Skip to content

Commit 364c173

Browse files
geoffw0geoffw0
committed
Swift: Accept additional taint flow in UnsafeJsEval test.
1 parent 1f69fff commit 364c173

File tree

1 file changed

+8
-0
lines changed

1 file changed

+8
-0
lines changed

‎swift/ql/test/query-tests/Security/CWE-094/UnsafeJsEval.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ edges
2828
| UnsafeJsEval.swift:208:7:208:39 | ... .+(_:_:) ... : | UnsafeJsEval.swift:285:13:285:13 | string : |
2929
| UnsafeJsEval.swift:208:7:208:39 | ... .+(_:_:) ... : | UnsafeJsEval.swift:299:13:299:13 | string : |
3030
| UnsafeJsEval.swift:211:19:211:41 | call to Data.init(_:) : | UnsafeJsEval.swift:214:7:214:49 | call to String.init(decoding:as:) : |
31+
| UnsafeJsEval.swift:211:19:211:41 | call to Data.init(_:) : | UnsafeJsEval.swift:214:24:214:24 | remoteData : |
3132
| UnsafeJsEval.swift:211:24:211:37 | .utf8 : | UnsafeJsEval.swift:144:5:144:29 | [summary param] 0 in Data.init(_:) : |
3233
| UnsafeJsEval.swift:211:24:211:37 | .utf8 : | UnsafeJsEval.swift:211:19:211:41 | call to Data.init(_:) : |
3334
| UnsafeJsEval.swift:214:7:214:49 | call to String.init(decoding:as:) : | UnsafeJsEval.swift:265:13:265:13 | string : |
@@ -36,6 +37,8 @@ edges
3637
| UnsafeJsEval.swift:214:7:214:49 | call to String.init(decoding:as:) : | UnsafeJsEval.swift:279:13:279:13 | string : |
3738
| UnsafeJsEval.swift:214:7:214:49 | call to String.init(decoding:as:) : | UnsafeJsEval.swift:285:13:285:13 | string : |
3839
| UnsafeJsEval.swift:214:7:214:49 | call to String.init(decoding:as:) : | UnsafeJsEval.swift:299:13:299:13 | string : |
40+
| UnsafeJsEval.swift:214:24:214:24 | remoteData : | UnsafeJsEval.swift:214:7:214:49 | call to String.init(decoding:as:) : |
41+
| UnsafeJsEval.swift:214:24:214:24 | remoteData : | file://:0:0:0:0 | [summary param] 0 in String.init(decoding:as:) : |
3942
| UnsafeJsEval.swift:265:13:265:13 | string : | UnsafeJsEval.swift:266:43:266:43 | string : |
4043
| UnsafeJsEval.swift:266:43:266:43 | string : | UnsafeJsEval.swift:69:2:73:5 | [summary param] 0 in WKUserScript.init(source:injectionTime:forMainFrameOnly:) : |
4144
| UnsafeJsEval.swift:266:43:266:43 | string : | UnsafeJsEval.swift:266:22:266:107 | call to WKUserScript.init(source:injectionTime:forMainFrameOnly:) |
@@ -61,6 +64,7 @@ edges
6164
| UnsafeJsEval.swift:301:31:301:84 | call to JSStringCreateWithUTF8CString(_:) : | UnsafeJsEval.swift:301:16:301:85 | call to JSStringRetain(_:) : |
6265
| UnsafeJsEval.swift:301:31:301:84 | call to JSStringCreateWithUTF8CString(_:) : | UnsafeJsEval.swift:305:17:305:17 | jsstr |
6366
| UnsafeJsEval.swift:318:24:318:87 | call to String.init(contentsOf:) : | UnsafeJsEval.swift:320:44:320:74 | ... .+(_:_:) ... |
67+
| file://:0:0:0:0 | [summary param] 0 in String.init(decoding:as:) : | file://:0:0:0:0 | [summary] to write: return (return) in String.init(decoding:as:) : |
6468
nodes
6569
| UnsafeJsEval.swift:69:2:73:5 | [summary param] 0 in WKUserScript.init(source:injectionTime:forMainFrameOnly:) : | semmle.label | [summary param] 0 in WKUserScript.init(source:injectionTime:forMainFrameOnly:) : |
6670
| UnsafeJsEval.swift:75:2:80:5 | [summary param] 0 in WKUserScript.init(source:injectionTime:forMainFrameOnly:in:) : | semmle.label | [summary param] 0 in WKUserScript.init(source:injectionTime:forMainFrameOnly:in:) : |
@@ -77,6 +81,7 @@ nodes
7781
| UnsafeJsEval.swift:211:19:211:41 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
