Skip to content

Commit 2d88930

Browse files
geoffw0geoffw0
committed
Swift: Some cases in the SqlInjection test are fixed by this.
1 parent 6e30409 commit 2d88930

File tree

2 files changed

+30
-3
lines changed

2 files changed

+30
-3
lines changed

‎swift/ql/test/query-tests/Security/CWE-089/SqlInjection.expected

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,12 +97,23 @@ edges
9797
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) : | SQLite.swift:117:16:117:16 | unsafeQuery1 |
9898
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) : | SQLite.swift:119:16:119:16 | unsafeQuery1 |
9999
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) : | SQLite.swift:132:20:132:20 | remoteString |
100+
| sqlite3_c_api.swift:15:2:15:71 | [summary param] this in copyBytes(to:count:) : | file://:0:0:0:0 | [summary] to write: argument 0 in copyBytes(to:count:) : |
101+
| sqlite3_c_api.swift:37:2:37:103 | [summary param] this in data(using:allowLossyConversion:) : | file://:0:0:0:0 | [summary] to write: return (return) in data(using:allowLossyConversion:) : |
100102
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:133:33:133:33 | unsafeQuery1 |
101103
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:134:33:134:33 | unsafeQuery2 |
102104
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:135:33:135:33 | unsafeQuery3 |
103105
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:145:26:145:26 | unsafeQuery3 |
104106
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:175:29:175:29 | unsafeQuery3 |
105107
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:183:29:183:29 | unsafeQuery3 |
108+
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:189:13:189:13 | unsafeQuery3 : |
109+
| sqlite3_c_api.swift:189:13:189:13 | unsafeQuery3 : | sqlite3_c_api.swift:37:2:37:103 | [summary param] this in data(using:allowLossyConversion:) : |
110+
| sqlite3_c_api.swift:189:13:189:13 | unsafeQuery3 : | sqlite3_c_api.swift:189:13:189:58 | call to data(using:allowLossyConversion:) : |
111+
| sqlite3_c_api.swift:189:13:189:58 | call to data(using:allowLossyConversion:) : | sqlite3_c_api.swift:190:2:190:2 | data : |
112+
| sqlite3_c_api.swift:190:2:190:2 | data : | sqlite3_c_api.swift:15:2:15:71 | [summary param] this in copyBytes(to:count:) : |
113+
| sqlite3_c_api.swift:190:2:190:2 | data : | sqlite3_c_api.swift:190:21:190:21 | [post] buffer : |
114+
| sqlite3_c_api.swift:190:21:190:21 | [post] buffer : | sqlite3_c_api.swift:194:28:194:28 | buffer |
115+
| sqlite3_c_api.swift:190:21:190:21 | [post] buffer : | sqlite3_c_api.swift:202:31:202:31 | buffer |
116+
| sqlite3_c_api.swift:190:21:190:21 | [post] buffer : | sqlite3_c_api.swift:210:31:210:31 | buffer |
106117
nodes
107118
| GRDB.swift:104:25:104:79 | call to String.init(contentsOf:) : | semmle.label | call to String.init(contentsOf:) : |
108119
| GRDB.swift:106:41:106:41 | remoteString | semmle.label | remoteString |
@@ -215,14 +226,27 @@ nodes
215226
| SQLite.swift:117:16:117:16 | unsafeQuery1 | semmle.label | unsafeQuery1 |
216227
| SQLite.swift:119:16:119:16 | unsafeQuery1 | semmle.label | unsafeQuery1 |
217228
| SQLite.swift:132:20:132:20 | remoteString | semmle.label | remoteString |
229+
| file://:0:0:0:0 | [summary] to write: argument 0 in copyBytes(to:count:) : | semmle.label | [summary] to write: argument 0 in copyBytes(to:count:) : |
230+
| file://:0:0:0:0 | [summary] to write: return (return) in data(using:allowLossyConversion:) : | semmle.label | [summary] to write: return (return) in data(using:allowLossyConversion:) : |
231+
| sqlite3_c_api.swift:15:2:15:71 | [summary param] this in copyBytes(to:count:) : | semmle.label | [summary param] this in copyBytes(to:count:) : |
232+
| sqlite3_c_api.swift:37:2:37:103 | [summary param] this in data(using:allowLossyConversion:) : | semmle.label | [summary param] this in data(using:allowLossyConversion:) : |
218233
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | semmle.label | call to String.init(contentsOf:) : |
219234
| sqlite3_c_api.swift:133:33:133:33 | unsafeQuery1 | semmle.label | unsafeQuery1 |
220235
| sqlite3_c_api.swift:134:33:134:33 | unsafeQuery2 | semmle.label | unsafeQuery2 |
221236
| sqlite3_c_api.swift:135:33:135:33 | unsafeQuery3 | semmle.label | unsafeQuery3 |
222237
| sqlite3_c_api.swift:145:26:145:26 | unsafeQuery3 | semmle.label | unsafeQuery3 |
223238
| sqlite3_c_api.swift:175:29:175:29 | unsafeQuery3 | semmle.label | unsafeQuery3 |
224239
| sqlite3_c_api.swift:183:29:183:29 | unsafeQuery3 | semmle.label | unsafeQuery3 |
240+
| sqlite3_c_api.swift:189:13:189:13 | unsafeQuery3 : | semmle.label | unsafeQuery3 : |
241+
| sqlite3_c_api.swift:189:13:189:58 | call to data(using:allowLossyConversion:) : | semmle.label | call to data(using:allowLossyConversion:) : |
242+
| sqlite3_c_api.swift:190:2:190:2 | data : | semmle.label | data : |
243+
| sqlite3_c_api.swift:190:21:190:21 | [post] buffer : | semmle.label | [post] buffer : |
244+
| sqlite3_c_api.swift:194:28:194:28 | buffer | semmle.label | buffer |
245+
| sqlite3_c_api.swift:202:31:202:31 | buffer | semmle.label | buffer |
246+
| sqlite3_c_api.swift:210:31:210:31 | buffer | semmle.label | buffer |
225247
subpaths
248+
| sqlite3_c_api.swift:189:13:189:13 | unsafeQuery3 : | sqlite3_c_api.swift:37:2:37:103 | [summary param] this in data(using:allowLossyConversion:) : | file://:0:0:0:0 | [summary] to write: return (return) in data(using:allowLossyConversion:) : | sqlite3_c_api.swift:189:13:189:58 | call to data(using:allowLossyConversion:) : |
249+
| sqlite3_c_api.swift:190:2:190:2 | data : | sqlite3_c_api.swift:15:2:15:71 | [summary param] this in copyBytes(to:count:) : | file://:0:0:0:0 | [summary] to write: argument 0 in copyBytes(to:count:) : | sqlite3_c_api.swift:190:21:190:21 | [post] buffer : |
226250
#select
227251
| GRDB.swift:106:41:106:41 | remoteString | GRDB.swift:104:25:104:79 | call to String.init(contentsOf:) : | GRDB.swift:106:41:106:41 | remoteString | This query depends on a $@. | GRDB.swift:104:25:104:79 | call to String.init(contentsOf:) | user-provided value |
228252
| GRDB.swift:108:41:108:41 | remoteString | GRDB.swift:104:25:104:79 | call to String.init(contentsOf:) : | GRDB.swift:108:41:108:41 | remoteString | This query depends on a $@. | GRDB.swift:104:25:104:79 | call to String.init(contentsOf:) | user-provided value |
@@ -328,3 +352,6 @@ subpaths
328352
| sqlite3_c_api.swift:145:26:145:26 | unsafeQuery3 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:145:26:145:26 | unsafeQuery3 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
329353
| sqlite3_c_api.swift:175:29:175:29 | unsafeQuery3 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:175:29:175:29 | unsafeQuery3 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
330354
| sqlite3_c_api.swift:183:29:183:29 | unsafeQuery3 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:183:29:183:29 | unsafeQuery3 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
355+
| sqlite3_c_api.swift:194:28:194:28 | buffer | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:194:28:194:28 | buffer | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
356+
| sqlite3_c_api.swift:202:31:202:31 | buffer | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:202:31:202:31 | buffer | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
357+
| sqlite3_c_api.swift:210:31:210:31 | buffer | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) : | sqlite3_c_api.swift:210:31:210:31 | buffer | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |

