Skip to content

Commit 00cd347

Browse files
geoffw0geoffw0
committed
Swift: Add more heuristic expressions.
1 parent bc57e46 commit 00cd347

File tree

6 files changed

+50
-17
lines changed

6 files changed

+50
-17
lines changed

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ class SensitiveCredential extends SensitiveDataType, TCredential {
3535
result = HeuristicNames::maybeSensitiveRegexp(classification)
3636
)
3737
or
38-
result = "(?is).*(account|accnt|license).?(id|key).*"
38+
result = "(?is).*((account|accnt|license).?(id|key)|one.?time.?code|pass.?phrase).*"
3939
}
4040
}
4141

@@ -50,21 +50,27 @@ class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
5050
"(?is).*(" +
5151
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
5252
// Government identifiers, such as Social Security Numbers
53-
"social.?security|national.?insurance|" +
53+
"social.?security|employer.?identification|national.?insurance|resident.?id|" +
54+
"passport.?(num|no)|" +
5455
// Contact information, such as home addresses
55-
"post.?code|zip.?code|home.?address|" +
56+
"post.?code|zip.?code|home.?addr|" +
5657
// and telephone numbers
57-
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax).?(num|no)|telephone|" +
58+
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax).?(num|no|phone)|" +
59+
"emergency.?contact|" +
5860
// Geographic location - where the user is (or was)
59-
"latitude|longitude|" +
61+
"latitude|longitude|nationality|" +
6062
// Financial data - such as credit card numbers, salary, bank accounts, and debts
61-
"credit.?card|debit.?card|salary|bank.?account|acc(ou)?nt.?(no|num)|" +
63+
"(credit|debit|bank|visa).?(card|num|no|acc(ou?)nt)|acc(ou)?nt.?(no|num|credit)|" +
64+
"salary|billing|credit.?(rating|score)|" +
6265
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
63-
"email|" +
66+
"e.?mail|" +
6467
// Health - medical conditions, insurance status, prescription records
65-
"birthday|birth.?date|date.?of.?birth|medical|" +
68+
"birth.?(date|day)|(date|day).?(of.?)?birth|" +
69+
"medical|(health|care).?plan|healthkit|appointment|prescription|" +
70+
"blood.?(type|alcohol|glucose|pressure)|heart.?(rate|rhythm)|body.?(mass|fat)|" +
71+
"menstrua|pregnan|insulin|inhaler|" +
6672
// Relationships - work and family
67-
"employer|spouse" +
73+
"employer|employee|spouse|maiden.?name" +
6874
// ---
6975
").*"
7076
}

