Skip to content

Commit ec72c75

Browse files
geoffw0geoffw0
committed
Swift: Add a partial model of Collection.
1 parent e357b44 commit ec72c75

File tree

6 files changed

+236
-21
lines changed

6 files changed

+236
-21
lines changed

‎swift/ql/lib/codeql/swift/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ private import internal.FlowSummaryImplSpecific
7878
* ensuring that they are visible to the taint tracking / data flow library.
7979
*/
8080
private module Frameworks {
81+
private import codeql.swift.frameworks.StandardLibrary.Collection
8182
private import codeql.swift.frameworks.StandardLibrary.CustomUrlSchemes
8283
private import codeql.swift.frameworks.StandardLibrary.Data
8384
private import codeql.swift.frameworks.StandardLibrary.FilePath

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Collection.qll

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Provides models for the `Collection` and related Swift class.
3+
*/
4+
5+
import swift
6+
private import codeql.swift.dataflow.DataFlow
7+
private import codeql.swift.dataflow.ExternalFlow
8+
private import codeql.swift.dataflow.FlowSteps
9+
10+
11+
/**
12+
* A model for `Collection` members that permit taint flow.
13+
*/
14+
private class CollectionSummaries extends SummaryModelCsv {
15+
override predicate row(string row) {
16+
row =
17+
[
18+
";Collection;true;prefix(_:);;;Argument[-1];ReturnValue;taint",
19+
";Collection;true;prefix(through:);;;Argument[-1];ReturnValue;taint",
20+
";Collection;true;prefix(upTo:);;;Argument[-1];ReturnValue;taint",
21+
";Collection;true;prefix(while:);;;Argument[-1];ReturnValue;taint",
22+
";Collection;true;suffix(_:);;;Argument[-1];ReturnValue;taint",
23+
";Collection;true;suffix(from:);;;Argument[-1];ReturnValue;taint",
24+
";Collection;true;dropFirst(_:);;;Argument[-1];ReturnValue;taint",
25+
";Collection;true;dropLast(_:);;;Argument[-1];ReturnValue;taint",
26+
";Collection;true;split(maxSplits:omittingEmptySubsequences:whereSeparator:);;;Argument[-1];ReturnValue;taint",
27+
";Collection;true;split(separator:maxSplits:omittingEmptySubsequences:);;;Argument[-1];ReturnValue;taint",
28+
";Collection;true;removeFirst();;;Argument[-1];ReturnValue;taint",
29+
";RangeReplaceableCollection;true;remove(at:);;;Argument[-1];ReturnValue;taint",
30+
";RangeReplaceableCollection;true;removeLast();;;Argument[-1];ReturnValue;taint",
31+
";RangeReplaceableCollection;true;removeLast();;;Argument[-1];ReturnValue;taint",
32+
";BidirectionalCollection;true;joined(separator:);;;Argument[-1..0];ReturnValue;taint",
33+
]
34+
}
35+
}

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/String.qll

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -109,12 +109,6 @@ private class StringSummaries extends SummaryModelCsv {
109109
";String;true;min();;;Argument[-1];ReturnValue;taint",
110110
";String;true;min(by:);;;Argument[-1];ReturnValue;taint",
111111
";String;true;subscript(_:);;;Argument[-1];ReturnValue;taint",
112-
";String;true;prefix(_:);;;Argument[-1];ReturnValue;taint",
113-
";String;true;prefix(through:);;;Argument[-1];ReturnValue;taint",
114-
";String;true;prefix(upTo:);;;Argument[-1];ReturnValue;taint",
115-
";String;true;prefix(while:);;;Argument[-1];ReturnValue;taint",
116-
";String;true;suffix(_:);;;Argument[-1];ReturnValue;taint",
117-
";String;true;suffix(from:);;;Argument[-1];ReturnValue;taint",
118112
";String;true;split(maxSplits:omittingEmptySubsequences:whereSeparator:);;;Argument[-1];ReturnValue;taint",
119113
";String;true;randomElement();;;Argument[-1];ReturnValue;taint",
120114
";String;true;randomElement(using:);;;Argument[-1];ReturnValue;taint",

