Skip to content

Commit 6a0b56b

Browse files
geoffw0geoffw0
committed
Swift: Fix for extensions.
1 parent 2622de9 commit 6a0b56b

File tree

3 files changed

+20
-5
lines changed

3 files changed

+20
-5
lines changed

‎swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.ql

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ class CoreDataStore extends Stored {
3434
.hasQualifiedName("NSManagedObject",
3535
["setValue(_:forKey:)", "setPrimitiveValue(_:forKey:)"]) and
3636
call.getArgument(0).getExpr() = this.asExpr()
37-
) or
37+
)
38+
or
3839
// any write into a class derived from `NSManagedObject` is a sink. For
3940
// example in `coreDataObj.data = sensitive` the post-update node corresponding
4041
// with `coreDataObj.data` is a sink.
@@ -91,8 +92,10 @@ class CleartextStorageConfig extends TaintTracking::Configuration {
9192
// flow out from fields of an `NSManagedObject` or `RealmSwiftObject` at the sink,
9293
// for example in `realmObj.data = sensitive`.
9394
isSink(node) and
94-
exists(ClassOrStructDecl cd |
95-
c.getAReadContent().(DataFlow::Content::FieldContent).getField() = cd.getAMember() and
95+
exists(ClassOrStructDecl cd, IterableDeclContext cx |
96+
(cx = cd or cx.(ExtensionDecl).getExtendedTypeDecl() = cd) and
97+
c.getAReadContent().(DataFlow::Content::FieldContent).getField() = cx.getAMember() and
98+
// TODO: add a `getAMember` version that accounts for extensions?
9699
cd.getABaseTypeDecl*().getName() = ["NSManagedObject", "RealmSwiftObject"]
97100
)
98101
or