‎swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ edges
1515
| testURL.swift:17:54:17:54 | passwd | testURL.swift:17:22:17:54 | ... .+(_:_:) ... |
1616
| testURL.swift:19:55:19:55 | account_no | testURL.swift:19:22:19:55 | ... .+(_:_:) ... |
1717
| testURL.swift:20:55:20:55 | credit_card_no | testURL.swift:20:22:20:55 | ... .+(_:_:) ... |
18+
| testURL.swift:28:55:28:55 | e_mail | testURL.swift:28:22:28:55 | ... .+(_:_:) ... |
19+
| testURL.swift:30:57:30:57 | a_homeaddr_z | testURL.swift:30:22:30:57 | ... .+(_:_:) ... |
20+
| testURL.swift:32:55:32:55 | resident_ID | testURL.swift:32:22:32:55 | ... .+(_:_:) ... |
1821
nodes
1922
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) | semmle.label | [summary] to write: return (return) in Data.init(_:) |
2023
| testAlamofire.swift:150:13:150:45 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
@@ -40,13 +43,23 @@ nodes
4043
| testSend.swift:71:27:71:27 | license_key | semmle.label | license_key |
4144
| testSend.swift:72:27:72:30 | .mobileNumber | semmle.label | .mobileNumber |
4245
| testSend.swift:76:27:76:30 | .Telephone | semmle.label | .Telephone |
46+
| testSend.swift:77:27:77:30 | .birth_day | semmle.label | .birth_day |
47+
| testSend.swift:78:27:78:30 | .CarePlanID | semmle.label | .CarePlanID |
48+
| testSend.swift:79:27:79:30 | .BankCardNo | semmle.label | .BankCardNo |
49+
| testSend.swift:80:27:80:30 | .MyCreditRating | semmle.label | .MyCreditRating |
4350
| testURL.swift:17:22:17:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4451
| testURL.swift:17:54:17:54 | passwd | semmle.label | passwd |
4552
| testURL.swift:19:22:19:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4653
| testURL.swift:19:55:19:55 | account_no | semmle.label | account_no |
4754
| testURL.swift:20:22:20:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4855
| testURL.swift:20:55:20:55 | credit_card_no | semmle.label | credit_card_no |
4956
| testURL.swift:24:22:24:22 | passwd | semmle.label | passwd |
57+
| testURL.swift:28:22:28:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
58+
| testURL.swift:28:55:28:55 | e_mail | semmle.label | e_mail |
59+
| testURL.swift:30:22:30:57 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
60+
| testURL.swift:30:57:30:57 | a_homeaddr_z | semmle.label | a_homeaddr_z |
61+
| testURL.swift:32:22:32:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
62+
| testURL.swift:32:55:32:55 | resident_ID | semmle.label | resident_ID |
5063
subpaths
5164
| testSend.swift:33:19:33:19 | passwordPlain | testSend.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) | testSend.swift:33:14:33:32 | call to Data.init(_:) |
5265
| testSend.swift:60:17:60:17 | password | testSend.swift:41:10:41:18 | data | testSend.swift:41:45:41:45 | data | testSend.swift:60:13:60:25 | call to pad(_:) |
@@ -62,7 +75,14 @@ subpaths
6275
| testSend.swift:71:27:71:27 | license_key | testSend.swift:71:27:71:27 | license_key | testSend.swift:71:27:71:27 | license_key | This operation transmits 'license_key', which may contain unencrypted sensitive data from $@. | testSend.swift:71:27:71:27 | license_key | license_key |
6376
| testSend.swift:72:27:72:30 | .mobileNumber | testSend.swift:72:27:72:30 | .mobileNumber | testSend.swift:72:27:72:30 | .mobileNumber | This operation transmits '.mobileNumber', which may contain unencrypted sensitive data from $@. | testSend.swift:72:27:72:30 | .mobileNumber | .mobileNumber |
6477
| testSend.swift:76:27:76:30 | .Telephone | testSend.swift:76:27:76:30 | .Telephone | testSend.swift:76:27:76:30 | .Telephone | This operation transmits '.Telephone', which may contain unencrypted sensitive data from $@. | testSend.swift:76:27:76:30 | .Telephone | .Telephone |
78+
| testSend.swift:77:27:77:30 | .birth_day | testSend.swift:77:27:77:30 | .birth_day | testSend.swift:77:27:77:30 | .birth_day | This operation transmits '.birth_day', which may contain unencrypted sensitive data from $@. | testSend.swift:77:27:77:30 | .birth_day | .birth_day |
79+
| testSend.swift:78:27:78:30 | .CarePlanID | testSend.swift:78:27:78:30 | .CarePlanID | testSend.swift:78:27:78:30 | .CarePlanID | This operation transmits '.CarePlanID', which may contain unencrypted sensitive data from $@. | testSend.swift:78:27:78:30 | .CarePlanID | .CarePlanID |
80+
| testSend.swift:79:27:79:30 | .BankCardNo | testSend.swift:79:27:79:30 | .BankCardNo | testSend.swift:79:27:79:30 | .BankCardNo | This operation transmits '.BankCardNo', which may contain unencrypted sensitive data from $@. | testSend.swift:79:27:79:30 | .BankCardNo | .BankCardNo |
81+
| testSend.swift:80:27:80:30 | .MyCreditRating | testSend.swift:80:27:80:30 | .MyCreditRating | testSend.swift:80:27:80:30 | .MyCreditRating | This operation transmits '.MyCreditRating', which may contain unencrypted sensitive data from $@. | testSend.swift:80:27:80:30 | .MyCreditRating | .MyCreditRating |
6582
| testURL.swift:17:22:17:54 | ... .+(_:_:) ... | testURL.swift:17:54:17:54 | passwd | testURL.swift:17:22:17:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:17:54:17:54 | passwd | passwd |
6683
| testURL.swift:19:22:19:55 | ... .+(_:_:) ... | testURL.swift:19:55:19:55 | account_no | testURL.swift:19:22:19:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:19:55:19:55 | account_no | account_no |
6784
| testURL.swift:20:22:20:55 | ... .+(_:_:) ... | testURL.swift:20:55:20:55 | credit_card_no | testURL.swift:20:22:20:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:20:55:20:55 | credit_card_no | credit_card_no |
6885
| testURL.swift:24:22:24:22 | passwd | testURL.swift:24:22:24:22 | passwd | testURL.swift:24:22:24:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@. | testURL.swift:24:22:24:22 | passwd | passwd |
86+
| testURL.swift:28:22:28:55 | ... .+(_:_:) ... | testURL.swift:28:55:28:55 | e_mail | testURL.swift:28:22:28:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:28:55:28:55 | e_mail | e_mail |
87+
| testURL.swift:30:22:30:57 | ... .+(_:_:) ... | testURL.swift:30:57:30:57 | a_homeaddr_z | testURL.swift:30:22:30:57 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:30:57:30:57 | a_homeaddr_z | a_homeaddr_z |
88+
| testURL.swift:32:22:32:55 | ... .+(_:_:) ... | testURL.swift:32:55:32:55 | resident_ID | testURL.swift:32:22:32:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:32:55:32:55 | resident_ID | resident_ID |

