Skip to content

Commit 268db8b

Browse files
geoffw0geoffw0
authored
Merge pull request #3 from MathiasVP/add-puns-to-mad-2
Swift: Syntax for selecting `PostUpdateNode`s in CSV rows
2 parents bfbd45a + 6dc6e13 commit 268db8b

File tree

7 files changed

+37
-31
lines changed

7 files changed

+37
-31
lines changed

‎swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -200,14 +200,19 @@ predicate interpretOutputSpecific(string c, InterpretNode mid, InterpretNode nod
200200
}
201201

202202
predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode node) {
203-
// Allow fields to be picked as input nodes.
204203
exists(Node n, AstNode ast, MemberRefExpr e |
205204
n = node.asNode() and
206-
ast = mid.asElement()
205+
ast = mid.asElement() and
206+
e.getMember() = ast
207207
|
208+
// Allow fields to be picked as input nodes.
208209
c = "" and
209-
e.getBase() = n.asExpr() and
210-
e.getMember() = ast
210+
e.getBase() = n.asExpr()
211+
or
212+
// Allow post update nodes to be picked as input nodes when the `input` column
213+
// of the row is `PostUpdate`.
214+
c = "PostUpdate" and
215+
e.getBase() = n.(PostUpdateNode).getPreUpdateNode().asExpr()
211216
)
212217
}
213218

‎swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPublic.qll

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,14 @@ predicate localTaintStep = localTaintStepCached/2;
2626
* of `c` at sinks and inputs to additional taint steps.
2727
*/
2828
bindingset[node]
29-
predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) { none() }
29+
predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet cs) {
30+
// If a `PostUpdateNode` is specified as a sink, there's (almost) always a store step preceding it.
31+
// So when the node is a `PostUpdateNode` we allow any sequence of implicit read steps of an appropriate
32+
// type to make sure we arrive at the sink with an empty access path.
33+
exists(NominalTypeDecl d, Decl cx |
34+
node.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr().getType() =
35+
d.getType().getABaseType*() and
36+
cx.asNominalTypeDecl() = d and
37+
cs.getAReadContent().(DataFlow::Content::FieldContent).getField() = cx.getAMember()
38+
)
39+
}

‎swift/ql/lib/codeql/swift/elements/type/DynamicSelfType.qll

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
1-
// generated by codegen/codegen.py, remove this comment if you wish to edit this file
21
private import codeql.swift.generated.type.DynamicSelfType
32

4-
class DynamicSelfType extends Generated::DynamicSelfType { }
3+
class DynamicSelfType extends Generated::DynamicSelfType {
4+
override Type getResolveStep() {
5+
// The type of qualifiers in a Swift constructor is assigned the type `Self` by the Swift compiler
6+
// This `getResolveStep` replaces that `Self` type with the type of the enclosing class.
7+
result = this.getImmediateStaticSelfType()
8+
}
9+
}

‎swift/ql/lib/codeql/swift/security/InsecureTLSExtensions.qll

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,10 @@ private class TlsExtensionsSinks extends SinkModelCsv {
5050
row =
5151
[
5252
// TLS-related properties of `URLSessionConfiguration`
53-
";URLSessionConfiguration;false;tlsMinimumSupportedProtocolVersion;;;;tls-protocol-version",
54-
";URLSessionConfiguration;false;tlsMinimumSupportedProtocol;;;;tls-protocol-version",
55-
";URLSessionConfiguration;false;tlsMaximumSupportedProtocolVersion;;;;tls-protocol-version",
56-
";URLSessionConfiguration;false;tlsMaximumSupportedProtocol;;;;tls-protocol-version",
53+
";URLSessionConfiguration;false;tlsMinimumSupportedProtocolVersion;;;PostUpdate;tls-protocol-version",
54+
";URLSessionConfiguration;false;tlsMinimumSupportedProtocol;;;PostUpdate;tls-protocol-version",
55+
";URLSessionConfiguration;false;tlsMaximumSupportedProtocolVersion;;;PostUpdate;tls-protocol-version",
56+
";URLSessionConfiguration;false;tlsMaximumSupportedProtocol;;;PostUpdate;tls-protocol-version",
5757
]
5858
}
5959
}
@@ -62,7 +62,5 @@ private class TlsExtensionsSinks extends SinkModelCsv {
6262
* A sink defined in a CSV model.
6363
*/
6464
private class DefaultTlsExtensionsSink extends InsecureTlsExtensionsSink {
65-
DefaultTlsExtensionsSink() {
66-
sinkNode(this.(DataFlow::PostUpdateNode).getPreUpdateNode(), "tls-protocol-version")
67-
}
65+
DefaultTlsExtensionsSink() { sinkNode(this, "tls-protocol-version") }
6866
}

‎swift/ql/lib/codeql/swift/security/InsecureTLSQuery.qll

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,6 @@ module InsecureTlsConfig implements DataFlow::ConfigSig {
2222
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
2323
any(InsecureTlsExtensionsAdditionalTaintStep s).step(nodeFrom, nodeTo)
2424
}
25-
26-
predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
27-
// flow out from fields of an `URLSessionConfiguration` at the sink,
28-
// for example in `sessionConfig.tlsMaximumSupportedProtocolVersion = tls_protocol_version_t.TLSv10`.
29-
isSink(node) and
30-
exists(NominalTypeDecl d, Decl cx |
31-
d.getType().getABaseType*().getUnderlyingType().getName() = "URLSessionConfiguration" and
32-
cx.asNominalTypeDecl() = d and
33-
c.getAReadContent().(DataFlow::Content::FieldContent).getField() = cx.getAMember()
34-
)
35-
}
3625
}
3726

3827
module InsecureTlsFlow = TaintTracking::Global<InsecureTlsConfig>;