‎swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1189,8 +1189,10 @@
11891189
| string.swift:228:31:228:31 | tainted | string.swift:228:13:228:48 | call to String.init(repeating:count:) |
11901190
| string.swift:228:31:228:31 | tainted | string.swift:230:13:230:13 | tainted |
11911191
| string.swift:230:13:230:13 | [post] tainted | string.swift:231:13:231:13 | tainted |
1192+
| string.swift:230:13:230:13 | tainted | string.swift:230:13:230:33 | call to dropFirst(_:) |
11921193
| string.swift:230:13:230:13 | tainted | string.swift:231:13:231:13 | tainted |
11931194
| string.swift:231:13:231:13 | [post] tainted | string.swift:232:13:232:13 | tainted |
1195+
| string.swift:231:13:231:13 | tainted | string.swift:231:13:231:32 | call to dropLast(_:) |
11941196
| string.swift:231:13:231:13 | tainted | string.swift:232:13:232:13 | tainted |
11951197
| string.swift:232:13:232:13 | [post] tainted | string.swift:232:37:232:37 | tainted |
11961198
| string.swift:232:13:232:13 | tainted | string.swift:232:13:232:55 | call to substring(from:) |
@@ -1216,8 +1218,10 @@
12161218
| string.swift:239:13:239:13 | tainted | string.swift:239:13:239:30 | call to reversed() |
12171219
| string.swift:239:13:239:13 | tainted | string.swift:241:13:241:13 | tainted |
12181220
| string.swift:241:13:241:13 | [post] tainted | string.swift:242:13:242:13 | tainted |
1221+
| string.swift:241:13:241:13 | tainted | string.swift:241:13:241:41 | call to split(separator:maxSplits:omittingEmptySubsequences:) |
12191222
| string.swift:241:13:241:13 | tainted | string.swift:242:13:242:13 | tainted |
12201223
| string.swift:242:13:242:13 | [post] tainted | string.swift:245:13:245:13 | tainted |
1224+
| string.swift:242:13:242:13 | tainted | string.swift:242:13:244:4 | call to split(maxSplits:omittingEmptySubsequences:whereSeparator:) |
12211225
| string.swift:242:13:242:13 | tainted | string.swift:245:13:245:13 | tainted |
12221226
| string.swift:243:5:243:5 | SSA def(c) | string.swift:243:18:243:18 | c |
12231227
| string.swift:243:5:243:5 | c | string.swift:243:5:243:5 | SSA def(c) |
@@ -1258,14 +1262,22 @@
12581262
| string.swift:259:5:259:5 | line | string.swift:259:5:259:5 | SSA def(line) |
12591263
| string.swift:259:11:259:11 | SSA def(stop) | string.swift:261:15:261:15 | stop |
12601264
| string.swift:259:11:259:11 | stop | string.swift:259:11:259:11 | SSA def(stop) |
1265+
| string.swift:264:13:264:26 | [...] | string.swift:264:13:264:35 | call to joined(separator:) |
12611266
| string.swift:264:14:264:14 | clean | string.swift:264:21:264:21 | clean |
12621267
| string.swift:264:21:264:21 | clean | string.swift:265:23:265:23 | clean |
1268+
| string.swift:264:34:264:34 | default separator | string.swift:264:13:264:35 | call to joined(separator:) |
1269+
| string.swift:265:13:265:28 | [...] | string.swift:265:13:265:37 | call to joined(separator:) |
12631270
| string.swift:265:14:265:14 | tainted | string.swift:266:21:266:21 | tainted |
12641271
| string.swift:265:23:265:23 | clean | string.swift:266:14:266:14 | clean |
1272+
| string.swift:265:36:265:36 | default separator | string.swift:265:13:265:37 | call to joined(separator:) |
1273+