7882
| UnsafeJsEval.swift:211:24:211:37 | .utf8 : | semmle.label | .utf8 : |
7983
| UnsafeJsEval.swift:214:7:214:49 | call to String.init(decoding:as:) : | semmle.label | call to String.init(decoding:as:) : |
84+
| UnsafeJsEval.swift:214:24:214:24 | remoteData : | semmle.label | remoteData : |
8085
| UnsafeJsEval.swift:265:13:265:13 | string : | semmle.label | string : |
8186
| UnsafeJsEval.swift:266:22:266:107 | call to WKUserScript.init(source:injectionTime:forMainFrameOnly:) | semmle.label | call to WKUserScript.init(source:injectionTime:forMainFrameOnly:) |
8287
| UnsafeJsEval.swift:266:43:266:43 | string : | semmle.label | string : |
@@ -101,11 +106,14 @@ nodes
101106
| UnsafeJsEval.swift:305:17:305:17 | jsstr | semmle.label | jsstr |
102107
| UnsafeJsEval.swift:318:24:318:87 | call to String.init(contentsOf:) : | semmle.label | call to String.init(contentsOf:) : |
103108
| UnsafeJsEval.swift:320:44:320:74 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
109+
| file://:0:0:0:0 | [summary param] 0 in String.init(decoding:as:) : | semmle.label | [summary param] 0 in String.init(decoding:as:) : |
104110
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : |
111+
| file://:0:0:0:0 | [summary] to write: return (return) in String.init(decoding:as:) : | semmle.label | [summary] to write: return (return) in String.init(decoding:as:) : |
105112
| file://:0:0:0:0 | [summary] to write: return (return) in WKUserScript.init(source:injectionTime:forMainFrameOnly:) : | semmle.label | [summary] to write: return (return) in WKUserScript.init(source:injectionTime:forMainFrameOnly:) : |
106113
| file://:0:0:0:0 | [summary] to write: return (return) in WKUserScript.init(source:injectionTime:forMainFrameOnly:in:) : | semmle.label | [summary] to write: return (return) in WKUserScript.init(source:injectionTime:forMainFrameOnly:in:) : |
107114
subpaths
108115
| UnsafeJsEval.swift:211:24:211:37 | .utf8 : | UnsafeJsEval.swift:144:5:144:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | UnsafeJsEval.swift:211:19:211:41 | call to Data.init(_:) : |
116+
| UnsafeJsEval.swift:214:24:214:24 | remoteData : | file://:0:0:0:0 | [summary param] 0 in String.init(decoding:as:) : | file://:0:0:0:0 | [summary] to write: return (return) in String.init(decoding:as:) : | UnsafeJsEval.swift:214:7:214:49 | call to String.init(decoding:as:) : |
109117
| UnsafeJsEval.swift:266:43:266:43 | string : | UnsafeJsEval.swift:69:2:73:5 | [summary param] 0 in WKUserScript.init(source:injectionTime:forMainFrameOnly:) : | file://:0:0:0:0 | [summary] to write: return (return) in WKUserScript.init(source:injectionTime:forMainFrameOnly:) : | UnsafeJsEval.swift:266:22:266:107 | call to WKUserScript.init(source:injectionTime:forMainFrameOnly:) |
110118
| UnsafeJsEval.swift:269:43:269:43 | string : | UnsafeJsEval.swift:75:2:80:5 | [summary param] 0 in WKUserScript.init(source:injectionTime:forMainFrameOnly:in:) : | file://:0:0:0:0 | [summary] to write: return (return) in WKUserScript.init(source:injectionTime:forMainFrameOnly:in:) : | UnsafeJsEval.swift:269:22:269:124 | call to WKUserScript.init(source:injectionTime:forMainFrameOnly:in:) |
111119
| UnsafeJsEval.swift:287:31:287:97 | call to JSStringCreateWithCharacters(_:_:) : | UnsafeJsEval.swift:124:21:124:42 | string : | UnsafeJsEval.swift:124:70:124:70 | string : | UnsafeJsEval.swift:287:16:287:98 | call to JSStringRetain(_:) : |

0 commit comments

Comments
 (0)