Skip to content

Commit 697c3df

Browse files
geoffw0geoffw0
committed
Swift: Model C printf variants.
1 parent 1040561 commit 697c3df

File tree

3 files changed

+33
-4
lines changed

3 files changed

+33
-4
lines changed

‎swift/ql/lib/codeql/swift/StringFormat.qll

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,16 @@ class NsExceptionRaise extends FormattingFunction, Method {
8585

8686
override int getFormatParameterIndex() { result = 1 }
8787
}
88+
89+
/**
90+
* A function that appears to be an imported C `printf` variant.
91+
*/
92+
class PrintfFormat extends FormattingFunction, FreeFunction {
93+
int formatParamIndex;
94+
95+
PrintfFormat() {
96+
this.getShortName().matches("%printf%") and this.getParam(formatParamIndex).getName() = "format"
97+
}
98+
99+
override int getFormatParameterIndex() { result = formatParamIndex }
100+
}

‎swift/ql/test/query-tests/Security/CWE-134/UncontrolledFormatString.expected

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,18 @@ edges
1919
| UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:118:61:118:61 | tainted |
2020
| UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:130:39:130:39 | tainted |
2121
| UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:135:37:135:37 | tainted |
22+
| UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:139:5:139:5 | tainted |
2223
| UncontrolledFormatString.swift:108:43:108:43 | tainted | UncontrolledFormatString.swift:108:26:108:50 | call to NSString.init(string:) |
2324
| UncontrolledFormatString.swift:109:57:109:57 | tainted | UncontrolledFormatString.swift:109:40:109:64 | call to NSString.init(string:) |
2425
| UncontrolledFormatString.swift:111:50:111:50 | tainted | UncontrolledFormatString.swift:111:33:111:57 | call to NSString.init(string:) |
2526
| UncontrolledFormatString.swift:112:64:112:64 | tainted | UncontrolledFormatString.swift:112:47:112:71 | call to NSString.init(string:) |
2627
| UncontrolledFormatString.swift:116:11:116:11 | tainted | UncontrolledFormatString.swift:77:12:77:22 | format |
2728
| UncontrolledFormatString.swift:135:37:135:37 | tainted | UncontrolledFormatString.swift:135:20:135:44 | call to NSString.init(string:) |
29+
| UncontrolledFormatString.swift:139:5:139:5 | tainted | UncontrolledFormatString.swift:140:9:140:9 | cstr [Collection element] |
30+
| UncontrolledFormatString.swift:140:9:140:9 | cstr [Collection element] | UncontrolledFormatString.swift:141:24:141:24 | cstr |
31+
| UncontrolledFormatString.swift:140:9:140:9 | cstr [Collection element] | UncontrolledFormatString.swift:143:21:143:21 | cstr |
32+
| UncontrolledFormatString.swift:140:9:140:9 | cstr [Collection element] | UncontrolledFormatString.swift:145:27:145:27 | cstr |
33+
| UncontrolledFormatString.swift:140:9:140:9 | cstr [Collection element] | UncontrolledFormatString.swift:147:35:147:35 | cstr |
2834
nodes
2935
| UncontrolledFormatString.swift:77:12:77:22 | format | semmle.label | format |
3036
| UncontrolledFormatString.swift:78:22:80:5 | format | semmle.label | format |
@@ -53,6 +59,12 @@ nodes
5359
| UncontrolledFormatString.swift:130:39:130:39 | tainted | semmle.label | tainted |
5460
| UncontrolledFormatString.swift:135:20:135:44 | call to NSString.init(string:) | semmle.label | call to NSString.init(string:) |
5561
| UncontrolledFormatString.swift:135:37:135:37 | tainted | semmle.label | tainted |
62+
| UncontrolledFormatString.swift:139:5:139:5 | tainted | semmle.label | tainted |
63+
| UncontrolledFormatString.swift:140:9:140:9 | cstr [Collection element] | semmle.label | cstr [Collection element] |
64+
| UncontrolledFormatString.swift:141:24:141:24 | cstr | semmle.label | cstr |
65+
| UncontrolledFormatString.swift:143:21:143:21 | cstr | semmle.label | cstr |
66+
| UncontrolledFormatString.swift:145:27:145:27 | cstr | semmle.label | cstr |
67+
| UncontrolledFormatString.swift:147:35:147:35 | cstr | semmle.label | cstr |
5668
subpaths
5769
#select
5870
| UncontrolledFormatString.swift:79:16:79:16 | format | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:79:16:79:16 | format | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
@@ -71,3 +83,7 @@ subpaths
7183
| UncontrolledFormatString.swift:118:61:118:61 | tainted | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:118:61:118:61 | tainted | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
7284
| UncontrolledFormatString.swift:130:39:130:39 | tainted | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:130:39:130:39 | tainted | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
7385
| UncontrolledFormatString.swift:135:20:135:44 | call to NSString.init(string:) | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:135:20:135:44 | call to NSString.init(string:) | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
86+
| UncontrolledFormatString.swift:141:24:141:24 | cstr | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:141:24:141:24 | cstr | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
87+
| UncontrolledFormatString.swift:143:21:143:21 | cstr | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:143:21:143:21 | cstr | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
88+
| UncontrolledFormatString.swift:145:27:145:27 | cstr | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:145:27:145:27 | cstr | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
89+
| UncontrolledFormatString.swift:147:35:147:35 | cstr | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:147:35:147:35 | cstr | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |

‎swift/ql/test/query-tests/Security/CWE-134/UncontrolledFormatString.swift

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -138,13 +138,13 @@ func tests() throws {
138138

139139
tainted.withCString({
140140
cstr in
141-
_ = dprintf(0, cstr, "abc") // BAD [NOT DETECTED]
141+
_ = dprintf(0, cstr, "abc") // BAD
142142
_ = dprintf(0, "%s", cstr) // GOOD: format not tainted
143-
_ = vprintf(cstr, getVaList(["abc"])) // BAD [NOT DETECTED]
143+
_ = vprintf(cstr, getVaList(["abc"])) // BAD
144144
_ = vprintf("%s", getVaList([cstr])) // GOOD: format not tainted
145-
_ = vfprintf(nil, cstr, getVaList(["abc"])) // BAD [NOT DETECTED]
145+
_ = vfprintf(nil, cstr, getVaList(["abc"])) // BAD
146146
_ = vfprintf(nil, "%s", getVaList([cstr])) // GOOD: format not tainted
147-
_ = vasprintf_l(nil, nil, cstr, getVaList(["abc"])) // BAD [NOT DETECTED]
147+
_ = vasprintf_l(nil, nil, cstr, getVaList(["abc"])) // BAD
148148
_ = vasprintf_l(nil, nil, "%s", getVaList([cstr])) // GOOD: format not tainted
149149
})
150150

0 commit comments

Comments
 (0)