Skip to content

Commit 9b117fe

Browse files
geoffw0geoffw0
committed
Swift: Generalize the arithmetic we allow taint through.
1 parent 87c0b61 commit 9b117fe

File tree

4 files changed

+78
-17
lines changed

4 files changed

+78
-17
lines changed

‎swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,8 @@ private module Cached {
4343
nodeFrom.asExpr() = interpolated.getAppendingExpr()
4444
)
4545
or
46-
// allow flow through string concatenation.
47-
exists(AddExpr ae |
48-
ae.getAnOperand() = nodeFrom.asExpr() and
49-
ae = nodeTo.asExpr() and
50-
ae.getType().getName() = "String"
51-
)
46+
// allow flow through arithmetic (this case includes string concatenation)
47+
nodeTo.asExpr().(ArithmeticOperation).getAnOperand() = nodeFrom.asExpr()
5248
or
5349
// flow through a subscript access
5450
exists(SubscriptExpr se |

‎swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -557,6 +557,27 @@
557557
| nsmutabledata.swift:48:9:48:9 | SSA def(nsMutableDataTainted6) | nsmutabledata.swift:49:15:49:15 | nsMutableDataTainted6 |
558558
| nsmutabledata.swift:48:33:48:40 | call to source() | nsmutabledata.swift:48:9:48:9 | SSA def(nsMutableDataTainted6) |
559559
| nsmutabledata.swift:49:15:49:15 | nsMutableDataTainted6 | nsmutabledata.swift:49:15:49:37 | .mutableBytes |
560+
| simple.swift:12:13:12:13 | 1 | simple.swift:12:13:12:24 | ... .+(_:_:) ... |
561+
| simple.swift:12:17:12:24 | call to source() | simple.swift:12:13:12:24 | ... .+(_:_:) ... |
562+
| simple.swift:13:13:13:20 | call to source() | simple.swift:13:13:13:24 | ... .+(_:_:) ... |
563+
| simple.swift:13:24:13:24 | 1 | simple.swift:13:13:13:24 | ... .+(_:_:) ... |
564+
| simple.swift:14:13:14:13 | 1 | simple.swift:14:13:14:24 | ... .-(_:_:) ... |
565+
| simple.swift:14:17:14:24 | call to source() | simple.swift:14:13:14:24 | ... .-(_:_:) ... |
566+
| simple.swift:15:13:15:20 | call to source() | simple.swift:15:13:15:24 | ... .-(_:_:) ... |
567+
| simple.swift:15:24:15:24 | 1 | simple.swift:15:13:15:24 | ... .-(_:_:) ... |
568+
| simple.swift:16:13:16:13 | 2 | simple.swift:16:13:16:24 | ... .*(_:_:) ... |
569+
| simple.swift:16:17:16:24 | call to source() | simple.swift:16:13:16:24 | ... .*(_:_:) ... |
570+
| simple.swift:17:13:17:20 | call to source() | simple.swift:17:13:17:24 | ... .*(_:_:) ... |
571+
| simple.swift:17:24:17:24 | 2 | simple.swift:17:13:17:24 | ... .*(_:_:) ... |
572+
| simple.swift:18:13:18:13 | 100 | simple.swift:18:13:18:26 | ... ./(_:_:) ... |
573+
| simple.swift:18:19:18:26 | call to source() | simple.swift:18:13:18:26 | ... ./(_:_:) ... |
574+
| simple.swift:19:13:19:20 | call to source() | simple.swift:19:13:19:24 | ... ./(_:_:) ... |
575+
| simple.swift:19:24:19:24 | 100 | simple.swift:19:13:19:24 | ... ./(_:_:) ... |
576+
| simple.swift:20:13:20:13 | 100 | simple.swift:20:13:20:26 | ... .%(_:_:) ... |
577+
| simple.swift:20:19:20:26 | call to source() | simple.swift:20:13:20:26 | ... .%(_:_:) ... |
578+
| simple.swift:21:13:21:20 | call to source() | simple.swift:21:13:21:24 | ... .%(_:_:) ... |
579+
| simple.swift:21:24:21:24 | 100 | simple.swift:21:13:21:24 | ... .%(_:_:) ... |
580+
| simple.swift:23:14:23:21 | call to source() | simple.swift:23:13:23:21 | call to -(_:) |
560581
| simple.swift:36:7:36:7 | SSA def(a) | simple.swift:37:13:37:13 | a |
561582
| simple.swift:36:11:36:11 | 0 | simple.swift:36:7:36:7 | SSA def(a) |
562583
| simple.swift:37:13:37:13 | [post] a | simple.swift:38:3:38:3 | a |

