Skip to content

Commit a86862d

Browse files
committed
Swift: Add test cases (heuristic).
1 parent 04016eb commit a86862d

File tree

1 file changed

+34
-0
lines changed

1 file changed

+34
-0
lines changed

swift/ql/test/query-tests/Security/CWE-022/testPathInjection.swift

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -481,3 +481,37 @@ func testPathInjection2(s1: UnsafeMutablePointer<String>, s2: UnsafeMutablePoint
481481
_ = fm.fileAttributes(atPath: remoteString, traverseLink: true) // $ MISSING: hasPathInjection=445
482482
_ = try fm.attributesOfItem(atPath: remoteString) // $ MISSING: hasPathInjection=445
483483
}
484+
485+
// ---
486+
487+
func myOpenFile1(atPath path: String) { }
488+
func myOpenFile2(_ filePath: String) { }
489+
func myFindFiles(ofType type: Int, inDirectory dir: String) { }
490+
491+
class MyClass {
492+
init(contentsOfFile: String) { }
493+
func doSomething(keyPath: String) { }
494+
func write(toFile: String) { }
495+
}
496+
497+
class MyFile {
498+
init(path: String) { }
499+
}
500+
501+
func testPathInjectionHeuristics() {
502+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
503+
504+
myOpenFile1(atPath: remoteString) // $ MISSING: hasPathInjection=
505+
myOpenFile2(remoteString) // $ MISSING: hasPathInjection=
506+
myFindFiles(ofType: 0, inDirectory: remoteString) // $ MISSING: hasPathInjection=
507+
508+
let mc = MyClass(contentsOfFile: remoteString) // $ MISSING: hasPathInjection=
509+
mc.doSomething(keyPath: remoteString) // good - not a path
510+
mc.write(toFile: remoteString) // $ MISSING: hasPathInjection=
511+
512+
let mf1 = MyFile(path: "")
513+
let mf2 = MyFile(path: remoteString) // $ MISSING: hasPathInjection=
514+
515+
_ = NSSortDescriptor(key: remoteString, ascending: true) // good - not a path
516+
_ = NSSortDescriptor(keyPath: remoteString as! KeyPath<Int, Int>, ascending: true) // good - not a path
517+
}

0 commit comments

Comments
 (0)