Skip to content

Commit ffbd201

Browse files
geoffw0geoffw0
committed
Swift: Implement basic model of WKUserScript.
1 parent 116d966 commit ffbd201

File tree

4 files changed

+69
-2
lines changed

4 files changed

+69
-2
lines changed

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/WebView.qll

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,3 +131,16 @@ private class JsExportedSource extends RemoteFlowSource {
131131

132132
override string getSourceType() { result = "Member of a type exposed through JSExport" }
133133
}
134+
135+
/**
136+
* A model for `WKUserScript` summaries.
137+
*/
138+
private class WKUserScriptSummaries extends SummaryModelCsv {
139+
override predicate row(string row) {
140+
row =
141+
[
142+
";WKUserScript;true;init(source:injectionTime:forMainFrameOnly:);;;Argument[0];ReturnValue;taint",
143+
";WKUserScript;true;init(source:injectionTime:forMainFrameOnly:in:);;;Argument[0];ReturnValue;taint"
144+
]
145+
}
146+
}

‎swift/ql/test/library-tests/dataflow/taint/Taint.expected

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -439,6 +439,8 @@ edges
439439
| webview.swift:53:5:53:89 | [summary param] this in forProperty(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in forProperty(_:) : |
440440
| webview.swift:54:5:54:38 | [summary param] 0 in setValue(_:at:) : | file://:0:0:0:0 | [summary] to write: argument this in setValue(_:at:) : |
441441
| webview.swift:55:5:55:48 | [summary param] 0 in setValue(_:forProperty:) : | file://:0:0:0:0 | [summary] to write: argument this in setValue(_:forProperty:) : |
442+
| webview.swift:65:5:65:93 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:) : | file://:0:0:0:0 | [summary] to write: return (return) in init(source:injectionTime:forMainFrameOnly:) : |
443+
| webview.swift:66:5:66:126 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:in:) : | file://:0:0:0:0 | [summary] to write: return (return) in init(source:injectionTime:forMainFrameOnly:in:) : |
442444
| webview.swift:77:11:77:18 | call to source() : | webview.swift:77:10:77:41 | .body |
443445
| webview.swift:81:13:81:20 | call to source() : | webview.swift:84:10:84:10 | source : |
444446
| webview.swift:81:13:81:20 | call to source() : | webview.swift:85:10:85:10 | source : |
@@ -530,6 +532,12 @@ edges
530532
| webview.swift:122:5:122:5 | [post] v3 : | webview.swift:123:10:123:10 | v3 |
531533
| webview.swift:122:17:122:17 | s : | webview.swift:55:5:55:48 | [summary param] 0 in setValue(_:forProperty:) : |
532534
| webview.swift:122:17:122:17 | s : | webview.swift:122:5:122:5 | [post] v3 : |
535+
| webview.swift:132:13:132:102 | call to init(source:injectionTime:forMainFrameOnly:) : | webview.swift:133:10:133:10 | b |
536+
| webview.swift:132:34:132:41 | call to source() : | webview.swift:65:5:65:93 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:) : |
537+
| webview.swift:132:34:132:41 | call to source() : | webview.swift:132:13:132:102 | call to init(source:injectionTime:forMainFrameOnly:) : |
538+
| webview.swift:137:13:137:113 | call to init(source:injectionTime:forMainFrameOnly:in:) : | webview.swift:138:10:138:10 | c |
539+
| webview.swift:137:34:137:41 | call to source() : | webview.swift:66:5:66:126 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:in:) : |
540+
| webview.swift:137:34:137:41 | call to source() : | webview.swift:137:13:137:113 | call to init(source:injectionTime:forMainFrameOnly:in:) : |
533541
nodes
534542
| data.swift:25:2:25:66 | [summary param] 0 in init(base64Encoded:options:) : | semmle.label | [summary param] 0 in init(base64Encoded:options:) : |
535543
