|
| 1 | + |
| 2 | +// --- stubs --- |
| 3 | + |
| 4 | +struct URL { |
| 5 | + init?(string: String) {} |
| 6 | +} |
| 7 | + |
| 8 | +extension String { |
| 9 | + init(contentsOf: URL) { |
| 10 | + let data = "" |
| 11 | + self.init(data) |
| 12 | + } |
| 13 | +} |
| 14 | + |
| 15 | +struct AnyRegexOutput { |
| 16 | +} |
| 17 | + |
| 18 | +protocol RegexComponent<RegexOutput> { |
| 19 | + associatedtype RegexOutput |
| 20 | +} |
| 21 | + |
| 22 | +struct Regex<Output> : RegexComponent { |
| 23 | + struct Match { |
| 24 | + } |
| 25 | + |
| 26 | + init(_ pattern: String) throws where Output == AnyRegexOutput { } |
| 27 | + |
| 28 | + func ignoresCase(_ ignoresCase: Bool = true) -> Regex<Regex<Output>.RegexOutput> { return self } |
| 29 | + func dotMatchesNewlines(_ dotMatchesNewlines: Bool = true) -> Regex<Regex<Output>.RegexOutput> { return self } |
| 30 | + |
| 31 | + func firstMatch(in string: String) throws -> Regex<Output>.Match? { return nil} |
| 32 | + |
| 33 | + typealias RegexOutput = Output |
| 34 | +} |
| 35 | + |
| 36 | +extension String : RegexComponent { |
| 37 | + typealias Output = Substring |
| 38 | + typealias RegexOutput = String.Output |
| 39 | +} |
| 40 | + |
| 41 | +class NSObject { |
| 42 | +} |
| 43 | + |
| 44 | +struct _NSRange { |
| 45 | + init(location: Int, length: Int) { } |
| 46 | +} |
| 47 | + |
| 48 | +typealias NSRange = _NSRange |
| 49 | + |
| 50 | +func NSMakeRange(_ loc: Int, _ len: Int) -> NSRange { return NSRange(location: loc, length: len) } |
| 51 | + |
| 52 | +class NSTextCheckingResult : NSObject { |
| 53 | +} |
| 54 | + |
| 55 | +class NSRegularExpression : NSObject { |
| 56 | + struct Options : OptionSet { |
| 57 | + var rawValue: UInt |
| 58 | + |
| 59 | + static var caseInsensitive: NSRegularExpression.Options { get { return Options(rawValue: 1 << 0) } } |
| 60 | + static var dotMatchesLineSeparators: NSRegularExpression.Options { get { return Options(rawValue: 1 << 1) } } |
| 61 | + } |
| 62 | + |
| 63 | + struct MatchingOptions : OptionSet { |
| 64 | + var rawValue: UInt |
| 65 | + } |
| 66 | + |
| 67 | + init(pattern: String, options: NSRegularExpression.Options = []) throws { } |
| 68 | + |
| 69 | + func matches(in string: String, options: NSRegularExpression.MatchingOptions = [], range: NSRange) -> [NSTextCheckingResult] { return [] } |
| 70 | + func firstMatch(in string: String, options: NSRegularExpression.MatchingOptions = [], range: NSRange) -> NSTextCheckingResult? { return nil } |
| 71 | +} |
| 72 | + |
| 73 | +// --- tests --- |
| 74 | + |
| 75 | +func myRegexpVariantsTests(myUrl: URL) throws { |
| 76 | + let tainted = String(contentsOf: myUrl) // tainted |
| 77 | + |
| 78 | + // BAD - doesn't match newlines or `</script >` |
| 79 | + let re1 = try Regex(#"<script.*?>.*?<\/script>"#).ignoresCase(true) |
| 80 | + _ = try re1.firstMatch(in: tainted) |
| 81 | + |
| 82 | + // BAD - doesn't match `</script >` [NOT DETECTED - all regexs with mode flags are currently missed by the query] |
| 83 | + let re2a = try Regex(#"(?is)<script.*?>.*?<\/script>"#) |
| 84 | + _ = try re2a.firstMatch(in: tainted) |
| 85 | + // BAD - doesn't match `</script >` |
