Skip to content

Commit a4e9d38

Browse files
geoffw0geoffw0
committed
Swift: Fix the test regression.
1 parent cbe5243 commit a4e9d38

File tree

6 files changed

+30
-5
lines changed

6 files changed

+30
-5
lines changed

‎swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,15 +33,15 @@ class ConstantPasswordSink extends Expr {
3333
ConstantPasswordSink() {
3434
// `password` arg in `init` is a sink
3535
exists(ClassOrStructDecl c, ConstructorDecl f, CallExpr call |
36-
c.getFullName() = ["HKDF", "PBKDF1", "PBKDF2", "Scrypt"] and
36+
c.getName() = ["HKDF", "PBKDF1", "PBKDF2", "Scrypt"] and
3737
c.getAMember() = f and
3838
call.getStaticTarget() = f and
3939
call.getArgumentWithLabel("password").getExpr() = this
4040
)
4141
or
4242
// RNCryptor (labelled arguments)
4343
exists(ClassOrStructDecl c, MethodDecl f, CallExpr call |
44-
c.getFullName() = ["RNCryptor", "RNEncryptor", "RNDecryptor"] and
44+
c.getName() = ["RNCryptor", "RNEncryptor", "RNDecryptor"] and
4545
c.getAMember() = f and
4646
call.getStaticTarget() = f and
4747
call.getArgumentWithLabel(["password", "withPassword", "forPassword"]).getExpr() = this

‎swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,15 +34,15 @@ class ConstantSaltSink extends Expr {
3434
ConstantSaltSink() {
3535
// `salt` arg in `init` is a sink
3636
exists(ClassOrStructDecl c, ConstructorDecl f, CallExpr call |
37-
c.getFullName() = ["HKDF", "PBKDF1", "PBKDF2", "Scrypt"] and
37+
c.getName() = ["HKDF", "PBKDF1", "PBKDF2", "Scrypt"] and
3838
c.getAMember() = f and
3939
call.getStaticTarget() = f and
4040
call.getArgumentWithLabel("salt").getExpr() = this
4141
)
4242
or
4343
// RNCryptor
4444
exists(ClassOrStructDecl c, MethodDecl f, CallExpr call |
45-
c.getFullName() = ["RNCryptor", "RNEncryptor", "RNDecryptor"] and
45+
c.getName() = ["RNCryptor", "RNEncryptor", "RNDecryptor"] and
4646
c.getAMember() = f and
4747
call.getStaticTarget() = f and
4848
call.getArgumentWithLabel(["salt", "encryptionSalt", "hmacSalt", "HMACSalt"]).getExpr() = this

‎swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ class InsufficientHashIterationsSink extends Expr {
3434
InsufficientHashIterationsSink() {
3535
// `iterations` arg in `init` is a sink
3636
exists(ClassOrStructDecl c, ConstructorDecl f, CallExpr call |
37-
c.getFullName() = ["PBKDF1", "PBKDF2"] and
37+
c.getName() = ["PBKDF1", "PBKDF2"] and
3838
c.getAMember() = f and
3939
call.getStaticTarget() = f and
4040
call.getArgumentWithLabel("iterations").getExpr() = this

‎swift/ql/test/query-tests/Security/CWE-259/ConstantPassword.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ edges
1818
| rncryptor.swift:69:24:69:24 | abc123 : | rncryptor.swift:107:61:107:61 | myConstPassword |
1919
| rncryptor.swift:69:24:69:24 | abc123 : | rncryptor.swift:108:97:108:97 | myConstPassword |
2020
| test.swift:43:39:43:134 | [...] : | test.swift:51:30:51:30 | constantPassword |
21+
| test.swift:43:39:43:134 | [...] : | test.swift:56:40:56:40 | constantPassword |
22+
| test.swift:43:39:43:134 | [...] : | test.swift:62:40:62:40 | constantPassword |
2123
| test.swift:43:39:43:134 | [...] : | test.swift:67:34:67:34 | constantPassword |
2224
nodes
2325
| rncryptor.swift:69:24:69:24 | abc123 : | semmle.label | abc123 : |
@@ -41,6 +43,8 @@ nodes
4143
| rncryptor.swift:108:97:108:97 | myConstPassword | semmle.label | myConstPassword |
4244
| test.swift:43:39:43:134 | [...] : | semmle.label | [...] : |
4345
| test.swift:51:30:51:30 | constantPassword | semmle.label | constantPassword |
46+
| test.swift:56:40:56:40 | constantPassword | semmle.label | constantPassword |
47+
| test.swift:62:40:62:40 | constantPassword | semmle.label | constantPassword |
4448
| test.swift:67:34:67:34 | constantPassword | semmle.label | constantPassword |
4549
subpaths
4650
#select
@@ -63,4 +67,6 @@ subpaths
6367
| rncryptor.swift:107:61:107:61 | myConstPassword | rncryptor.swift:69:24:69:24 | abc123 : | rncryptor.swift:107:61:107:61 | myConstPassword | The value 'abc123' is used as a constant password. |
6468
| rncryptor.swift:108:97:108:97 | myConstPassword | rncryptor.swift:69:24:69:24 | abc123 : | rncryptor.swift:108:97:108:97 | myConstPassword | The value 'abc123' is used as a constant password. |
6569
| test.swift:51:30:51:30 | constantPassword | test.swift:43:39:43:134 | [...] : | test.swift:51:30:51:30 | constantPassword | The value '[...]' is used as a constant password. |
70+
| test.swift:56:40:56:40 | constantPassword | test.swift:43:39:43:134 | [...] : | test.swift:56:40:56:40 | constantPassword | The value '[...]' is used as a constant password. |
71+
| test.swift:62:40:62:40 | constantPassword | test.swift:43:39:43:134 | [...] : | test.swift:62:40:62:40 | constantPassword | The value '[...]' is used as a constant password. |
6672
| test.swift:67:34:67:34 | constantPassword | test.swift:43:39:43:134 | [...] : | test.swift:67:34:67:34 | constantPassword | The value '[...]' is used as a constant password. |

