Skip to content

Commit 0adff53

Browse files
MathiasVPMathiasVP
authored
Merge pull request github#13190 from geoffw0/sharedsensitive
Swift: Adopt the shared sensitive data library
2 parents 41bd1ae + edfdddb commit 0adff53

File tree

14 files changed

+215
-30
lines changed

14 files changed

+215
-30
lines changed

‎config/identical-files.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -511,7 +511,8 @@
511511
"SensitiveDataHeuristics Python/JS": [
512512
"javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
513513
"python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll",
514-
"ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll"
514+
"ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll",
515+
"swift/ql/lib/codeql/swift/security/internal/SensitiveDataHeuristics.qll"
515516
],
516517
"CFG": [
517518
"csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImplShared.qll",
@@ -598,4 +599,4 @@
598599
"python/ql/lib/semmle/python/security/internal/EncryptionKeySizes.qll",
599600
"java/ql/lib/semmle/code/java/security/internal/EncryptionKeySizes.qll"
600601
]
601-
}
602+
}

‎swift/ql/.generated.list

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎swift/ql/lib/change-notes/2023-05-30-shared-sensitive.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: majorAnalysis
3+
---
4+
* Incorporated the cross-language `SensitiveDataHeuristics.qll` heuristics library into the Swift `SensitiveExprs.qll` library. This adds a number of new heuristics enhancing detection from the library.

‎swift/ql/lib/codeql/swift/elements/decl/Function.qll

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,16 @@ private import codeql.swift.elements.decl.Method
66
*/
77
class Function extends Generated::Function, Callable {
88
override string toString() { result = this.getName() }
9+
10+
/**
11+
* Gets the name of this function, without the argument list. For example
12+
* a function with name `myFunction(arg:)` has short name `myFunction`.
13+
*/
14+
string getShortName() {
15+
// match as many characters as possible that are not `(`.
16+
// (`*+` is possessive matching)
17+
result = this.getName().regexpCapture("([^(]*+).*", 1)
18+
}
919
}
1020

1121
/**

‎swift/ql/lib/codeql/swift/generated/Callable.qll

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎swift/ql/lib/codeql/swift/generated/Raw.qll

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*/
66

77
import swift
8+
import internal.SensitiveDataHeuristics
89

910
private newtype TSensitiveDataType =
1011
TCredential() or
@@ -29,7 +30,12 @@ class SensitiveCredential extends SensitiveDataType, TCredential {
2930
override string toString() { result = "credential" }
3031

3132
override string getRegexp() {
32-
result = ".*(password|passwd|accountid|account.?key|accnt.?key|license.?key|trusted).*"
33+
exists(SensitiveDataClassification classification |
34+
not classification = SensitiveDataClassification::id() and // not accurate enough
35+
result = HeuristicNames::maybeSensitiveRegexp(classification)
36+
)
37+
or
38+
result = "(?is).*(account|accnt|license).?(id|key).*"
3339
}
3440
}
3541

@@ -41,7 +47,7 @@ class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
4147

4248
override string getRegexp() {
4349
result =
44-
".*(" +
50+
"(?is).*(" +
4551
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
4652
// Government identifiers, such as Social Security Numbers
4753
"social.?security|national.?insurance|" +
@@ -52,7 +58,7 @@ class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
5258
// Geographic location - where the user is (or was)
5359
"latitude|longitude|" +
5460
// Financial data - such as credit card numbers, salary, bank accounts, and debts
55-
"credit.?card|debit.?card|salary|bank.?account|" +
61+
"credit.?card|debit.?card|salary|bank.?account|acc(ou)?nt.?(no|num)|" +
5662
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
5763
"email|" +
5864
// Health - medical conditions, insurance status, prescription records
@@ -69,15 +75,18 @@ class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
6975
* contain hashed or encrypted data, or are only a reference to data that is
7076
* actually stored elsewhere.
7177
*/
72-
private string regexpProbablySafe() { result = ".*(hash|crypt|file|path|url|invalid).*" }
78+
private string regexpProbablySafe() {
79+
result = HeuristicNames::notSensitiveRegexp() or
80+
result = "(?is).*(file|path|url|invalid).*"
81+
}
7382