‎swift/ql/test/extractor-tests/generated/type/DynamicSelfType/DynamicSelfType.expected

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +0,0 @@
1-
| Self | getName: | Self | getCanonicalType: | Self | getStaticSelfType: | X |

‎swift/ql/test/library-tests/dataflow/dataflow/DataFlow.expected

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ edges
235235
| test.swift:536:10:536:13 | s : | test.swift:537:13:537:13 | s : |
236236
| test.swift:537:7:537:7 | [post] self [str] : | test.swift:536:5:538:5 | self[return] [str] : |
237237
| test.swift:537:13:537:13 | s : | test.swift:537:7:537:7 | [post] self [str] : |
238-
| test.swift:542:17:545:5 | self[return] [str] : | test.swift:550:13:550:41 | call to Self.init(contentsOfFile:) [str] : |
238+
| test.swift:542:17:545:5 | self[return] [str] : | test.swift:550:13:550:41 | call to MyClass.init(contentsOfFile:) [str] : |
239239
| test.swift:543:7:543:7 | [post] self [str] : | test.swift:542:17:545:5 | self[return] [str] : |
240240
| test.swift:543:7:543:7 | [post] self [str] : | test.swift:544:17:544:17 | self [str] : |
241241
| test.swift:543:20:543:28 | call to source3() : | test.swift:536:10:536:13 | s : |
@@ -245,8 +245,8 @@ edges
245245
| test.swift:549:13:549:33 | call to MyClass.init(s:) [str] : | test.swift:549:13:549:35 | .str |
246246
| test.swift:549:24:549:32 | call to source3() : | test.swift:536:10:536:13 | s : |
247247
| test.swift:549:24:549:32 | call to source3() : | test.swift:549:13:549:33 | call to MyClass.init(s:) [str] : |
248-
| test.swift:550:13:550:41 | call to Self.init(contentsOfFile:) [str] : | test.swift:535:9:535:9 | self [str] : |
249-
| test.swift:550:13:550:41 | call to Self.init(contentsOfFile:) [str] : | test.swift:550:13:550:43 | .str |
248+
| test.swift:550:13:550:41 | call to MyClass.init(contentsOfFile:) [str] : | test.swift:535:9:535:9 | self [str] : |
249+
| test.swift:550:13:550:41 | call to MyClass.init(contentsOfFile:) [str] : | test.swift:550:13:550:43 | .str |
250250
| test.swift:567:8:567:11 | x : | test.swift:568:14:568:14 | x : |
251251
| test.swift:568:5:568:5 | [post] self [x] : | test.swift:567:3:569:3 | self[return] [x] : |
252252
| test.swift:568:14:568:14 | x : | test.swift:568:5:568:5 | [post] self [x] : |
@@ -541,7 +541,7 @@ nodes
541541
| test.swift:549:13:549:33 | call to MyClass.init(s:) [str] : | semmle.label | call to MyClass.init(s:) [str] : |
542542
| test.swift:549:13:549:35 | .str | semmle.label | .str |
543543
| test.swift:549:24:549:32 | call to source3() : | semmle.label | call to source3() : |
544-
| test.swift:550:13:550:41 | call to Self.init(contentsOfFile:) [str] : | semmle.label | call to Self.init(contentsOfFile:) [str] : |
544+
| test.swift:550:13:550:41 | call to MyClass.init(contentsOfFile:) [str] : | semmle.label | call to MyClass.init(contentsOfFile:) [str] : |
545545
| test.swift:550:13:550:43 | .str | semmle.label | .str |
546546
| test.swift:567:3:569:3 | self[return] [x] : | semmle.label | self[return] [x] : |
547547
| test.swift:567:8:567:11 | x : | semmle.label | x : |
@@ -609,7 +609,7 @@ subpaths
609609
| test.swift:543:20:543:28 | call to source3() : | test.swift:536:10:536:13 | s : | test.swift:537:7:537:7 | [post] self [str] : | test.swift:543:7:543:7 | [post] self [str] : |
610610
| test.swift:549:13:549:33 | call to MyClass.init(s:) [str] : | test.swift:535:9:535:9 | self [str] : | file://:0:0:0:0 | .str : | test.swift:549:13:549:35 | .str |
611611
| test.swift:549:24:549:32 | call to source3() : | test.swift:536:10:536:13 | s : | test.swift:536:5:538:5 | self[return] [str] : | test.swift:549:13:549:33 | call to MyClass.init(s:) [str] : |
612-
| test.swift:550:13:550:41 | call to Self.init(contentsOfFile:) [str] : | test.swift:535:9:535:9 | self [str] : | file://:0:0:0:0 | .str : | test.swift:550:13:550:43 | .str |
612+
| test.swift:550:13:550:41 | call to MyClass.init(contentsOfFile:) [str] : | test.swift:535:9:535:9 | self [str] : | file://:0:0:0:0 | .str : | test.swift:550:13:550:43 | .str |
613613
| test.swift:573:16:573:23 | call to source() : | test.swift:567:8:567:11 | x : | test.swift:567:3:569:3 | self[return] [x] : | test.swift:573:11:573:24 | call to S.init(x:) [x] : |
614614
| test.swift:575:13:575:13 | s [x] : | test.swift:574:11:574:14 | enter #keyPath(...) [x] : | test.swift:574:11:574:14 | exit #keyPath(...) : | test.swift:575:13:575:25 | \\...[...] |
615615
| test.swift:578:13:578:13 | s [x] : | test.swift:577:36:577:38 | enter #keyPath(...) [x] : | test.swift:577:36:577:38 | exit #keyPath(...) : | test.swift:578:13:578:32 | \\...[...] |

0 commit comments

Comments
 (0)