Skip to content

Commit 16ae637

Browse files
geoffw0geoffw0
committed
Swift: Add sqlite3 models.
1 parent 4245a38 commit 16ae637

File tree

3 files changed

+40
-6
lines changed

3 files changed

+40
-6
lines changed

‎swift/ql/lib/codeql/swift/security/CleartextStorageDatabaseExtensions.qll

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,25 @@ private class CleartextStorageDatabaseSinks extends SinkModelCsv {
108108
";FetchableRecord;true;fetchOne(_:arguments:adapter:);;;Argument[1];database-store",
109109
";Statement;true;execute(arguments:);;;Argument[0];database-store",
110110
";CommonTableExpression;true;init(recursive:named:columns:sql:arguments:);;;Argument[4];database-store",
111-
";Statement;true;setArguments(_:);;;Argument[0];database-store"
111+
";Statement;true;setArguments(_:);;;Argument[0];database-store",
112+
// sqlite3 sinks
113+
";;false;sqlite3_exec(_:_:_:_:_:);;;Argument[1];database-store",
114+
";;false;sqlite3_prepare(_:_:_:_:_:);;;Argument[1];database-store",
115+
";;false;sqlite3_prepare_v2(_:_:_:_:_:);;;Argument[1];database-store",
116+
";;false;sqlite3_prepare_v3(_:_:_:_:_:_:);;;Argument[1];database-store",
117+
";;false;sqlite3_prepare16(_:_:_:_:_:);;;Argument[1];database-store",
118+
";;false;sqlite3_prepare16_v2(_:_:_:_:_:);;;Argument[1];database-store",
119+
";;false;sqlite3_prepare16_v3(_:_:_:_:_:);;;Argument[1];database-store",
120+
";;false;sqlite3_bind_blob(_:_:_:_:_:);;;Argument[2];database-store",
121+
";;false;sqlite3_bind_blob64(_:_:_:_:_:);;;Argument[2];database-store",
122+
";;false;sqlite3_bind_double(_:_:_:);;;Argument[2];database-store",
123+
";;false;sqlite3_bind_int(_:_:_:);;;Argument[2];database-store",
124+
";;false;sqlite3_bind_int64(_:_:_:);;;Argument[2];database-store",
125+
";;false;sqlite3_bind_text(_:_:_:_:_:);;;Argument[2];database-store",
126+
";;false;sqlite3_bind_text16(_:_:_:_:_:);;;Argument[2];database-store",
127+
";;false;sqlite3_bind_text64(_:_:_:_:_:_:);;;Argument[2];database-store",
128+
";;false;sqlite3_bind_value(_:_:_:);;;Argument[2];database-store",
129+
";;false;sqlite3_bind_pointer(_:_:_:_:);;;Argument[2];database-store",
112130
]
113131
}
114132
}