‎swift/ql/test/query-tests/Security/CWE-089/sqlite3_c_api.swift

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -191,23 +191,23 @@ func test_sqlite3_c_api(db: OpaquePointer?, buffer: UnsafeMutablePointer<UInt8>)
191191

192192
var stmt6: OpaquePointer?
193193

194-
if (sqlite3_prepare16(db, buffer, Int32(data.count), &stmt6, nil) == SQLITE_OK) { // BAD [NOT DETECTED]
194+
if (sqlite3_prepare16(db, buffer, Int32(data.count), &stmt6, nil) == SQLITE_OK) { // BAD
195195
let result = sqlite3_step(stmt6)
196196
// ...
197197
}
198198
sqlite3_finalize(stmt6)
199199

200200
var stmt7: OpaquePointer?
201201

202-
if (sqlite3_prepare16_v2(db, buffer, Int32(data.count), &stmt7, nil) == SQLITE_OK) { // BAD [NOT DETECTED]
202+
if (sqlite3_prepare16_v2(db, buffer, Int32(data.count), &stmt7, nil) == SQLITE_OK) { // BAD
203203
let result = sqlite3_step(stmt7)
204204
// ...
205205
}
206206
sqlite3_finalize(stmt7)
207207

208208
var stmt8: OpaquePointer?
209209

210-
if (sqlite3_prepare16_v3(db, buffer, Int32(data.count), 0, &stmt8, nil) == SQLITE_OK) { // BAD [NOT DETECTED]
210+
if (sqlite3_prepare16_v3(db, buffer, Int32(data.count), 0, &stmt8, nil) == SQLITE_OK) { // BAD
211211
let result = sqlite3_step(stmt8)
212212
// ...
213213
}

0 commit comments

Comments
 (0)