| 86 | + let re2b = try Regex(#"<script.*?>.*?<\/script>"#).ignoresCase(true).dotMatchesNewlines(true) |
| 87 | + _ = try re2b.firstMatch(in: tainted) |
| 88 | + // BAD - doesn't match `</script >` |
| 89 | + let options2c: NSRegularExpression.Options = [.caseInsensitive, .dotMatchesLineSeparators] |
| 90 | + let ns2c = try NSRegularExpression(pattern: #"<script.*?>.*?<\/script>"#, options: options2c) |
| 91 | + _ = ns2c.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 92 | + |
| 93 | + // GOOD |
| 94 | + let re3a = try Regex(#"(?is)<script.*?>.*?<\/script[^>]*>"#) |
| 95 | + _ = try re3a.firstMatch(in: tainted) |
| 96 | + // GOOD |
| 97 | + let re3b = try Regex(#"<script.*?>.*?<\/script[^>]*>"#).ignoresCase(true).dotMatchesNewlines(true) |
| 98 | + _ = try re3b.firstMatch(in: tainted) |
| 99 | + // GOOD |
| 100 | + let options3b: NSRegularExpression.Options = [.caseInsensitive, .dotMatchesLineSeparators] |
| 101 | + let ns3b = try NSRegularExpression(pattern: #"<script.*?>.*?<\/script[^>]*>"#, options: options3b) |
| 102 | + _ = ns3b.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 103 | + |
| 104 | + // GOOD - we don't care regexps that only match comments |
| 105 | + let re4 = try Regex(#"<!--.*-->"#).ignoresCase(true).dotMatchesNewlines(true) |
| 106 | + _ = try re4.firstMatch(in: tainted) |
| 107 | + |
| 108 | + // GOOD |
| 109 | + let re5 = try Regex(#"<!--.*--!?>"#).ignoresCase(true).dotMatchesNewlines(true) |
| 110 | + _ = try re5.firstMatch(in: tainted) |
| 111 | + |
| 112 | + // BAD, does not match newlines |
| 113 | + let re6 = try Regex(#"<!--.*--!?>"#).ignoresCase(true) |
| 114 | + _ = try re6.firstMatch(in: tainted) |
| 115 | + |
| 116 | + // BAD - doesn't match newlines inside the script tag |
| 117 | + let re7 = try Regex(#"<script.*?>(.|\s)*?<\/script[^>]*>"#).ignoresCase(true) |
| 118 | + _ = try re7.firstMatch(in: tainted) |
| 119 | + |
| 120 | + // BAD - doesn't match newlines inside the content |
| 121 | + let re8 = try Regex(#"<script[^>]*?>.*?<\/script[^>]*>"#).ignoresCase(true) |
| 122 | + _ = try re8.firstMatch(in: tainted) |
| 123 | + |
| 124 | + // BAD - does not match single quotes for attribute values |
| 125 | + let re9 = try Regex(#"<script(\s|\w|=|")*?>.*?<\/script[^>]*>"#).ignoresCase(true).dotMatchesNewlines(true) |
| 126 | + _ = try re9.firstMatch(in: tainted) |
| 127 | + |
| 128 | + // BAD - does not match double quotes for attribute values [NOT DETECTED] |
| 129 | + let re10a = try Regex(#"(?is)<script(\s|\w|=|')*?>.*?<\/script[^>]*>"#) |
| 130 | + _ = try re10a.firstMatch(in: tainted) |
| 131 | + // BAD - does not match double quotes for attribute values |
| 132 | + let re10b = try Regex(#"<script(\s|\w|=|')*?>.*?<\/script[^>]*>"#).ignoresCase(true).dotMatchesNewlines(true) |
| 133 | + _ = try re10b.firstMatch(in: tainted) |
| 134 | + // BAD - does not match double quotes for attribute values |
| 135 | + let options10: NSRegularExpression.Options = [.caseInsensitive, .dotMatchesLineSeparators] |
| 136 | + let ns10 = try NSRegularExpression(pattern: #"<script(\s|\w|=|')*?>.*?<\/script[^>]*>"#, options: options10) |
| 137 | + _ = ns10.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 138 | + |
