Skip to content

Commit 0e443da

Browse files
geoffw0geoffw0
committed
Swift: Remove id() categorization due to accuracy, and repair the old bank.?account case.
1 parent 5019d3b commit 0e443da

File tree

6 files changed

+53
-70
lines changed

6 files changed

+53
-70
lines changed

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@ class SensitiveCredential extends SensitiveDataType, TCredential {
3030
override string toString() { result = "credential" }
3131

3232
override string getRegexp() {
33-
result = HeuristicNames::maybeSensitiveRegexp(_) or
33+
exists(SensitiveDataClassification classification |
34+
not classification = SensitiveDataClassification::id() and // not accurate enough
35+
result = HeuristicNames::maybeSensitiveRegexp(classification)
36+
)
37+
or
3438
result = "(?is).*(license.?key).*"
3539
}
3640
}
@@ -54,7 +58,7 @@ class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
5458
// Geographic location - where the user is (or was)
5559
"latitude|longitude|" +
5660
// Financial data - such as credit card numbers, salary, bank accounts, and debts
57-
"credit.?card|debit.?card|salary|" +
61+
"credit.?card|debit.?card|salary|bank.?account|" +
5862
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
5963
"email|" +
6064
// Health - medical conditions, insurance status, prescription records

‎swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ edges
1313
| testSend.swift:54:17:54:17 | password | testSend.swift:41:10:41:18 | data |
1414
| testSend.swift:54:17:54:17 | password | testSend.swift:54:13:54:25 | call to pad(_:) |
1515
| testURL.swift:13:54:13:54 | passwd | testURL.swift:13:22:13:54 | ... .+(_:_:) ... |
16-
| testURL.swift:15:55:15:55 | account_no | testURL.swift:15:22:15:55 | ... .+(_:_:) ... |
1716
| testURL.swift:16:55:16:55 | credit_card_no | testURL.swift:16:22:16:55 | ... .+(_:_:) ... |
1817
nodes
1918
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) | semmle.label | [summary] to write: return (return) in Data.init(_:) |
@@ -41,8 +40,6 @@ nodes
4140
| testSend.swift:66:27:66:30 | .mobileNumber | semmle.label | .mobileNumber |
4241
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4342
| testURL.swift:13:54:13:54 | passwd | semmle.label | passwd |
44-
| testURL.swift:15:22:15:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
45-
| testURL.swift:15:55:15:55 | account_no | semmle.label | account_no |
4643
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4744
| testURL.swift:16:55:16:55 | credit_card_no | semmle.label | credit_card_no |
4845
| testURL.swift:20:22:20:22 | passwd | semmle.label | passwd |
@@ -61,6 +58,5 @@ subpaths
6158
| testSend.swift:65:27:65:27 | license_key | testSend.swift:65:27:65:27 | license_key | testSend.swift:65:27:65:27 | license_key | This operation transmits 'license_key', which may contain unencrypted sensitive data from $@. | testSend.swift:65:27:65:27 | license_key | license_key |
6259
| testSend.swift:66:27:66:30 | .mobileNumber | testSend.swift:66:27:66:30 | .mobileNumber | testSend.swift:66:27:66:30 | .mobileNumber | This operation transmits '.mobileNumber', which may contain unencrypted sensitive data from $@. | testSend.swift:66:27:66:30 | .mobileNumber | .mobileNumber |
6360
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | testURL.swift:13:54:13:54 | passwd | testURL.swift:13:22:13:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:13:54:13:54 | passwd | passwd |
64-
| testURL.swift:15:22:15:55 | ... .+(_:_:) ... | testURL.swift:15:55:15:55 | account_no | testURL.swift:15:22:15:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:15:55:15:55 | account_no | account_no |
6561
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | testURL.swift:16:55:16:55 | credit_card_no | testURL.swift:16:22:16:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:16:55:16:55 | credit_card_no | credit_card_no |
6662
| testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@. | testURL.swift:20:22:20:22 | passwd | passwd |