‎swift/ql/test/library-tests/dataflow/taint/Taint.expected

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -331,6 +331,17 @@ edges
331331
| nsmutabledata.swift:48:33:48:40 | call to source() : | nsmutabledata.swift:49:15:49:37 | .mutableBytes |
332332
| nsmutabledata.swift:49:15:49:15 | nsMutableDataTainted6 : | nsmutabledata.swift:13:9:13:9 | self : |
333333
| nsmutabledata.swift:49:15:49:15 | nsMutableDataTainted6 : | nsmutabledata.swift:49:15:49:37 | .mutableBytes |
334+
| simple.swift:12:17:12:24 | call to source() : | simple.swift:12:13:12:24 | ... .+(_:_:) ... |
335+
| simple.swift:13:13:13:20 | call to source() : | simple.swift:13:13:13:24 | ... .+(_:_:) ... |
336+
| simple.swift:14:17:14:24 | call to source() : | simple.swift:14:13:14:24 | ... .-(_:_:) ... |
337+
| simple.swift:15:13:15:20 | call to source() : | simple.swift:15:13:15:24 | ... .-(_:_:) ... |
338+
| simple.swift:16:17:16:24 | call to source() : | simple.swift:16:13:16:24 | ... .*(_:_:) ... |
339+
| simple.swift:17:13:17:20 | call to source() : | simple.swift:17:13:17:24 | ... .*(_:_:) ... |
340+
| simple.swift:18:19:18:26 | call to source() : | simple.swift:18:13:18:26 | ... ./(_:_:) ... |
341+
| simple.swift:19:13:19:20 | call to source() : | simple.swift:19:13:19:24 | ... ./(_:_:) ... |
342+
| simple.swift:20:19:20:26 | call to source() : | simple.swift:20:13:20:26 | ... .%(_:_:) ... |
343+
| simple.swift:21:13:21:20 | call to source() : | simple.swift:21:13:21:24 | ... .%(_:_:) ... |
344+
| simple.swift:23:14:23:21 | call to source() : | simple.swift:23:13:23:21 | call to -(_:) |
334345
| string.swift:60:2:60:54 | [summary param] 0 in String.init(data:encoding:) : | file://:0:0:0:0 | [summary] to write: return (return) in String.init(data:encoding:) : |
335346
| string.swift:64:3:64:63 | [summary param] 0 in String.init(format:_:) : | file://:0:0:0:0 | [summary] to write: return (return) in String.init(format:_:) : |
336347
| string.swift:65:3:65:60 | [summary param] 0 in String.init(format:arguments:) : | file://:0:0:0:0 | [summary] to write: return (return) in String.init(format:arguments:) : |
@@ -1370,6 +1381,28 @@ nodes
13701381
| nsmutabledata.swift:48:33:48:40 | call to source() : | semmle.label | call to source() : |
13711382
| nsmutabledata.swift:49:15:49:15 | nsMutableDataTainted6 : | semmle.label | nsMutableDataTainted6 : |
13721383
| nsmutabledata.swift:49:15:49:37 | .mutableBytes | semmle.label | .mutableBytes |
1384+
| simple.swift:12:13:12:24 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
1385+
| simple.swift:12:17:12:24 | call to source() : | semmle.label | call to source() : |
1386+
| simple.swift:13:13:13:20 | call to source() : | semmle.label | call to source() : |
1387+
| simple.swift:13:13:13:24 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
1388+
| simple.swift:14:13:14:24 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
1389+
| simple.swift:14:17:14:24 | call to source() : | semmle.label | call to source() : |
1390+
| simple.swift:15:13:15:20 | call to source() : | semmle.label | call to source() : |
1391+
| simple.swift:15:13:15:24 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
1392+
| simple.swift:16:13:16:24 | ... .*(_:_:) ... | semmle.label | ... .*(_:_:) ... |
1393+
| simple.swift:16:17:16:24 | call to source() : | semmle.label | call to source() : |
1394+
| simple.swift:17:13:17:20 | call to source() : | semmle.label | call to source() : |
1395+
| simple.swift:17:13:17:24 | ... .*(_:_:) ... | semmle.label | ... .*(_:_:) ... |
1396+
| simple.swift:18:13:18:26 | ... ./(_:_:) ... | semmle.label | ... ./(_:_:) ... |
1397+
| simple.swift:18:19:18:26 | call to source() : | semmle.label | call to source() : |
1398+
| simple.swift:19:13:19:20 | call to source() : | semmle.label | call to source() : |
1399+