| 139 | + // BAD - does not match tabs between attributes [NOT DETECTED] |
| 140 | + let re11a = try Regex(#"(?is)<script( |\n|\w|=|'|")*?>.*?<\/script[^>]*>"#) |
| 141 | + _ = try re11a.firstMatch(in: tainted) |
| 142 | + // BAD - does not match tabs between attributes |
| 143 | + let re11b = try Regex(#"<script( |\n|\w|=|'|")*?>.*?<\/script[^>]*>"#).ignoresCase(true).dotMatchesNewlines(true) |
| 144 | + _ = try re11b.firstMatch(in: tainted) |
| 145 | + // BAD - does not match tabs between attributes |
| 146 | + let options11: NSRegularExpression.Options = [.caseInsensitive, .dotMatchesLineSeparators] |
| 147 | + let ns11 = try NSRegularExpression(pattern: #"<script( |\n|\w|=|'|")*?>.*?<\/script[^>]*>"#, options: options11) |
| 148 | + _ = ns11.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 149 | + |
| 150 | + // BAD - does not match uppercase SCRIPT tags [NOT DETECTED] |
| 151 | + let re12a = try Regex(#"(?s)<script.*?>.*?<\/script[^>]*>"#) |
| 152 | + _ = try re12a.firstMatch(in: tainted) |
| 153 | + // BAD - does not match uppercase SCRIPT tags |
| 154 | + let re12b = try Regex(#"<script.*?>.*?<\/script[^>]*>"#).dotMatchesNewlines(true) |
| 155 | + _ = try re12b.firstMatch(in: tainted) |
| 156 | + // BAD - does not match uppercase SCRIPT tags |
| 157 | + let ns12 = try NSRegularExpression(pattern: #"<script.*?>.*?<\/script[^>]*>"#, options: .dotMatchesLineSeparators) |
| 158 | + _ = ns12.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 159 | + |
| 160 | + // BAD - does not match mixed case script tags [NOT DETECTED] |
| 161 | + let re13a = try Regex(#"(?s)<(script|SCRIPT).*?>.*?<\/(script|SCRIPT)[^>]*>"#) |
| 162 | + _ = try re13a.firstMatch(in: tainted) |
| 163 | + // BAD - does not match mixed case script tags |
| 164 | + let re13b = try Regex(#"<(script|SCRIPT).*?>.*?<\/(script|SCRIPT)[^>]*>"#).dotMatchesNewlines(true) |
| 165 | + _ = try re13b.firstMatch(in: tainted) |
| 166 | + // BAD - does not match mixed case script tags |
| 167 | + let ns13 = try NSRegularExpression(pattern: #"<(script|SCRIPT).*?>.*?<\/(script|SCRIPT)[^>]*>"#, options: .dotMatchesLineSeparators) |
| 168 | + _ = ns13.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 169 | + |
| 170 | + // BAD - doesn't match newlines in the end tag [NOT DETECTED] |
| 171 | + let re14a = try Regex(#"(?i)<script[^>]*?>[\s\S]*?<\/script.*>"#) |
| 172 | + _ = try re14a.firstMatch(in: tainted) |
| 173 | + // BAD - doesn't match newlines in the end tag |
| 174 | + let re14b = try Regex(#"<script[^>]*?>[\s\S]*?<\/script.*>"#).ignoresCase(true) |
| 175 | + _ = try re14b.firstMatch(in: tainted) |
| 176 | + // BAD - doesn't match newlines in the end tag |
| 177 | + let ns14 = try NSRegularExpression(pattern: #"<script[^>]*?>[\s\S]*?<\/script.*>"#, options: .caseInsensitive) |
| 178 | + _ = ns14.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 179 | + |
| 180 | + // GOOD |
| 181 | + let re15a = try Regex(#"(?i)<script[^>]*?>[\s\S]*?<\/script[^>]*?>"#) |
| 182 | + _ = try re15a.firstMatch(in: tainted) |
| 183 | + // GOOD |
| 184 | + let re15b = try Regex(#"<script[^>]*?>[\s\S]*?<\/script[^>]*?>"#).ignoresCase(true) |
| 185 | + _ = try re15b.firstMatch(in: tainted) |
| 186 | + // GOOD |