| data.swift:26:2:26:61 | [summary param] 0 in init(buffer:) : | semmle.label | [summary param] 0 in init(buffer:) : |
@@ -752,6 +760,8 @@ nodes
752760
| file://:0:0:0:0 | [summary] to write: return (return) in init(rect:in:) : | semmle.label | [summary] to write: return (return) in init(rect:in:) : |
753761
| file://:0:0:0:0 | [summary] to write: return (return) in init(referencing:) : | semmle.label | [summary] to write: return (return) in init(referencing:) : |
754762
| file://:0:0:0:0 | [summary] to write: return (return) in init(size:in:) : | semmle.label | [summary] to write: return (return) in init(size:in:) : |
763+
| file://:0:0:0:0 | [summary] to write: return (return) in init(source:injectionTime:forMainFrameOnly:) : | semmle.label | [summary] to write: return (return) in init(source:injectionTime:forMainFrameOnly:) : |
764+
| file://:0:0:0:0 | [summary] to write: return (return) in init(source:injectionTime:forMainFrameOnly:in:) : | semmle.label | [summary] to write: return (return) in init(source:injectionTime:forMainFrameOnly:in:) : |
755765
| file://:0:0:0:0 | [summary] to write: return (return) in init(string:) : | semmle.label | [summary] to write: return (return) in init(string:) : |
756766
| file://:0:0:0:0 | [summary] to write: return (return) in init(string:relativeTo:) : | semmle.label | [summary] to write: return (return) in init(string:relativeTo:) : |
757767
| file://:0:0:0:0 | [summary] to write: return (return) in init(string:relativeTo:) : | semmle.label | [summary] to write: return (return) in init(string:relativeTo:) : |
@@ -1052,6 +1062,8 @@ nodes
10521062
| webview.swift:53:5:53:89 | [summary param] this in forProperty(_:) : | semmle.label | [summary param] this in forProperty(_:) : |
10531063
| webview.swift:54:5:54:38 | [summary param] 0 in setValue(_:at:) : | semmle.label | [summary param] 0 in setValue(_:at:) : |
10541064
| webview.swift:55:5:55:48 | [summary param] 0 in setValue(_:forProperty:) : | semmle.label | [summary param] 0 in setValue(_:forProperty:) : |
1065+
| webview.swift:65:5:65:93 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:) : | semmle.label | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:) : |
1066+
| webview.swift:66:5:66:126 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:in:) : | semmle.label | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:in:) : |
10551067
| webview.swift:77:10:77:41 | .body | semmle.label | .body |
10561068
| webview.swift:77:11:77:18 | call to source() : | semmle.label | call to source() : |
10571069
| webview.swift:81:13:81:20 | call to source() : | semmle.label | call to source() : |
@@ -1116,6 +1128,12 @@ nodes
11161128
| webview.swift:122:5:122:5 | [post] v3 : | semmle.label | [post] v3 : |
11171129
| webview.swift:122:17:122:17 | s : | semmle.label | s : |
11181130
| webview.swift:123:10:123:10 | v3 | semmle.label | v3 |
1131+
| webview.swift:132:13:132:102 | call to init(source:injectionTime:forMainFrameOnly:) : | semmle.label | call to init(source:injectionTime:forMainFrameOnly:) : |
1132+
| webview.swift:132:34:132:41 | call to source() : | semmle.label | call to source() : |
1133+
| webview.swift:133:10:133:10 | b | semmle.label | b |
1134+
| webview.swift:137:13:137:113 | call to init(source:injectionTime:forMainFrameOnly:in:) : | semmle.label | call to init(source:injectionTime:forMainFrameOnly:in:) : |
1135+
| webview.swift:137:34:137:41 | call to source() : | semmle.label | call to source() : |
1136+
| webview.swift:138:10:138:10 | c | semmle.label | c |
11191137
subpaths
11201138