| string.swift:266:13:266:28 | [...] | string.swift:266:13:266:37 | call to joined(separator:) |
12651274
| string.swift:266:14:266:14 | clean | string.swift:269:13:269:13 | clean |
12661275
| string.swift:266:21:266:21 | tainted | string.swift:267:14:267:14 | tainted |
1276+
| string.swift:266:36:266:36 | default separator | string.swift:266:13:266:37 | call to joined(separator:) |
1277+
| string.swift:267:13:267:30 | [...] | string.swift:267:13:267:39 | call to joined(separator:) |
12671278
| string.swift:267:14:267:14 | tainted | string.swift:267:23:267:23 | tainted |
12681279
| string.swift:267:23:267:23 | tainted | string.swift:270:13:270:13 | tainted |
1280+
| string.swift:267:38:267:38 | default separator | string.swift:267:13:267:39 | call to joined(separator:) |
12691281
| string.swift:269:13:269:13 | [post] clean | string.swift:271:13:271:13 | clean |
12701282
| string.swift:269:13:269:13 | clean | string.swift:269:13:269:19 | .description |
12711283
| string.swift:269:13:269:13 | clean | string.swift:271:13:271:13 | clean |
@@ -1352,6 +1364,7 @@
13521364
| string.swift:300:14:300:22 | call to source2() | string.swift:300:7:300:7 | SSA def(str1) |
13531365
| string.swift:301:13:301:13 | [post] str1 | string.swift:302:13:302:13 | str1 |
13541366
| string.swift:301:13:301:13 | str1 | string.swift:302:13:302:13 | str1 |
1367+
| string.swift:302:13:302:13 | &... | string.swift:302:13:302:44 | call to remove(at:) |
13551368
| string.swift:302:13:302:13 | &... | string.swift:302:29:302:29 | str1 |
13561369
| string.swift:302:13:302:13 | [post] &... | string.swift:302:29:302:29 | str1 |
13571370
| string.swift:302:13:302:13 | str1 | string.swift:302:13:302:13 | &... |
@@ -1375,6 +1388,7 @@
13751388
| string.swift:315:14:315:22 | call to source2() | string.swift:315:7:315:7 | SSA def(str4) |
13761389
| string.swift:316:13:316:13 | [post] str4 | string.swift:317:13:317:13 | str4 |
13771390
| string.swift:316:13:316:13 | str4 | string.swift:317:13:317:13 | str4 |
1391+
| string.swift:317:13:317:13 | &... | string.swift:317:13:317:30 | call to removeFirst() |
13781392
| string.swift:317:13:317:13 | &... | string.swift:318:13:318:13 | str4 |
13791393
| string.swift:317:13:317:13 | [post] &... | string.swift:318:13:318:13 | str4 |
13801394
| string.swift:317:13:317:13 | str4 | string.swift:317:13:317:13 | &... |
@@ -1385,6 +1399,7 @@
13851399
| string.swift:319:3:319:3 | str4 | string.swift:319:3:319:3 | &... |
13861400
| string.swift:320:13:320:13 | [post] str4 | string.swift:321:13:321:13 | str4 |
13871401
| string.swift:320:13:320:13 | str4 | string.swift:321:13:321:13 | str4 |
1402+
| string.swift:321:13:321:13 | &... | string.swift:321:13:321:29 | call to removeLast() |
13881403
| string.swift:321:13:321:13 | &... | string.swift:322:13:322:13 | str4 |
13891404
| string.swift:321:13:321:13 | [post] &... | string.swift:322:13:322:13 | str4 |
13901405
| string.swift:321:13:321:13 | str4 | string.swift:321:13:321:13 | &... |
@@ -1691,12 +1706,14 @@
16911706
| string.swift:546:20:546:20 | sub1 | string.swift:546:13:546:24 | call to String.init(_:) |
16921707
| string.swift:548:7:548:7 | SSA def(sub2) | string.swift:549:13:549:13 | sub2 |
16931708