| simple.swift:19:13:19:24 | ... ./(_:_:) ... | semmle.label | ... ./(_:_:) ... |
1400+
| simple.swift:20:13:20:26 | ... .%(_:_:) ... | semmle.label | ... .%(_:_:) ... |
1401+
| simple.swift:20:19:20:26 | call to source() : | semmle.label | call to source() : |
1402+
| simple.swift:21:13:21:20 | call to source() : | semmle.label | call to source() : |
1403+
| simple.swift:21:13:21:24 | ... .%(_:_:) ... | semmle.label | ... .%(_:_:) ... |
1404+
| simple.swift:23:13:23:21 | call to -(_:) | semmle.label | call to -(_:) |
1405+
| simple.swift:23:14:23:21 | call to source() : | semmle.label | call to source() : |
13731406
| string.swift:60:2:60:54 | [summary param] 0 in String.init(data:encoding:) : | semmle.label | [summary param] 0 in String.init(data:encoding:) : |
13741407
| string.swift:64:3:64:63 | [summary param] 0 in String.init(format:_:) : | semmle.label | [summary param] 0 in String.init(format:_:) : |
13751408
| string.swift:65:3:65:60 | [summary param] 0 in String.init(format:arguments:) : | semmle.label | [summary param] 0 in String.init(format:arguments:) : |
@@ -2084,6 +2117,17 @@ subpaths
20842117
| nsmutabledata.swift:41:15:41:15 | nsMutableDataTainted4 | nsmutabledata.swift:40:66:40:73 | call to source() : | nsmutabledata.swift:41:15:41:15 | nsMutableDataTainted4 | result |
20852118
| nsmutabledata.swift:45:15:45:15 | nsMutableDataTainted5 | nsmutabledata.swift:44:35:44:42 | call to source() : | nsmutabledata.swift:45:15:45:15 | nsMutableDataTainted5 | result |
20862119
| nsmutabledata.swift:49:15:49:37 | .mutableBytes | nsmutabledata.swift:48:33:48:40 | call to source() : | nsmutabledata.swift:49:15:49:37 | .mutableBytes | result |
2120+
| simple.swift:12:13:12:24 | ... .+(_:_:) ... | simple.swift:12:17:12:24 | call to source() : | simple.swift:12:13:12:24 | ... .+(_:_:) ... | result |
2121+
| simple.swift:13:13:13:24 | ... .+(_:_:) ... | simple.swift:13:13:13:20 | call to source() : | simple.swift:13:13:13:24 | ... .+(_:_:) ... | result |
2122+
| simple.swift:14:13:14:24 | ... .-(_:_:) ... | simple.swift:14:17:14:24 | call to source() : | simple.swift:14:13:14:24 | ... .-(_:_:) ... | result |
2123+
| simple.swift:15:13:15:24 | ... .-(_:_:) ... | simple.swift:15:13:15:20 | call to source() : | simple.swift:15:13:15:24 | ... .-(_:_:) ... | result |
2124+
| simple.swift:16:13:16:24 | ... .*(_:_:) ... | simple.swift:16:17:16:24 | call to source() : | simple.swift:16:13:16:24 | ... .*(_:_:) ... | result |
2125+
| simple.swift:17:13:17:24 | ... .*(_:_:) ... | simple.swift:17:13:17:20 | call to source() : | simple.swift:17:13:17:24 | ... .*(_:_:) ... | result |
2126+
| simple.swift:18:13:18:26 | ... ./(_:_:) ... | simple.swift:18:19:18:26 | call to source() : | simple.swift:18:13:18:26 | ... ./(_:_:) ... | result |
2127+
| simple.swift:19:13:19:24 | ... ./(_:_:) ... | simple.swift:19:13:19:20 | call to source() : | simple.swift:19:13:19:24 | ... ./(_:_:) ... | result |
2128+
| simple.swift:20:13:20:26 | ... .%(_:_:) ... | simple.swift:20:19:20:26 | call to source() : | simple.swift:20:13:20:26 | ... .%(_:_:) ... | result |
2129+
| simple.swift:21:13:21:24 | ... .%(_:_:) ... | simple.swift:21:13:21:20 | call to source() : | simple.swift:21:13:21:24 | ... .%(_:_:) ... | result |
2130+
| simple.swift:23:13:23:21 | call to -(_:) | simple.swift:23:14:23:21 | call to source() : | simple.swift:23:13:23:21 | call to -(_:) | result |
20872131
| string.swift:139:13:139:13 | "..." | string.swift:137:11:137:18 | call to source() : | string.swift:139:13:139:13 | "..." | result |
20882132
| string.swift:141:13:141:13 | "..." | string.swift:137:11:137:18 | call to source() : | string.swift:141:13:141:13 | "..." | result |
20892133
| string.swift:143:13:143:13 | "..." | string.swift:137:11:137:18 | call to source() : | string.swift:143:13:143:13 | "..." | result |