| data.swift:89:41:89:48 | call to source() : | data.swift:25:2:25:66 | [summary param] 0 in init(base64Encoded:options:) : | file://:0:0:0:0 | [summary] to write: return (return) in init(base64Encoded:options:) : | data.swift:89:21:89:71 | call to init(base64Encoded:options:) : |
11211139
| data.swift:93:34:93:41 | call to source() : | data.swift:26:2:26:61 | [summary param] 0 in init(buffer:) : | file://:0:0:0:0 | [summary] to write: return (return) in init(buffer:) : | data.swift:93:21:93:73 | call to init(buffer:) : |
@@ -1235,6 +1253,8 @@ subpaths
12351253
| webview.swift:114:39:114:39 | s : | webview.swift:52:5:52:53 | [summary param] 1 in defineProperty(_:descriptor:) : | file://:0:0:0:0 | [summary] to write: argument this in defineProperty(_:descriptor:) : | webview.swift:114:5:114:5 | [post] v1 : |
12361254
| webview.swift:118:17:118:17 | s : | webview.swift:54:5:54:38 | [summary param] 0 in setValue(_:at:) : | file://:0:0:0:0 | [summary] to write: argument this in setValue(_:at:) : | webview.swift:118:5:118:5 | [post] v2 : |
12371255
| webview.swift:122:17:122:17 | s : | webview.swift:55:5:55:48 | [summary param] 0 in setValue(_:forProperty:) : | file://:0:0:0:0 | [summary] to write: argument this in setValue(_:forProperty:) : | webview.swift:122:5:122:5 | [post] v3 : |
1256+
| webview.swift:132:34:132:41 | call to source() : | webview.swift:65:5:65:93 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:) : | file://:0:0:0:0 | [summary] to write: return (return) in init(source:injectionTime:forMainFrameOnly:) : | webview.swift:132:13:132:102 | call to init(source:injectionTime:forMainFrameOnly:) : |
1257+
| webview.swift:137:34:137:41 | call to source() : | webview.swift:66:5:66:126 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:in:) : | file://:0:0:0:0 | [summary] to write: return (return) in init(source:injectionTime:forMainFrameOnly:in:) : | webview.swift:137:13:137:113 | call to init(source:injectionTime:forMainFrameOnly:in:) : |
12381258
#select
12391259
| data.swift:90:12:90:12 | dataTainted3 | data.swift:89:41:89:48 | call to source() : | data.swift:90:12:90:12 | dataTainted3 | result |
12401260
| data.swift:94:12:94:12 | dataTainted4 | data.swift:93:34:93:41 | call to source() : | data.swift:94:12:94:12 | dataTainted4 | result |
@@ -1389,3 +1409,5 @@ subpaths
13891409
| webview.swift:115:10:115:10 | v1 | webview.swift:81:13:81:20 | call to source() : | webview.swift:115:10:115:10 | v1 | result |
13901410
| webview.swift:119:10:119:10 | v2 | webview.swift:81:13:81:20 | call to source() : | webview.swift:119:10:119:10 | v2 | result |
13911411
| webview.swift:123:10:123:10 | v3 | webview.swift:81:13:81:20 | call to source() : | webview.swift:123:10:123:10 | v3 | result |
1412+
| webview.swift:133:10:133:10 | b | webview.swift:132:34:132:41 | call to source() : | webview.swift:133:10:133:10 | b | result |
1413+
| webview.swift:138:10:138:10 | c | webview.swift:137:34:137:41 | call to source() : | webview.swift:138:10:138:10 | c | result |

‎swift/ql/test/library-tests/dataflow/taint/webview.swift

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,11 +130,11 @@ func testWKUserScript() {
130130
sink(a.source)
131131

132132
let b = WKUserScript(source: source() as! String, injectionTime: atStart, forMainFrameOnly: false)
133-
sink(b) // $ MISSING: tainted=132
133+
sink(b) // $ tainted=132
134134
sink(b.source) // $ MISSING: tainted=132
135135

136136
let world = WKContentWorld()
137137
let c = WKUserScript(source: source() as! String, injectionTime: atStart, forMainFrameOnly: false, in: world)
138-
sink(c) // $ MISSING: tainted=137
138+
sink(c) // $ tainted=137
139139
sink(c.source) // $ MISSING: tainted=137
140140
}

0 commit comments

Comments
 (0)