| 187 | + let ns15 = try NSRegularExpression(pattern: #"<script[^>]*?>[\s\S]*?<\/script[^>]*?>"#, options: .caseInsensitive) |
| 188 | + _ = ns15.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 189 | + |
| 190 | + // BAD - doesn't match comments with the right capture groups |
| 191 | + let re16 = try Regex(#"<(?:!--([\S|\s]*?)-->)|([^\/\s>]+)[\S\s]*?>"#) |
| 192 | + _ = try re16.firstMatch(in: tainted) |
| 193 | + // BAD - doesn't match comments with the right capture groups |
| 194 | + let ns16 = try NSRegularExpression(pattern: #"<(?:!--([\S|\s]*?)-->)|([^\/\s>]+)[\S\s]*?>"#) |
| 195 | + _ = ns16.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 196 | + |
| 197 | + // BAD - capture groups |
| 198 | + let re17 = try Regex(#"<(?:(?:\/([^>]+)>)|(?:!--([\S|\s]*?)-->)|(?:([^\/\s>]+)((?:\s+[\w\-:.]+(?:\s*=\s*?(?:(?:"[^"]*")|(?:'[^']*')|[^\s"'\/>]+))?)*)[\S\s]*?(\/?)>))"#) |
| 199 | + _ = try re17.firstMatch(in: tainted) |
| 200 | + // BAD - capture groups |
| 201 | + let ns17 = try NSRegularExpression(pattern: #"<(?:(?:\/([^>]+)>)|(?:!--([\S|\s]*?)-->)|(?:([^\/\s>]+)((?:\s+[\w\-:.]+(?:\s*=\s*?(?:(?:"[^"]*")|(?:'[^']*')|[^\s"'\/>]+))?)*)[\S\s]*?(\/?)>))"#, options: .caseInsensitive) |
| 202 | + _ = ns17.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 203 | + |
| 204 | + // BAD - too strict matching on the end tag |
| 205 | + let ns2_1 = try NSRegularExpression(pattern: #"<script\b[^>]*>([\s\S]*?)<\/script>"#, options: .caseInsensitive) |
| 206 | + _ = ns2_1.matches(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 207 | + |
| 208 | + // BAD - capture groups |
| 209 | + let ns2_2 = try NSRegularExpression(pattern: #"(<[a-z\/!$]("[^"]*"|'[^']*'|[^'">])*>|<!(--.*?--\s*)+>)"#, options: .caseInsensitive) |
| 210 | + _ = ns2_2.matches(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 211 | + |
| 212 | + // BAD - capture groups |
| 213 | + let ns2_3 = try NSRegularExpression(pattern: #"<(?:(?:!--([\w\W]*?)-->)|(?:!\[CDATA\[([\w\W]*?)\]\]>)|(?:!DOCTYPE([\w\W]*?)>)|(?:\?([^\s\/<>]+) ?([\w\W]*?)[?/]>)|(?:\/([A-Za-z][A-Za-z0-9\-_\:\.]*)>)|(?:([A-Za-z][A-Za-z0-9\-_\:\.]*)((?:\s+[^"'>]+(?:(?:"[^"]*")|(?:'[^']*')|[^>]*))*|\/|\s+)>))"#) |
| 214 | + _ = ns2_3.matches(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 215 | + |
| 216 | + // BAD - capture groups |
| 217 | + let ns2_4 = try NSRegularExpression(pattern: #"<!--([\w\W]*?)-->|<([^>]*?)>"#) |
| 218 | + _ = ns2_4.matches(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 219 | + |
| 220 | + // GOOD - it's used with the ignorecase flag |
| 221 | + let ns2_5 = try NSRegularExpression(pattern: #"<script([^>]*)>([\S\s]*?)<\/script([^>]*)>"#, options: .caseInsensitive) |
| 222 | + _ = ns2_5.matches(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 223 | + |
| 224 | + // BAD - doesn't match --!> |
| 225 | + let ns2_6 = try NSRegularExpression(pattern: #"-->"#) |
| 226 | + _ = ns2_6.matches(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 227 | + |
| 228 | + // GOOD |
| 229 | + let ns2_7 = try NSRegularExpression(pattern: #"^>|^->|<!--|-->|--!>|<!-$"#) |
| 230 | + _ = ns2_7.matches(in: tainted, range: NSMakeRange(0, tainted.utf16.count)) |
| 231 | +} |
0 commit comments