‎swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,17 @@ edges
66
| testCoreData2.swift:37:16:37:16 | bankAccountNo : | testCoreData2.swift:37:2:37:2 | [post] obj [myValue] : |
77
| testCoreData2.swift:39:2:39:2 | [post] obj [myBankAccountNumber] : | testCoreData2.swift:39:2:39:2 | [post] obj |
88
| testCoreData2.swift:39:28:39:28 | bankAccountNo : | testCoreData2.swift:39:2:39:2 | [post] obj [myBankAccountNumber] : |
9+
| testCoreData2.swift:41:2:41:2 | [post] obj [myBankAccountNumber2] : | testCoreData2.swift:41:2:41:2 | [post] obj |
10+
| testCoreData2.swift:41:29:41:29 | bankAccountNo : | testCoreData2.swift:41:2:41:2 | [post] obj [myBankAccountNumber2] : |
911
| testCoreData2.swift:43:2:43:2 | [post] obj [notStoredBankAccountNumber] : | testCoreData2.swift:43:2:43:2 | [post] obj |
1012
| testCoreData2.swift:43:35:43:35 | bankAccountNo : | testCoreData2.swift:23:13:23:13 | value : |
1113
| testCoreData2.swift:43:35:43:35 | bankAccountNo : | testCoreData2.swift:43:2:43:2 | [post] obj [notStoredBankAccountNumber] : |
1214
| testCoreData2.swift:46:2:46:10 | [post] ...? [myValue] : | testCoreData2.swift:46:2:46:10 | [post] ...? |
1315
| testCoreData2.swift:46:22:46:22 | bankAccountNo : | testCoreData2.swift:46:2:46:10 | [post] ...? [myValue] : |
1416
| testCoreData2.swift:48:2:48:10 | [post] ...? [myBankAccountNumber] : | testCoreData2.swift:48:2:48:10 | [post] ...? |
1517
| testCoreData2.swift:48:34:48:34 | bankAccountNo : | testCoreData2.swift:48:2:48:10 | [post] ...? [myBankAccountNumber] : |
18+
| testCoreData2.swift:50:2:50:10 | [post] ...? [myBankAccountNumber2] : | testCoreData2.swift:50:2:50:10 | [post] ...? |
19+
| testCoreData2.swift:50:35:50:35 | bankAccountNo : | testCoreData2.swift:50:2:50:10 | [post] ...? [myBankAccountNumber2] : |
1620
| testCoreData2.swift:52:2:52:10 | [post] ...? [notStoredBankAccountNumber] : | testCoreData2.swift:52:2:52:10 | [post] ...? |
1721
| testCoreData2.swift:52:41:52:41 | bankAccountNo : | testCoreData2.swift:23:13:23:13 | value : |
1822
| testCoreData2.swift:52:41:52:41 | bankAccountNo : | testCoreData2.swift:52:2:52:10 | [post] ...? [notStoredBankAccountNumber] : |
@@ -54,6 +58,9 @@ nodes
5458
| testCoreData2.swift:39:2:39:2 | [post] obj | semmle.label | [post] obj |
5559
| testCoreData2.swift:39:2:39:2 | [post] obj [myBankAccountNumber] : | semmle.label | [post] obj [myBankAccountNumber] : |
5660
| testCoreData2.swift:39:28:39:28 | bankAccountNo : | semmle.label | bankAccountNo : |
61+
| testCoreData2.swift:41:2:41:2 | [post] obj | semmle.label | [post] obj |
62+
| testCoreData2.swift:41:2:41:2 | [post] obj [myBankAccountNumber2] : | semmle.label | [post] obj [myBankAccountNumber2] : |
63+
| testCoreData2.swift:41:29:41:29 | bankAccountNo : | semmle.label | bankAccountNo : |
5764
| testCoreData2.swift:43:2:43:2 | [post] obj | semmle.label | [post] obj |
5865
| testCoreData2.swift:43:2:43:2 | [post] obj [notStoredBankAccountNumber] : | semmle.label | [post] obj [notStoredBankAccountNumber] : |
5966
| testCoreData2.swift:43:35:43:35 | bankAccountNo : | semmle.label | bankAccountNo : |
@@ -63,6 +70,9 @@ nodes
6370
| testCoreData2.swift:48:2:48:10 | [post] ...? | semmle.label | [post] ...? |
6471
| testCoreData2.swift:48:2:48:10 | [post] ...? [myBankAccountNumber] : | semmle.label | [post] ...? [myBankAccountNumber] : |
6572
| testCoreData2.swift:48:34:48:34 | bankAccountNo : | semmle.label | bankAccountNo : |
73+
| testCoreData2.swift:50:2:50:10 | [post] ...? | semmle.label | [post] ...? |
74+
| testCoreData2.swift:50:2:50:10 | [post] ...? [myBankAccountNumber2] : | semmle.label | [post] ...? [myBankAccountNumber2] : |
75+
| testCoreData2.swift:50:35:50:35 | bankAccountNo : | semmle.label | bankAccountNo : |
6676
| testCoreData2.swift:52:2:52:10 | [post] ...? | semmle.label | [post] ...? |
6777
| testCoreData2.swift:52:2:52:10 | [post] ...? [notStoredBankAccountNumber] : | semmle.label | [post] ...? [notStoredBankAccountNumber] : |
6878
| testCoreData2.swift:52:41:52:41 | bankAccountNo : | semmle.label | bankAccountNo : |
@@ -114,9 +124,11 @@ subpaths
114124
#select
115125
| testCoreData2.swift:37:2:37:2 | obj | testCoreData2.swift:37:16:37:16 | bankAccountNo : | testCoreData2.swift:37:2:37:2 | [post] obj | This operation stores '[post] obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:37:16:37:16 | bankAccountNo : | bankAccountNo |
116126
| testCoreData2.swift:39:2:39:2 | obj | testCoreData2.swift:39:28:39:28 | bankAccountNo : | testCoreData2.swift:39:2:39:2 | [post] obj | This operation stores '[post] obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:39:28:39:28 | bankAccountNo : | bankAccountNo |
127+
| testCoreData2.swift:41:2:41:2 | obj | testCoreData2.swift:41:29:41:29 | bankAccountNo : | testCoreData2.swift:41:2:41:2 | [post] obj | This operation stores '[post] obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:41:29:41:29 | bankAccountNo : | bankAccountNo |
117128
| testCoreData2.swift:43:2:43:2 | obj | testCoreData2.swift:43:35:43:35 | bankAccountNo : | testCoreData2.swift:43:2:43:2 | [post] obj | This operation stores '[post] obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:43:35:43:35 | bankAccountNo : | bankAccountNo |
118129
| testCoreData2.swift:46:2:46:10 | ...? | testCoreData2.swift:46:22:46:22 | bankAccountNo : | testCoreData2.swift:46:2:46:10 | [post] ...? | This operation stores '[post] ...?' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:46:22:46:22 | bankAccountNo : | bankAccountNo |
119130
| testCoreData2.swift:48:2:48:10 | ...? | testCoreData2.swift:48:34:48:34 | bankAccountNo : | testCoreData2.swift:48:2:48:10 | [post] ...? | This operation stores '[post] ...?' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:48:34:48:34 | bankAccountNo : | bankAccountNo |
131+
| testCoreData2.swift:50:2:50:10 | ...? | testCoreData2.swift:50:35:50:35 | bankAccountNo : | testCoreData2.swift:50:2:50:10 | [post] ...? | This operation stores '[post] ...?' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:50:35:50:35 | bankAccountNo : | bankAccountNo |
120132
| testCoreData2.swift:52:2:52:10 | ...? | testCoreData2.swift:52:41:52:41 | bankAccountNo : | testCoreData2.swift:52:2:52:10 | [post] ...? | This operation stores '[post] ...?' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:52:41:52:41 | bankAccountNo : | bankAccountNo |
121133
| testCoreData2.swift:57:3:57:3 | obj | testCoreData2.swift:57:29:57:29 | bankAccountNo : | testCoreData2.swift:57:3:57:3 | [post] obj | This operation stores '[post] obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:57:29:57:29 | bankAccountNo : | bankAccountNo |
122134
| testCoreData.swift:19:12:19:12 | value | testCoreData.swift:61:25:61:25 | password : | testCoreData.swift:19:12:19:12 | value | This operation stores 'value' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:61:25:61:25 | password : | password |