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,14 @@
129129
| testSend.swift:72:27:72:30 | .mobileNumber | label:mobileNumber, type:private information |
130130
| testSend.swift:75:27:75:30 | .passwordFeatureEnabled | label:passwordFeatureEnabled, type:credential |
131131
| testSend.swift:76:27:76:30 | .Telephone | label:Telephone, type:private information |
132+
| testSend.swift:77:27:77:30 | .birth_day | label:birth_day, type:private information |
133+
| testSend.swift:78:27:78:30 | .CarePlanID | label:CarePlanID, type:private information |
134+
| testSend.swift:79:27:79:30 | .BankCardNo | label:BankCardNo, type:private information |
135+
| testSend.swift:80:27:80:30 | .MyCreditRating | label:MyCreditRating, type:private information |
132136
| testURL.swift:17:54:17:54 | passwd | label:passwd, type:credential |
133137
| testURL.swift:19:55:19:55 | account_no | label:account_no, type:private information |
134138
| testURL.swift:20:55:20:55 | credit_card_no | label:credit_card_no, type:private information |
135139
| testURL.swift:24:22:24:22 | passwd | label:passwd, type:credential |
140+
| testURL.swift:28:55:28:55 | e_mail | label:e_mail, type:private information |
141+
| testURL.swift:30:57:30:57 | a_homeaddr_z | label:a_homeaddr_z, type:private information |
142+
| testURL.swift:32:55:32:55 | resident_ID | label:resident_ID, type:private information |

‎swift/ql/test/query-tests/Security/CWE-311/testSend.swift

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,9 +74,9 @@ func test2(password : String, license_key: String, ms: MyStruct, connection : NW
7474
connection.send(content: ms.mobilePlayer, completion: .idempotent) // GOOD (not sensitive)
7575
connection.send(content: ms.passwordFeatureEnabled, completion: .idempotent) // GOOD (not sensitive)
7676
connection.send(content: ms.Telephone, completion: .idempotent) // BAD
77-
connection.send(content: ms.birth_day, completion: .idempotent) // BAD [NOT DETECTED]
78-
connection.send(content: ms.CarePlanID, completion: .idempotent) // BAD [NOT DETECTED]
79-
connection.send(content: ms.BankCardNo, completion: .idempotent) // BAD [NOT DETECTED]
80-
connection.send(content: ms.MyCreditRating, completion: .idempotent) // BAD [NOT DETECTED]
77+
connection.send(content: ms.birth_day, completion: .idempotent) // BAD
78+
connection.send(content: ms.CarePlanID, completion: .idempotent) // BAD
79+
connection.send(content: ms.BankCardNo, completion: .idempotent) // BAD
80+
connection.send(content: ms.MyCreditRating, completion: .idempotent) // BAD
8181
connection.send(content: ms.OneTimeCode, completion: .idempotent) // BAD [NOT DETECTED]
8282
}

‎swift/ql/test/query-tests/Security/CWE-311/testURL.swift

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,9 @@ func test1(passwd : String, encrypted_passwd : String, account_no : String, cred
2525
let g = URL(string: "abc", relativeTo: f); // BAD (reported on line above)
2626

2727
let e_mail = myString
28-
let h = URL(string: "http://example.com/login?em=" + e_mail); // BAD [NOT DETECTED]
28+
let h = URL(string: "http://example.com/login?em=" + e_mail); // BAD
2929
var a_homeaddr_z = getMyString()
30-
let i = URL(string: "http://example.com/login?home=" + a_homeaddr_z); // BAD [NOT DETECTED]
30+
let i = URL(string: "http://example.com/login?home=" + a_homeaddr_z); // BAD
3131
var resident_ID = getMyString()
32-
let j = URL(string: "http://example.com/login?id=" + resident_ID); // BAD [NOT DETECTED]
32+
let j = URL(string: "http://example.com/login?id=" + resident_ID); // BAD
3333
}

‎swift/ql/test/query-tests/Security/CWE-312/cleartextLoggingTest.swift

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ func test1(password: String, passwordHash : String, passphrase: String, pass_phr
134134
log.fault("\(passwordHash, privacy: .public)") // Safe
135135

136136
NSLog(passphrase) // $ hasCleartextLogging=136
137-
NSLog(pass_phrase) // $ MISSING: hasCleartextLogging=137
137+
NSLog(pass_phrase) // $ hasCleartextLogging=137
138138
}
139139

140140
class MyClass {

0 commit comments

Comments
 (0)