‎swift/ql/test/library-tests/dataflow/taint/simple.swift

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,18 @@ func sink(arg: Any) {}
99
func taintThroughArithmetic() {
1010
// arithmetic
1111

12-
sink(arg: 1 + source()) // $ MISSING: tainted=
13-
sink(arg: source() + 1) // $ MISSING: tainted=
14-
sink(arg: 1 - source()) // $ MISSING: tainted=
15-
sink(arg: source() - 1) // $ MISSING: tainted=
16-
sink(arg: 2 * source()) // $ MISSING: tainted=
17-
sink(arg: source() * 2) // $ MISSING: tainted=
18-
sink(arg: 100 / source()) // $ MISSING: tainted=
19-
sink(arg: source() / 100) // $ MISSING: tainted=
20-
sink(arg: 100 % source()) // $ MISSING: tainted=
21-
sink(arg: source() % 100) // $ MISSING: tainted=
12+
sink(arg: 1 + source()) // $ tainted=12
13+
sink(arg: source() + 1) // $ tainted=13
14+
sink(arg: 1 - source()) // $ tainted=14
15+
sink(arg: source() - 1) // $ tainted=15
16+
sink(arg: 2 * source()) // $ tainted=16
17+
sink(arg: source() * 2) // $ tainted=17
18+
sink(arg: 100 / source()) // $ tainted=18
19+
sink(arg: source() / 100) // $ tainted=19
20+
sink(arg: 100 % source()) // $ tainted=20
21+
sink(arg: source() % 100) // $ tainted=21
2222

23-
sink(arg: -source()) // $ MISSING: tainted=
23+
sink(arg: -source()) // $ tainted=23
2424

2525
// overflow operators
2626

0 commit comments

Comments
 (0)