| string.swift:548:14:548:14 | [post] tainted | string.swift:552:14:552:14 | tainted |
1709+
| string.swift:548:14:548:14 | tainted | string.swift:548:14:548:31 | call to prefix(_:) |
16941710
| string.swift:548:14:548:14 | tainted | string.swift:552:14:552:14 | tainted |
16951711
| string.swift:548:14:548:31 | call to prefix(_:) | string.swift:548:7:548:7 | SSA def(sub2) |
16961712
| string.swift:549:13:549:13 | sub2 | string.swift:550:20:550:20 | sub2 |
16971713
| string.swift:550:20:550:20 | sub2 | string.swift:550:13:550:24 | call to String.init(_:) |
16981714
| string.swift:552:7:552:7 | SSA def(sub3) | string.swift:553:13:553:13 | sub3 |
16991715
| string.swift:552:14:552:14 | [post] tainted | string.swift:552:38:552:38 | tainted |
1716+
| string.swift:552:14:552:14 | tainted | string.swift:552:14:552:54 | call to prefix(through:) |
17001717
| string.swift:552:14:552:14 | tainted | string.swift:552:38:552:38 | tainted |
17011718
| string.swift:552:14:552:54 | call to prefix(through:) | string.swift:552:7:552:7 | SSA def(sub3) |
17021719
| string.swift:552:38:552:38 | [post] tainted | string.swift:556:14:556:14 | tainted |
@@ -1705,6 +1722,7 @@
17051722
| string.swift:554:20:554:20 | sub3 | string.swift:554:13:554:24 | call to String.init(_:) |
17061723
| string.swift:556:7:556:7 | SSA def(sub4) | string.swift:557:13:557:13 | sub4 |
17071724
| string.swift:556:14:556:14 | [post] tainted | string.swift:556:35:556:35 | tainted |
1725+
| string.swift:556:14:556:14 | tainted | string.swift:556:14:556:51 | call to prefix(upTo:) |
17081726
| string.swift:556:14:556:14 | tainted | string.swift:556:35:556:35 | tainted |
17091727
| string.swift:556:14:556:51 | call to prefix(upTo:) | string.swift:556:7:556:7 | SSA def(sub4) |
17101728
| string.swift:556:35:556:35 | [post] tainted | string.swift:560:14:560:14 | tainted |
@@ -1713,12 +1731,14 @@
17131731
| string.swift:558:20:558:20 | sub4 | string.swift:558:13:558:24 | call to String.init(_:) |
17141732
| string.swift:560:7:560:7 | SSA def(sub5) | string.swift:561:13:561:13 | sub5 |
17151733
| string.swift:560:14:560:14 | [post] tainted | string.swift:564:14:564:14 | tainted |
1734+
| string.swift:560:14:560:14 | tainted | string.swift:560:14:560:31 | call to suffix(_:) |
17161735
| string.swift:560:14:560:14 | tainted | string.swift:564:14:564:14 | tainted |
17171736
| string.swift:560:14:560:31 | call to suffix(_:) | string.swift:560:7:560:7 | SSA def(sub5) |
17181737
| string.swift:561:13:561:13 | sub5 | string.swift:562:20:562:20 | sub5 |
17191738
| string.swift:562:20:562:20 | sub5 | string.swift:562:13:562:24 | call to String.init(_:) |
17201739
| string.swift:564:7:564:7 | SSA def(sub6) | string.swift:565:13:565:13 | sub6 |
17211740
| string.swift:564:14:564:14 | [post] tainted | string.swift:564:35:564:35 | tainted |
1741+
| string.swift:564:14:564:14 | tainted | string.swift:564:14:564:53 | call to suffix(from:) |
17221742
| string.swift:564:14:564:14 | tainted | string.swift:564:35:564:35 | tainted |
17231743
| string.swift:564:14:564:53 | call to suffix(from:) | string.swift:564:7:564:7 | SSA def(sub6) |
17241744
| string.swift:565:13:565:13 | sub6 | string.swift:566:20:566:20 | sub6 |

0 commit comments

Comments
 (0)