7483
/**
7584
* A `VarDecl` that might be used to contain sensitive data.
7685
*/
7786
private class SensitiveVarDecl extends VarDecl {
7887
SensitiveDataType sensitiveType;
7988

80-
SensitiveVarDecl() { this.getName().toLowerCase().regexpMatch(sensitiveType.getRegexp()) }
89+
SensitiveVarDecl() { this.getName().regexpMatch(sensitiveType.getRegexp()) }
8190

8291
predicate hasInfo(string label, SensitiveDataType type) {
8392
label = this.getName() and
@@ -90,11 +99,15 @@ private class SensitiveVarDecl extends VarDecl {
9099
*/
91100
private class SensitiveFunction extends Function {
92101
SensitiveDataType sensitiveType;
102+
string name; // name of the function, not including the argument list.
93103

94-
SensitiveFunction() { this.getName().toLowerCase().regexpMatch(sensitiveType.getRegexp()) }
104+
SensitiveFunction() {
105+
name = this.getShortName() and
106+
name.regexpMatch(sensitiveType.getRegexp())
107+
}
95108

96109
predicate hasInfo(string label, SensitiveDataType type) {
97-
label = this.getName() and
110+
label = name and
98111
sensitiveType = type
99112
}
100113
}
@@ -105,7 +118,7 @@ private class SensitiveFunction extends Function {
105118
private class SensitiveArgument extends Argument {
106119
SensitiveDataType sensitiveType;
107120

108-
SensitiveArgument() { this.getLabel().toLowerCase().regexpMatch(sensitiveType.getRegexp()) }
121+
SensitiveArgument() { this.getLabel().regexpMatch(sensitiveType.getRegexp()) }
109122

110123
predicate hasInfo(string label, SensitiveDataType type) {
111124
label = this.getLabel() and
@@ -138,7 +151,7 @@ class SensitiveExpr extends Expr {
138151
)
139152
) and
140153
// do not mark as sensitive it if it is probably safe
141-
not label.toLowerCase().regexpMatch(regexpProbablySafe())
154+
not label.regexpMatch(regexpProbablySafe())
142155
}
143156

144157
/**
@@ -156,7 +169,7 @@ class SensitiveExpr extends Expr {
156169
* A function that is likely used to encrypt or hash data.
157170
*/
158171
private class EncryptionFunction extends Function {
159-
EncryptionFunction() { this.getName().regexpMatch(".*(crypt|hash|encode|protect).*") }
172+
EncryptionFunction() { this.getName().regexpMatch("(?is).*(crypt|hash|encode|protect).*") }
160173
}
161174