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 40 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -4,54 +4,50 @@
44
| testAlamofire.swift:159:26:159:26 | email | label:email, type:private information |
55
| testAlamofire.swift:171:35:171:35 | email | label:email, type:private information |
66
| testAlamofire.swift:177:35:177:35 | email | label:email, type:private information |
7-
| testAlamofire.swift:187:48:187:48 | username | label:username, type:credential |
87
| testAlamofire.swift:187:65:187:65 | password | label:password, type:credential |
9-
| testAlamofire.swift:195:47:195:47 | username | label:username, type:credential |
108
| testAlamofire.swift:195:64:195:64 | password | label:password, type:credential |
11-
| testAlamofire.swift:205:45:205:45 | username | label:username, type:credential |
129
| testAlamofire.swift:205:62:205:62 | password | label:password, type:credential |
13-
| testAlamofire.swift:213:48:213:48 | username | label:username, type:credential |
1410
| testAlamofire.swift:213:65:213:65 | password | label:password, type:credential |
15-
| testCoreData2.swift:37:16:37:16 | bankAccountNo | label:bankAccountNo, type:credential |
16-
| testCoreData2.swift:38:2:38:6 | .myBankAccountNumber | label:myBankAccountNumber, type:credential |
17-
| testCoreData2.swift:39:2:39:6 | .myBankAccountNumber | label:myBankAccountNumber, type:credential |
18-
| testCoreData2.swift:39:28:39:28 | bankAccountNo | label:bankAccountNo, type:credential |
19-
| testCoreData2.swift:40:2:40:6 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:credential |
20-
| testCoreData2.swift:41:2:41:6 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:credential |
21-
| testCoreData2.swift:41:29:41:29 | bankAccountNo | label:bankAccountNo, type:credential |
22-
| testCoreData2.swift:42:2:42:6 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:credential |
23-
| testCoreData2.swift:43:2:43:6 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:credential |
24-
| testCoreData2.swift:43:35:43:35 | bankAccountNo | label:bankAccountNo, type:credential |
25-
| testCoreData2.swift:46:22:46:22 | bankAccountNo | label:bankAccountNo, type:credential |
26-
| testCoreData2.swift:47:2:47:12 | .myBankAccountNumber | label:myBankAccountNumber, type:credential |
27-
| testCoreData2.swift:48:2:48:12 | .myBankAccountNumber | label:myBankAccountNumber, type:credential |
28-
| testCoreData2.swift:48:34:48:34 | bankAccountNo | label:bankAccountNo, type:credential |
29-
| testCoreData2.swift:49:2:49:12 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:credential |
30-
| testCoreData2.swift:50:2:50:12 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:credential |
31-
| testCoreData2.swift:50:35:50:35 | bankAccountNo | label:bankAccountNo, type:credential |
32-
| testCoreData2.swift:51:2:51:12 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:credential |
33-
| testCoreData2.swift:52:2:52:12 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:credential |
34-
| testCoreData2.swift:52:41:52:41 | bankAccountNo | label:bankAccountNo, type:credential |
35-
| testCoreData2.swift:57:3:57:7 | .myBankAccountNumber | label:myBankAccountNumber, type:credential |
36-
| testCoreData2.swift:57:29:57:29 | bankAccountNo | label:bankAccountNo, type:credential |
37-
| testCoreData2.swift:60:4:60:8 | .myBankAccountNumber | label:myBankAccountNumber, type:credential |
38-
| testCoreData2.swift:60:30:60:30 | bankAccountNo | label:bankAccountNo, type:credential |
39-
| testCoreData2.swift:62:4:62:8 | .myBankAccountNumber | label:myBankAccountNumber, type:credential |
40-
| testCoreData2.swift:62:30:62:30 | bankAccountNo | label:bankAccountNo, type:credential |
41-
| testCoreData2.swift:65:3:65:7 | .myBankAccountNumber | label:myBankAccountNumber, type:credential |
42-
| testCoreData2.swift:65:29:65:29 | bankAccountNo | label:bankAccountNo, type:credential |
43-
| testCoreData2.swift:79:18:79:28 | .bankAccountNo | label:bankAccountNo, type:credential |
44-
| testCoreData2.swift:80:18:80:28 | .bankAccountNo2 | label:bankAccountNo2, type:credential |
45-
| testCoreData2.swift:82:18:82:18 | bankAccountNo | label:bankAccountNo, type:credential |
46-
| testCoreData2.swift:83:18:83:18 | bankAccountNo | label:bankAccountNo, type:credential |
47-
| testCoreData2.swift:84:18:84:18 | bankAccountNo2 | label:bankAccountNo2, type:credential |
48-
| testCoreData2.swift:85:18:85:18 | bankAccountNo2 | label:bankAccountNo2, type:credential |
49-
| testCoreData2.swift:87:22:87:32 | .bankAccountNo | label:bankAccountNo, type:credential |
50-
| testCoreData2.swift:88:22:88:22 | bankAccountNo | label:bankAccountNo, type:credential |
51-
| testCoreData2.swift:89:22:89:22 | bankAccountNo2 | label:bankAccountNo2, type:credential |
52-
| testCoreData2.swift:91:10:91:10 | bankAccountNo | label:bankAccountNo, type:credential |
53-
| testCoreData2.swift:95:10:95:10 | bankAccountNo | label:bankAccountNo, type:credential |
54-
| testCoreData2.swift:101:10:101:10 | bankAccountNo | label:bankAccountNo, type:credential |
11+
| testCoreData2.swift:37:16:37:16 | bankAccountNo | label:bankAccountNo, type:private information |
12+
| testCoreData2.swift:38:2:38:6 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
13+
| testCoreData2.swift:39:2:39:6 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
14+
| testCoreData2.swift:39:28:39:28 | bankAccountNo | label:bankAccountNo, type:private information |