‎swift/ql/test/query-tests/Security/CWE-311/testCoreData2.swift

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ func testCoreData2_1(obj: MyManagedObject2, maybeObj: MyManagedObject2?, value:
3838
obj.myBankAccountNumber = value // BAD [NOT DETECTED]
3939
obj.myBankAccountNumber = bankAccountNo // BAD
4040
obj.myBankAccountNumber2 = value // BAD [NOT DETECTED]
41-
obj.myBankAccountNumber2 = bankAccountNo // BAD [NOT DETECTED]
41+
obj.myBankAccountNumber2 = bankAccountNo // BAD
4242
obj.notStoredBankAccountNumber = value // GOOD (not stored in the database)
4343
obj.notStoredBankAccountNumber = bankAccountNo // GOOD (not stored in the datbase) [FALSE POSITIVE]
4444

@@ -47,7 +47,7 @@ func testCoreData2_1(obj: MyManagedObject2, maybeObj: MyManagedObject2?, value:
4747
maybeObj?.myBankAccountNumber = value // BAD [NOT DETECTED]
4848
maybeObj?.myBankAccountNumber = bankAccountNo // BAD
4949
maybeObj?.myBankAccountNumber2 = value // BAD [NOT DETECTED]
50-
maybeObj?.myBankAccountNumber2 = bankAccountNo // BAD [NOT DETECTED]
50+
maybeObj?.myBankAccountNumber2 = bankAccountNo // BAD
5151
maybeObj?.notStoredBankAccountNumber = value // GOOD (not stored in the database)
5252
maybeObj?.notStoredBankAccountNumber = bankAccountNo // GOOD (not stored in the datbase) [FALSE POSITIVE]
5353
}

0 commit comments

Comments
 (0)