data("123" + "abc"), settings: myKeyDerivationSettings) // BAD (constant salt)
86+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data("123\(getARandomString())abc"), settings: myKeyDerivationSettings) // GOOD [FALSE POSITIVE]
87+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data("123\("const"))abc"), settings: myKeyDerivationSettings) // BAD (constant salt)
88+
89+
var myMutableString1 = "123"
90+
myMutableString1.append(getARandomString())
91+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data(myMutableString1), settings: myKeyDerivationSettings) // GOOD [FALSE POSITIVE]
92+
93+
var myMutableString2 = getARandomString()
94+
myMutableString2.append("abc")
95+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data(myMutableString2), settings: myKeyDerivationSettings) // GOOD [FALSE POSITIVE]
96+
97+
var myMutableString3 = "123"
98+
myMutableString3 += getARandomString()
99+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data(myMutableString3), settings: myKeyDerivationSettings) // GOOD [FALSE POSITIVE]
100+
101+
var myMutableString4 = getARandomString()
102+
myMutableString4 += "abc"
103+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data(myMutableString4), settings: myKeyDerivationSettings) // GOOD [FALSE POSITIVE]
80104
}

0 commit comments

Comments
 (0)