Skip to content

Commit 82f9903

Browse files
geoffw0geoffw0
committed
Swift: Additional test cases for swift/cleartext-storage-database on Core Data.
1 parent c8f35ea commit 82f9903

File tree

2 files changed

+95
-0
lines changed

2 files changed

+95
-0
lines changed

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,34 @@
88
| testAlamofire.swift:195:64:195:64 | password | label:password, type:credential |
99
| testAlamofire.swift:205:62:205:62 | password | label:password, type:credential |
1010
| testAlamofire.swift:213:65:213:65 | password | label:password, type:credential |
11+
| testCoreData2.swift:37:16:37:16 | bankAccountNo | label:bankAccountNo, type:private information |
12+
| testCoreData2.swift:38:2:38:6 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
13+
| testCoreData2.swift:39:2:39:6 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
14+
| testCoreData2.swift:39:28:39:28 | bankAccountNo | label:bankAccountNo, type:private information |
15+
| testCoreData2.swift:40:2:40:6 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:private information |
16+
| testCoreData2.swift:41:2:41:6 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:private information |
17+
| testCoreData2.swift:41:29:41:29 | bankAccountNo | label:bankAccountNo, type:private information |
18+
| testCoreData2.swift:42:2:42:6 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:private information |
19+
| testCoreData2.swift:43:2:43:6 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:private information |
20+
| testCoreData2.swift:43:35:43:35 | bankAccountNo | label:bankAccountNo, type:private information |
21+
| testCoreData2.swift:46:22:46:22 | bankAccountNo | label:bankAccountNo, type:private information |
22+
| testCoreData2.swift:47:2:47:12 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
23+
| testCoreData2.swift:48:2:48:12 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
24+
| testCoreData2.swift:48:34:48:34 | bankAccountNo | label:bankAccountNo, type:private information |
25+
| testCoreData2.swift:49:2:49:12 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:private information |
26+
| testCoreData2.swift:50:2:50:12 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:private information |
27+
| testCoreData2.swift:50:35:50:35 | bankAccountNo | label:bankAccountNo, type:private information |
28+
| testCoreData2.swift:51:2:51:12 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:private information |
29+
| testCoreData2.swift:52:2:52:12 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:private information |
30+
| testCoreData2.swift:52:41:52:41 | bankAccountNo | label:bankAccountNo, type:private information |
31+
| testCoreData2.swift:57:3:57:7 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
32+
| testCoreData2.swift:57:29:57:29 | bankAccountNo | label:bankAccountNo, type:private information |
33+
| testCoreData2.swift:60:4:60:8 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
34+
| testCoreData2.swift:60:30:60:30 | bankAccountNo | label:bankAccountNo, type:private information |
35+
| testCoreData2.swift:62:4:62:8 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
36+
| testCoreData2.swift:62:30:62:30 | bankAccountNo | label:bankAccountNo, type:private information |
37+
| testCoreData2.swift:65:3:65:7 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
38+
| testCoreData2.swift:65:29:65:29 | bankAccountNo | label:bankAccountNo, type:private information |
1139
| testCoreData.swift:48:15:48:15 | password | label:password, type:credential |
1240
| testCoreData.swift:51:24:51:24 | password | label:password, type:credential |
1341
| testCoreData.swift:58:15:58:15 | password | label:password, type:credential |

‎swift/ql/test/query-tests/Security/CWE-311/testCoreData2.swift

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
2+
// --- stubs ---
3+
4+
class NSObject
5+
{
6+
}
7+
8+
@propertyWrapper
9+
struct NSManaged { // note: this may not be an accurate stub for `NSManaged`.
10+
var wrappedValue: Any {
11+
didSet {}
12+
}
13+
}
14+
15+
class NSManagedObject : NSObject
16+
{
17+
}
18+
19+
class MyManagedObject2 : NSManagedObject
20+
{
21+
@NSManaged public var myValue: Int
22+
@NSManaged public var myBankAccountNumber : Int
23+
public var notStoredBankAccountNumber: Int = 0
24+
}
25+
26+
extension MyManagedObject2
27+
{
28+
@NSManaged public var myBankAccountNumber2 : Int
29+
}
30+
31+
// --- tests ---
32+
33+
func testCoreData2_1(obj: MyManagedObject2, maybeObj: MyManagedObject2?, value: Int, bankAccountNo: Int)
34+
{
35+
// @NSManaged fields of an NSManagedObject...
36+
obj.myValue = value // GOOD (not sensitive)
37+
obj.myValue = bankAccountNo // BAD [NOT DETECTED]
38+
obj.myBankAccountNumber = value // BAD [NOT DETECTED]
39+
obj.myBankAccountNumber = bankAccountNo // BAD [NOT DETECTED]
40+
obj.myBankAccountNumber2 = value // BAD [NOT DETECTED]
41+
obj.myBankAccountNumber2 = bankAccountNo // BAD [NOT DETECTED]
42+
obj.notStoredBankAccountNumber = value // GOOD (not stored in the database)
43+
obj.notStoredBankAccountNumber = bankAccountNo // GOOD (not stored in the datbase)
44+
45+
maybeObj?.myValue = value // GOOD (not sensitive)
46+
maybeObj?.myValue = bankAccountNo // BAD [NOT DETECTED]
47+
maybeObj?.myBankAccountNumber = value // BAD [NOT DETECTED]
48+
maybeObj?.myBankAccountNumber = bankAccountNo // BAD [NOT DETECTED]
49+
maybeObj?.myBankAccountNumber2 = value // BAD [NOT DETECTED]
50+
maybeObj?.myBankAccountNumber2 = bankAccountNo // BAD [NOT DETECTED]
51+
maybeObj?.notStoredBankAccountNumber = value // GOOD (not stored in the database)
52+
maybeObj?.notStoredBankAccountNumber = bankAccountNo // GOOD (not stored in the datbase)
53+
}
54+
55+
class testCoreData2_2 {
56+
func myFunc(obj: MyManagedObject2, bankAccountNo: Int) {
57+
obj.myBankAccountNumber = bankAccountNo // BAD [NOT DETECTED]
58+
59+
if #available(iOS 10.0, *) {
60+
obj.myBankAccountNumber = bankAccountNo // BAD [NOT DETECTED]
61+
} else {
62+
obj.myBankAccountNumber = bankAccountNo // BAD [NOT DETECTED]
63+
}
64+
65+
obj.myBankAccountNumber = bankAccountNo // BAD [NOT DETECTED]
66+
}
67+
}

0 commit comments

Comments
 (0)