15+
| testCoreData2.swift:40:2:40:6 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:private information |
16+
| testCoreData2.swift:41:2:41:6 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:private information |
17+
| testCoreData2.swift:41:29:41:29 | bankAccountNo | label:bankAccountNo, type:private information |
18+
| testCoreData2.swift:42:2:42:6 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:private information |
19+
| testCoreData2.swift:43:2:43:6 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:private information |
20+
| testCoreData2.swift:43:35:43:35 | bankAccountNo | label:bankAccountNo, type:private information |
21+
| testCoreData2.swift:46:22:46:22 | bankAccountNo | label:bankAccountNo, type:private information |
22+
| testCoreData2.swift:47:2:47:12 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
23+
| testCoreData2.swift:48:2:48:12 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
24+
| testCoreData2.swift:48:34:48:34 | bankAccountNo | label:bankAccountNo, type:private information |
25+
| testCoreData2.swift:49:2:49:12 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:private information |
26+
| testCoreData2.swift:50:2:50:12 | .myBankAccountNumber2 | label:myBankAccountNumber2, type:private information |
27+
| testCoreData2.swift:50:35:50:35 | bankAccountNo | label:bankAccountNo, type:private information |
28+
| testCoreData2.swift:51:2:51:12 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:private information |
29+
| testCoreData2.swift:52:2:52:12 | .notStoredBankAccountNumber | label:notStoredBankAccountNumber, type:private information |
30+
| testCoreData2.swift:52:41:52:41 | bankAccountNo | label:bankAccountNo, type:private information |
31+
| testCoreData2.swift:57:3:57:7 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
32+
| testCoreData2.swift:57:29:57:29 | bankAccountNo | label:bankAccountNo, type:private information |
33+
| testCoreData2.swift:60:4:60:8 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
34+
| testCoreData2.swift:60:30:60:30 | bankAccountNo | label:bankAccountNo, type:private information |
35+
| testCoreData2.swift:62:4:62:8 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
36+
| testCoreData2.swift:62:30:62:30 | bankAccountNo | label:bankAccountNo, type:private information |
37+
| testCoreData2.swift:65:3:65:7 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
38+
| testCoreData2.swift:65:29:65:29 | bankAccountNo | label:bankAccountNo, type:private information |
39+
| testCoreData2.swift:79:18:79:28 | .bankAccountNo | label:bankAccountNo, type:private information |
40+
| testCoreData2.swift:80:18:80:28 | .bankAccountNo2 | label:bankAccountNo2, type:private information |
41+
| testCoreData2.swift:82:18:82:18 | bankAccountNo | label:bankAccountNo, type:private information |
42+
| testCoreData2.swift:83:18:83:18 | bankAccountNo | label:bankAccountNo, type:private information |
43+
| testCoreData2.swift:84:18:84:18 | bankAccountNo2 | label:bankAccountNo2, type:private information |
44+
| testCoreData2.swift:85:18:85:18 | bankAccountNo2 | label:bankAccountNo2, type:private information |
45+
| testCoreData2.swift:87:22:87:32 | .bankAccountNo | label:bankAccountNo, type:private information |
46+
| testCoreData2.swift:88:22:88:22 | bankAccountNo | label:bankAccountNo, type:private information |
47+
| testCoreData2.swift:89:22:89:22 | bankAccountNo2 | label:bankAccountNo2, type:private information |
48+
| testCoreData2.swift:91:10:91:10 | bankAccountNo | label:bankAccountNo, type:private information |
49+
| testCoreData2.swift:95:10:95:10 | bankAccountNo | label:bankAccountNo, type:private information |
50+
| testCoreData2.swift:101:10:101:10 | bankAccountNo | label:bankAccountNo, type:private information |
5551
| testCoreData.swift:48:15:48:15 | password | label:password, type:credential |
5652
| testCoreData.swift:51:24:51:24 | password | label:password, type:credential |
5753
| testCoreData.swift:58:15:58:15 | password | label:password, type:credential |
@@ -133,6 +129,5 @@
133129
| testSend.swift:66:27:66:30 | .mobileNumber | label:mobileNumber, type:private information |
134130
| testSend.swift:69:27:69:30 | .passwordFeatureEnabled | label:passwordFeatureEnabled, type:credential |
135131
| testURL.swift:13:54:13:54 | passwd | label:passwd, type:credential |
136-
| testURL.swift:15:55:15:55 | account_no | label:account_no, type:credential |
137132
| testURL.swift:16:55:16:55 | credit_card_no | label:credit_card_no, type:private information |
138133
| testURL.swift:20:22:20:22 | passwd | label:passwd, type:credential |

‎swift/ql/test/query-tests/Security/CWE-311/testURL.swift

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ struct URL
1212
func test1(passwd : String, encrypted_passwd : String, account_no : String, credit_card_no : String) {
1313
let a = URL(string: "http://example.com/login?p=" + passwd); // BAD
1414
let b = URL(string: "http://example.com/login?p=" + encrypted_passwd); // GOOD (not sensitive)
15-
let c = URL(string: "http://example.com/login?ac=" + account_no); // BAD
15+
let c = URL(string: "http://example.com/login?ac=" + account_no); // BAD [NOT DETECTED]
1616
let d = URL(string: "http://example.com/login?cc=" + credit_card_no); // BAD
1717

1818
let base = URL(string: "http://example.com/"); // GOOD (not sensitive)

0 commit comments

Comments
 (0)