‎swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@ edges
66
| file://:0:0:0:0 | value | file://:0:0:0:0 | [post] self [notStoredBankAccountNumber] |
77
| file://:0:0:0:0 | value | file://:0:0:0:0 | [post] self [password] |
88
| file://:0:0:0:0 | value | file://:0:0:0:0 | [post] self [value] |
9+
| sqlite3_c_api.swift:42:69:42:69 | medicalNotes | sqlite3_c_api.swift:46:27:46:27 | insertQuery |
10+
| sqlite3_c_api.swift:43:49:43:49 | medicalNotes | sqlite3_c_api.swift:47:27:47:27 | updateQuery |
11+
| sqlite3_c_api.swift:43:49:43:49 | medicalNotes | sqlite3_c_api.swift:48:27:48:27 | deleteQuery |
12+
| sqlite3_c_api.swift:43:49:43:49 | medicalNotes | sqlite3_c_api.swift:57:34:57:34 | id |
913
| testCoreData2.swift:23:13:23:13 | value | file://:0:0:0:0 | value |
1014
| testCoreData2.swift:37:2:37:2 | [post] obj [myValue] | testCoreData2.swift:37:2:37:2 | [post] obj |
1115
| testCoreData2.swift:37:16:37:16 | bankAccountNo | testCoreData2.swift:37:2:37:2 | [post] obj [myValue] |
@@ -197,6 +201,13 @@ nodes
197201
| file://:0:0:0:0 | value | semmle.label | value |
198202
| file://:0:0:0:0 | value | semmle.label | value |
199203
| file://:0:0:0:0 | value | semmle.label | value |
204+
| sqlite3_c_api.swift:42:69:42:69 | medicalNotes | semmle.label | medicalNotes |
205+
| sqlite3_c_api.swift:43:49:43:49 | medicalNotes | semmle.label | medicalNotes |
206+
| sqlite3_c_api.swift:46:27:46:27 | insertQuery | semmle.label | insertQuery |
207+
| sqlite3_c_api.swift:47:27:47:27 | updateQuery | semmle.label | updateQuery |
208+
| sqlite3_c_api.swift:48:27:48:27 | deleteQuery | semmle.label | deleteQuery |
209+
| sqlite3_c_api.swift:57:34:57:34 | id | semmle.label | id |
210+
| sqlite3_c_api.swift:58:36:58:36 | medicalNotes | semmle.label | medicalNotes |
200211
| testCoreData2.swift:23:13:23:13 | value | semmle.label | value |
201212
| testCoreData2.swift:37:2:37:2 | [post] obj | semmle.label | [post] obj |
202213
| testCoreData2.swift:37:2:37:2 | [post] obj [myValue] | semmle.label | [post] obj [myValue] |
@@ -465,6 +476,11 @@ subpaths
465476
| testRealm.swift:66:11:66:11 | myPassword | testRealm.swift:27:6:27:6 | value | file://:0:0:0:0 | [post] self [data] | testRealm.swift:66:2:66:2 | [post] g [data] |
466477
| testRealm.swift:73:15:73:15 | myPassword | testRealm.swift:34:6:34:6 | value | file://:0:0:0:0 | [post] self [password] | testRealm.swift:73:2:73:2 | [post] h [password] |
467478
#select
479+
| sqlite3_c_api.swift:46:27:46:27 | insertQuery | sqlite3_c_api.swift:42:69:42:69 | medicalNotes | sqlite3_c_api.swift:46:27:46:27 | insertQuery | This operation stores 'insertQuery' in a database. It may contain unencrypted sensitive data from $@. | sqlite3_c_api.swift:42:69:42:69 | medicalNotes | medicalNotes |
480+
| sqlite3_c_api.swift:47:27:47:27 | updateQuery | sqlite3_c_api.swift:43:49:43:49 | medicalNotes | sqlite3_c_api.swift:47:27:47:27 | updateQuery | This operation stores 'updateQuery' in a database. It may contain unencrypted sensitive data from $@. | sqlite3_c_api.swift:43:49:43:49 | medicalNotes | medicalNotes |
481+
| sqlite3_c_api.swift:48:27:48:27 | deleteQuery | sqlite3_c_api.swift:43:49:43:49 | medicalNotes | sqlite3_c_api.swift:48:27:48:27 | deleteQuery | This operation stores 'deleteQuery' in a database. It may contain unencrypted sensitive data from $@. | sqlite3_c_api.swift:43:49:43:49 | medicalNotes | medicalNotes |
482+
| sqlite3_c_api.swift:57:34:57:34 | id | sqlite3_c_api.swift:43:49:43:49 | medicalNotes | sqlite3_c_api.swift:57:34:57:34 | id | This operation stores 'id' in a database. It may contain unencrypted sensitive data from $@. | sqlite3_c_api.swift:43:49:43:49 | medicalNotes | medicalNotes |
483+
| sqlite3_c_api.swift:58:36:58:36 | medicalNotes | sqlite3_c_api.swift:58:36:58:36 | medicalNotes | sqlite3_c_api.swift:58:36:58:36 | medicalNotes | This operation stores 'medicalNotes' in a database. It may contain unencrypted sensitive data from $@. | sqlite3_c_api.swift:58:36:58:36 | medicalNotes | medicalNotes |
468484
| testCoreData2.swift:37:2:37:2 | obj | testCoreData2.swift:37:16:37:16 | bankAccountNo | testCoreData2.swift:37:2:37:2 | [post] obj | This operation stores 'obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:37:16:37:16 | bankAccountNo | bankAccountNo |
469485
| testCoreData2.swift:39:2:39:2 | obj | testCoreData2.swift:39:28:39:28 | bankAccountNo | testCoreData2.swift:39:2:39:2 | [post] obj | This operation stores 'obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:39:28:39:28 | bankAccountNo | bankAccountNo |
470486
| testCoreData2.swift:41:2:41:2 | obj | testCoreData2.swift:41:29:41:29 | bankAccountNo | testCoreData2.swift:41:2:41:2 | [post] obj | This operation stores 'obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:41:29:41:29 | bankAccountNo | bankAccountNo |

‎swift/ql/test/query-tests/Security/CWE-311/sqlite3_c_api.swift

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ func test_sqlite3_c_api(db: OpaquePointer?, id: Int32, medicalNotes: String) {
4343
let updateQuery = "UPDATE PATIENTS SET NOTES=\(medicalNotes) WHERE ID=\(id);"
4444
let deleteQuery = "DELETE FROM PATIENTS WHERE ID=\(id);"
4545

46-
let _ = sqlite3_exec(db, insertQuery, nil, nil, nil) // BAD (sensitive data) [NOT DETECTED]
47-
let _ = sqlite3_exec(db, updateQuery, nil, nil, nil) // BAD (sensitive data) [NOT DETECTED]
48-
let _ = sqlite3_exec(db, deleteQuery, nil, nil, nil) // GOOD
46+
let _ = sqlite3_exec(db, insertQuery, nil, nil, nil) // BAD (sensitive data)
47+
let _ = sqlite3_exec(db, updateQuery, nil, nil, nil) // BAD (sensitive data)
48+
let _ = sqlite3_exec(db, deleteQuery, nil, nil, nil) // GOOD [FALSE POSITIVE]
4949

5050
// --- sensitive data in bindings ---
5151

@@ -54,8 +54,8 @@ func test_sqlite3_c_api(db: OpaquePointer?, id: Int32, medicalNotes: String) {
5454
var stmt1: OpaquePointer?
5555

5656
if (sqlite3_prepare(db, varQuery, -1, &stmt1, nil) == SQLITE_OK) { // GOOD
57-
if (sqlite3_bind_int(stmt1, 1, id) == SQLITE_OK) { // GOOD
58-
if (sqlite3_bind_text(stmt1, 2, medicalNotes, -1, SQLITE_TRANSIENT) == SQLITE_OK) { // BAD (sensitive data) [NOT DETECTED]
57+
if (sqlite3_bind_int(stmt1, 1, id) == SQLITE_OK) { // GOOD [FALSE POSITIVE]
58+
if (sqlite3_bind_text(stmt1, 2, medicalNotes, -1, SQLITE_TRANSIENT) == SQLITE_OK) { // BAD (sensitive data)
5959
// ...
6060
}
6161
}

0 commit comments

Comments
 (0)