‎swift/ql/test/query-tests/Security/CWE-760/ConstantSalt.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ edges
1515
| rncryptor.swift:60:29:60:29 | 0 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
1616
| rncryptor.swift:60:29:60:29 | 0 : | rncryptor.swift:60:24:60:30 | call to Data.init(_:) : |
1717
| test.swift:43:35:43:130 | [...] : | test.swift:51:49:51:49 | constantSalt |
18+
| test.swift:43:35:43:130 | [...] : | test.swift:56:59:56:59 | constantSalt |
19+
| test.swift:43:35:43:130 | [...] : | test.swift:62:59:62:59 | constantSalt |
1820
| test.swift:43:35:43:130 | [...] : | test.swift:67:53:67:53 | constantSalt |
1921
nodes
2022
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : |
@@ -35,6 +37,8 @@ nodes
3537
| rncryptor.swift:79:160:79:160 | myConstantSalt2 | semmle.label | myConstantSalt2 |
3638
| test.swift:43:35:43:130 | [...] : | semmle.label | [...] : |
3739
| test.swift:51:49:51:49 | constantSalt | semmle.label | constantSalt |
40+
| test.swift:56:59:56:59 | constantSalt | semmle.label | constantSalt |
41+
| test.swift:62:59:62:59 | constantSalt | semmle.label | constantSalt |
3842
| test.swift:67:53:67:53 | constantSalt | semmle.label | constantSalt |
3943
subpaths
4044
| rncryptor.swift:59:29:59:29 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:59:24:59:43 | call to Data.init(_:) : |
@@ -51,4 +55,6 @@ subpaths
5155
| rncryptor.swift:78:135:78:135 | myConstantSalt1 | rncryptor.swift:59:29:59:29 | abcdef123456 : | rncryptor.swift:78:135:78:135 | myConstantSalt1 | The value 'abcdef123456' is used as a constant salt, which is insecure for hashing passwords. |
5256
| rncryptor.swift:79:160:79:160 | myConstantSalt2 | rncryptor.swift:60:29:60:29 | 0 : | rncryptor.swift:79:160:79:160 | myConstantSalt2 | The value '0' is used as a constant salt, which is insecure for hashing passwords. |
5357
| test.swift:51:49:51:49 | constantSalt | test.swift:43:35:43:130 | [...] : | test.swift:51:49:51:49 | constantSalt | The value '[...]' is used as a constant salt, which is insecure for hashing passwords. |
58+
| test.swift:56:59:56:59 | constantSalt | test.swift:43:35:43:130 | [...] : | test.swift:56:59:56:59 | constantSalt | The value '[...]' is used as a constant salt, which is insecure for hashing passwords. |
59+
| test.swift:62:59:62:59 | constantSalt | test.swift:43:35:43:130 | [...] : | test.swift:62:59:62:59 | constantSalt | The value '[...]' is used as a constant salt, which is insecure for hashing passwords. |
5460
| test.swift:67:53:67:53 | constantSalt | test.swift:43:35:43:130 | [...] : | test.swift:67:53:67:53 | constantSalt | The value '[...]' is used as a constant salt, which is insecure for hashing passwords. |

‎swift/ql/test/query-tests/Security/CWE-916/InsufficientHashIterations.expected

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,17 @@
11
edges
2+
| test.swift:20:45:20:45 | 99999 : | test.swift:33:22:33:43 | call to getLowIterationCount() : |
3+
| test.swift:33:22:33:43 | call to getLowIterationCount() : | test.swift:37:84:37:84 | lowIterations |
4+
| test.swift:33:22:33:43 | call to getLowIterationCount() : | test.swift:44:84:44:84 | lowIterations |
25
nodes
6+
| test.swift:20:45:20:45 | 99999 : | semmle.label | 99999 : |
7+
| test.swift:33:22:33:43 | call to getLowIterationCount() : | semmle.label | call to getLowIterationCount() : |
8+
| test.swift:37:84:37:84 | lowIterations | semmle.label | lowIterations |
9+
| test.swift:38:84:38:84 | 80000 | semmle.label | 80000 |
10+
| test.swift:44:84:44:84 | lowIterations | semmle.label | lowIterations |
11+
| test.swift:45:84:45:84 | 80000 | semmle.label | 80000 |
312
subpaths
413
#select
14+
| test.swift:37:84:37:84 | lowIterations | test.swift:20:45:20:45 | 99999 : | test.swift:37:84:37:84 | lowIterations | The value '99999' is an insufficient number of iterations for secure password hashing. |
15+
| test.swift:38:84:38:84 | 80000 | test.swift:38:84:38:84 | 80000 | test.swift:38:84:38:84 | 80000 | The value '80000' is an insufficient number of iterations for secure password hashing. |
16+
| test.swift:44:84:44:84 | lowIterations | test.swift:20:45:20:45 | 99999 : | test.swift:44:84:44:84 | lowIterations | The value '99999' is an insufficient number of iterations for secure password hashing. |
17+
| test.swift:45:84:45:84 | 80000 | test.swift:45:84:45:84 | 80000 | test.swift:45:84:45:84 | 80000 | The value '80000' is an insufficient number of iterations for secure password hashing. |

0 commit comments

Comments
 (0)