Skip to content

Commit 72d6f56

Browse files
geoffw0geoffw0
authored
Merge pull request github#12413 from geoffw0/ptrout2
Swift: Permit data flow from all generic arguments
2 parents bdad847 + 2ed140c commit 72d6f56

File tree

5 files changed

+43
-35
lines changed

5 files changed

+43
-35
lines changed

‎swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -211,9 +211,7 @@ private module Cached {
211211
private predicate modifiable(Argument arg) {
212212
arg.getExpr() instanceof InOutExpr
213213
or
214-
arg.getExpr().getType() instanceof NominalType
215-
or
216-
arg.getExpr().getType() instanceof PointerType
214+
arg.getExpr().getType() instanceof NominalOrBoundGenericNominalType
217215
}
218216

219217
predicate modifiableParam(ParamDecl param) {

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/PointerTypes.qll

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,6 @@
55

66
import swift
77

8-
/**
9-
* A type that is used as a pointer in Swift, such as `UnsafePointer`,
10-
* `UnsafeBufferPointer` and similar types.
11-
*/
12-
class PointerType extends Type {
13-
PointerType() {
14-
this instanceof UnsafeTypedPointerType or
15-
this instanceof UnsafeRawPointerType or
16-
this instanceof OpaquePointerType or
17-
this instanceof AutoreleasingUnsafeMutablePointerType or
18-
this instanceof UnmanagedType or
19-
this instanceof CVaListPointerType or
20-
this instanceof ManagedBufferPointerType
21-
}
22-
}
23-
248
/**
259
* A Swift unsafe typed pointer type such as `UnsafePointer`,
2610
* `UnsafeMutablePointer` or `UnsafeBufferPointer`.

‎swift/ql/test/library-tests/dataflow/taint/libraries/unsafepointer.swift

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,3 +99,31 @@ func testMutatingMyPointerInCall(ptr: MyPointer) {
9999
sink(arg: ptr.pointee) // $ MISSING: tainted=87
100100
sink(arg: ptr)
101101
}
102+
103+
// ---
104+
105+
struct MyPointerContainer {
106+
var ptr: UnsafeMutablePointer<String>
107+
}
108+
109+
struct MyGenericPointerContainer<T> {
110+
var ptr: UnsafeMutablePointer<T>
111+
}
112+
113+
func writePointerContainer(mpc: MyPointerContainer) {
114+
mpc.ptr.pointee = sourceString()
115+
sink(arg: mpc.ptr.pointee) // $ tainted=114
116+
}
117+
118+
func writeGenericPointerContainer<T>(mgpc: MyGenericPointerContainer<T>) {
119+
mgpc.ptr.pointee = sourceString() as! T
120+
sink(arg: mgpc.ptr.pointee) // $ tainted=119
121+
}
122+
123+
func testWritingPointerContainersInCalls(mpc: MyPointerContainer, mgpc: MyGenericPointerContainer<Int>) {
124+
writePointerContainer(mpc: mpc)
125+
sink(arg: mpc.ptr.pointee) // $ tainted=114
126+
127+
writeGenericPointerContainer(mgpc: mgpc)
128+
sink(arg: mgpc.ptr.pointee) // $ tainted=119
129+
}

‎swift/ql/test/library-tests/elements/type/pointertypes/pointertypes.expected

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
1-
| pointers.swift:2:8:2:8 | self | AutoreleasingUnsafeMutablePointer<Pointee> | AutoreleasingUnsafeMutablePointerType, PointerType |
2-
| pointers.swift:14:6:14:6 | p1 | UnsafePointer<Int> | PointerType, UnsafeTypedPointerType |
3-
| pointers.swift:15:6:15:6 | p2 | UnsafeMutablePointer<UInt8> | PointerType, UnsafeTypedPointerType |
4-
| pointers.swift:16:6:16:6 | p3 | UnsafeBufferPointer<String> | PointerType, UnsafeTypedPointerType |
5-
| pointers.swift:17:6:17:6 | p4 | UnsafeMutableBufferPointer<MyClass> | PointerType, UnsafeTypedPointerType |
6-
| pointers.swift:18:6:18:6 | p5 | UnsafeRawPointer | PointerType, UnsafeRawPointerType |
7-
| pointers.swift:19:6:19:6 | p6 | UnsafeMutableRawPointer | PointerType, UnsafeRawPointerType |
8-
| pointers.swift:20:6:20:6 | p7 | UnsafeRawBufferPointer | PointerType, UnsafeRawPointerType |
9-
| pointers.swift:21:6:21:6 | p8 | UnsafeMutableRawBufferPointer | PointerType, UnsafeRawPointerType |
10-
| pointers.swift:23:6:23:6 | op | OpaquePointer | OpaquePointerType, PointerType |
11-
| pointers.swift:24:6:24:6 | aump | AutoreleasingUnsafeMutablePointer<UInt8> | AutoreleasingUnsafeMutablePointerType, PointerType |
12-
| pointers.swift:25:6:25:6 | um | Unmanaged<MyClass> | PointerType, UnmanagedType |
13-
| pointers.swift:26:6:26:6 | cvlp | CVaListPointer | CVaListPointerType, PointerType |
14-
| pointers.swift:28:6:28:6 | mbp | ManagedBufferPointer<Int, MyClass> | ManagedBufferPointerType, PointerType |
1+
| pointers.swift:2:8:2:8 | self | AutoreleasingUnsafeMutablePointer<Pointee> | AutoreleasingUnsafeMutablePointerType |
2+
| pointers.swift:14:6:14:6 | p1 | UnsafePointer<Int> | UnsafeTypedPointerType |
3+
| pointers.swift:15:6:15:6 | p2 | UnsafeMutablePointer<UInt8> | UnsafeTypedPointerType |
4+
| pointers.swift:16:6:16:6 | p3 | UnsafeBufferPointer<String> | UnsafeTypedPointerType |
5+
| pointers.swift:17:6:17:6 | p4 | UnsafeMutableBufferPointer<MyClass> | UnsafeTypedPointerType |
6+
| pointers.swift:18:6:18:6 | p5 | UnsafeRawPointer | UnsafeRawPointerType |
7+
| pointers.swift:19:6:19:6 | p6 | UnsafeMutableRawPointer | UnsafeRawPointerType |
8+
| pointers.swift:20:6:20:6 | p7 | UnsafeRawBufferPointer | UnsafeRawPointerType |
9+
| pointers.swift:21:6:21:6 | p8 | UnsafeMutableRawBufferPointer | UnsafeRawPointerType |
10+
| pointers.swift:23:6:23:6 | op | OpaquePointer | OpaquePointerType |
11+
| pointers.swift:24:6:24:6 | aump | AutoreleasingUnsafeMutablePointer<UInt8> | AutoreleasingUnsafeMutablePointerType |
12+
| pointers.swift:25:6:25:6 | um | Unmanaged<MyClass> | UnmanagedType |
13+
| pointers.swift:26:6:26:6 | cvlp | CVaListPointer | CVaListPointerType |
14+
| pointers.swift:28:6:28:6 | mbp | ManagedBufferPointer<Int, MyClass> | ManagedBufferPointerType |

‎swift/ql/test/library-tests/elements/type/pointertypes/pointertypes.ql

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@ import swift
22
import codeql.swift.frameworks.StandardLibrary.PointerTypes
33

44
string describe(Type t) {
5-
t instanceof PointerType and result = "PointerType"
6-
or
75
t instanceof BuiltinRawPointerType and result = "BuiltinRawPointerType"
86
or
97
t instanceof UnsafeTypedPointerType and result = "UnsafeTypedPointerType"

0 commit comments

Comments
 (0)