162175
/**

‎swift/ql/lib/codeql/swift/security/internal/SensitiveDataHeuristics.qll

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
/**
2+
* INTERNAL: Do not use.
3+
*
4+
* Provides classes and predicates for identifying strings that may indicate the presence of sensitive data.
5+
* Such that we can share this logic across our CodeQL analysis of different languages.
6+
*
7+
* 'Sensitive' data in general is anything that should not be sent around in unencrypted form.
8+
*/
9+
10+
/**
11+
* A classification of different kinds of sensitive data:
12+
*
13+
* - secret: generic secret or trusted data;
14+
* - id: a user name or other account information;
15+
* - password: a password or authorization key;
16+
* - certificate: a certificate.
17+
*
18+
* While classifications are represented as strings, this should not be relied upon.
19+
* Instead, use the predicates in `SensitiveDataClassification::` to work with
20+
* classifications.
21+
*/
22+
class SensitiveDataClassification extends string {
23+
SensitiveDataClassification() { this in ["secret", "id", "password", "certificate"] }
24+
}
25+
26+
/**
27+
* Provides predicates to select the different kinds of sensitive data we support.
28+
*/
29+
module SensitiveDataClassification {
30+
/** Gets the classification for secret or trusted data. */
31+
SensitiveDataClassification secret() { result = "secret" }
32+
33+
/** Gets the classification for user names or other account information. */
34+
SensitiveDataClassification id() { result = "id" }
35+
36+
/** Gets the classification for passwords or authorization keys. */
37+
SensitiveDataClassification password() { result = "password" }
38+
39+
/** Gets the classification for certificates. */
40+
SensitiveDataClassification certificate() { result = "certificate" }
41+
}
42+
43+
/**
44+
* INTERNAL: Do not use.
45+
*
46+
* Provides heuristics for identifying names related to sensitive information.
47+
*/
48+
module HeuristicNames {
49+
/**
50+
* Gets a regular expression that identifies strings that may indicate the presence of secret
51+
* or trusted data.
52+
*/
53+
string maybeSecret() { result = "(?is).*((?<!is|is_)secret|(?<!un|un_|is|is_)trusted).*" }
54+
55+
/**
56+
* Gets a regular expression that identifies strings that may indicate the presence of
57+
* user names or other account information.
58+
*/
59+
string maybeAccountInfo() {
60+
result = "(?is).*acc(ou)?nt.*" or
61+
result = "(?is).*(puid|username|userid|session(id|key)).*" or
62+
result = "(?s).*([uU]|^|_|[a-z](?=U))([uU][iI][dD]).*"
63+
}
64+
65+
/**
66+
* Gets a regular expression that identifies strings that may indicate the presence of
67+
* a password or an authorization key.
68+
*/
69+
string maybePassword() {
70+
result = "(?is).*pass(wd|word|code|phrase)(?!.*question).*" or
71+
result = "(?is).*(auth(entication|ori[sz]ation)?)key.*"
72+
}
73+
74+
/**
75+
* Gets a regular expression that identifies strings that may indicate the presence of
76+
* a certificate.
77+
*/
78+
string maybeCertificate() { result = "(?is).*(cert)(?!.*(format|name)).*" }
79+
80+
/**
81+
* Gets a regular expression that identifies strings that may indicate the presence
82+
* of sensitive data, with `classification` describing the kind of sensitive data involved.
83+
*/
84+
string maybeSensitiveRegexp(SensitiveDataClassification classification) {
85+
result = maybeSecret() and classification = SensitiveDataClassification::secret()
86+
or
87+
result = maybeAccountInfo() and classification = SensitiveDataClassification::id()
88+
or
89+
result = maybePassword() and classification = SensitiveDataClassification::password()
90+
or
91+
result = maybeCertificate() and
92+
classification = SensitiveDataClassification::certificate()
93+
}
94+
95+
/**
96+
* Gets a regular expression that identifies strings that may indicate the presence of data
97+
* that is hashed or encrypted, and hence rendered non-sensitive, or contains special characters
98+
* suggesting nouns within the string do not represent the meaning of the whole string (e.g. a URL or a SQL query).
99+
*
100+
* We also filter out common words like `certain` and `concert`, since otherwise these could
101+
* be matched by the certificate regular expressions. Same for `accountable` (account), or
102+
* `secretarial` (secret).
103+
*/
104+
string notSensitiveRegexp() {
105+
result =
106+
"(?is).*([^\\w$.-]|redact|censor|obfuscate|hash|md5|sha|random|((?<!un)(en))?(crypt|(?<!pass)code)|certain|concert|secretar|accountant|accountab).*"
107+
}
108+
109+
/**
110+
* Holds if `name` may indicate the presence of sensitive data, and
111+
* `name` does not indicate that the data is in fact non-sensitive (for example since
112+
* it is hashed or encrypted). `classification` describes the kind of sensitive data
113+
* involved.
114+
*
115+
* That is, one of the regexps from `maybeSensitiveRegexp` matches `name` (with the
116+
* given classification), and none of the regexps from `notSensitiveRegexp` matches
117+
* `name`.
118+
*/
119+
bindingset[name]
120+
predicate nameIndicatesSensitiveData(string name, SensitiveDataClassification classification) {
121+
name.regexpMatch(maybeSensitiveRegexp(classification)) and
122+
not name.regexpMatch(notSensitiveRegexp())
123+
}
124+
}

‎swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ edges
1313
| testSend.swift:54:17:54:17 | password | testSend.swift:41:10:41:18 | data |
1414
| testSend.swift:54:17:54:17 | password | testSend.swift:54:13:54:25 | call to pad(_:) |
1515
| testURL.swift:13:54:13:54 | passwd | testURL.swift:13:22:13:54 | ... .+(_:_:) ... |
16+
| testURL.swift:15:55:15:55 | account_no | testURL.swift:15:22:15:55 | ... .+(_:_:) ... |
1617
| testURL.swift:16:55:16:55 | credit_card_no | testURL.swift:16:22:16:55 | ... .+(_:_:) ... |
1718
nodes
1819
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) | semmle.label | [summary] to write: return (return) in Data.init(_:) |
@@ -40,6 +41,8 @@ nodes
4041
| testSend.swift:66:27:66:30 | .mobileNumber | semmle.label | .mobileNumber |
4142
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4243
| testURL.swift:13:54:13:54 | passwd | semmle.label | passwd |
44+
| testURL.swift:15:22:15:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
45+
| testURL.swift:15:55:15:55 | account_no | semmle.label | account_no |
4346
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4447
| testURL.swift:16:55:16:55 | credit_card_no | semmle.label | credit_card_no |
4548
| testURL.swift:20:22:20:22 | passwd | semmle.label | passwd |
@@ -58,5 +61,6 @@ subpaths
5861
| testSend.swift:65:27:65:27 | license_key | testSend.swift:65:27:65:27 | license_key | testSend.swift:65:27:65:27 | license_key | This operation transmits 'license_key', which may contain unencrypted sensitive data from $@. | testSend.swift:65:27:65:27 | license_key | license_key |
5962
| testSend.swift:66:27:66:30 | .mobileNumber | testSend.swift:66:27:66:30 | .mobileNumber | testSend.swift:66:27:66:30 | .mobileNumber | This operation transmits '.mobileNumber', which may contain unencrypted sensitive data from $@. | testSend.swift:66:27:66:30 | .mobileNumber | .mobileNumber |
6063
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | testURL.swift:13:54:13:54 | passwd | testURL.swift:13:22:13:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:13:54:13:54 | passwd | passwd |
64+
| testURL.swift:15:22:15:55 | ... .+(_:_:) ... | testURL.swift:15:55:15:55 | account_no | testURL.swift:15:22:15:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:15:55:15:55 | account_no | account_no |
6165
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | testURL.swift:16:55:16:55 | credit_card_no | testURL.swift:16:22:16:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:16:55:16:55 | credit_card_no | credit_card_no |
6266
| testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@. | testURL.swift:20:22:20:22 | passwd | passwd |

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,8 @@
5353
| testCoreData.swift:58:15:58:15 | password | label:password, type:credential |
5454
| testCoreData.swift:61:25:61:25 | password | label:password, type:credential |
5555
| testCoreData.swift:64:16:64:16 | password | label:password, type:credential |
56-
| testCoreData.swift:77:2:77:25 | call to doSomething(password:) | label:doSomething(password:), type:credential |
5756
| testCoreData.swift:77:24:77:24 | x | label:password, type:credential |
58-
| testCoreData.swift:80:10:80:22 | call to getPassword() | label:getPassword(), type:credential |
57+
| testCoreData.swift:80:10:80:22 | call to getPassword() | label:getPassword, type:credential |
5958
| testCoreData.swift:85:15:85:17 | .password | label:password, type:credential |
6059
| testCoreData.swift:91:10:91:10 | passwd | label:passwd, type:credential |
6160
| testCoreData.swift:92:10:92:10 | passwd | label:passwd, type:credential |
@@ -130,5 +129,6 @@
130129
| testSend.swift:66:27:66:30 | .mobileNumber | label:mobileNumber, type:private information |
131130
| testSend.swift:69:27:69:30 | .passwordFeatureEnabled | label:passwordFeatureEnabled, type:credential |
132131
| testURL.swift:13:54:13:54 | passwd | label:passwd, type:credential |
132+
| testURL.swift:15:55:15:55 | account_no | label:account_no, type:private information |
133133
| testURL.swift:16:55:16:55 | credit_card_no | label:credit_card_no, type:private information |
134134
| testURL.swift:20:22:20:22 | passwd | label:passwd, type:credential |

0 commit comments

Comments
 (0)