Skip to content

Commit 2983295

Browse files
geoffw0geoffw0
committed
Swift: Add numeric barrier for uncontrolled format string query.
1 parent f98de85 commit 2983295

File tree

3 files changed

+12
-20
lines changed

3 files changed

+12
-20
lines changed

‎swift/ql/lib/codeql/swift/security/UncontrolledFormatStringExtensions.qll

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,13 @@ private class DefaultUncontrolledFormatStringSink extends UncontrolledFormatStri
4242
sinkNode(this, "format-string")
4343
}
4444
}
45+
46+
/**
47+
* A barrier for uncontrolled format string vulnerabilities.
48+
*/
49+
private class UncontrolledFormatStringDefaultBarrier extends UncontrolledFormatStringBarrier {
50+
UncontrolledFormatStringDefaultBarrier() {
51+
// any numeric type
52+
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = "Numeric"
53+
}
54+
}

‎swift/ql/test/query-tests/Security/CWE-134/UncontrolledFormatString.expected

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -12,18 +12,10 @@ edges
1212
| UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:85:72:85:72 | tainted |
1313
| UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:88:11:88:11 | tainted |
1414
| UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:91:61:91:61 | tainted |
15-
| UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:93:26:93:26 | tainted |
16-
| UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:97:27:97:27 | tainted |
1715
| UncontrolledFormatString.swift:81:47:81:47 | tainted | UncontrolledFormatString.swift:81:30:81:54 | call to NSString.init(string:) |
1816
| UncontrolledFormatString.swift:82:65:82:65 | tainted | UncontrolledFormatString.swift:82:48:82:72 | call to NSString.init(string:) |
1917
| UncontrolledFormatString.swift:84:54:84:54 | tainted | UncontrolledFormatString.swift:84:37:84:61 | call to NSString.init(string:) |
2018
| UncontrolledFormatString.swift:85:72:85:72 | tainted | UncontrolledFormatString.swift:85:55:85:79 | call to NSString.init(string:) |
21-
| UncontrolledFormatString.swift:93:22:93:33 | call to Self.init(_:) | UncontrolledFormatString.swift:95:28:95:28 | taintedSan |
22-
| UncontrolledFormatString.swift:93:26:93:26 | tainted | UncontrolledFormatString.swift:93:22:93:33 | call to Self.init(_:) |
23-
| UncontrolledFormatString.swift:97:23:97:34 | call to Self.init(_:) | UncontrolledFormatString.swift:98:30:98:30 | taintedVal2 |
24-
| UncontrolledFormatString.swift:97:27:97:27 | tainted | UncontrolledFormatString.swift:97:23:97:34 | call to Self.init(_:) |
25-
| UncontrolledFormatString.swift:98:23:98:41 | call to String.init(_:) | UncontrolledFormatString.swift:99:28:99:28 | taintedSan2 |
26-
| UncontrolledFormatString.swift:98:30:98:30 | taintedVal2 | UncontrolledFormatString.swift:98:23:98:41 | call to String.init(_:) |
2719
nodes
2820
| UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
2921
| UncontrolledFormatString.swift:70:28:70:28 | tainted | semmle.label | tainted |
@@ -43,14 +35,6 @@ nodes
4335
| UncontrolledFormatString.swift:85:72:85:72 | tainted | semmle.label | tainted |
4436
| UncontrolledFormatString.swift:88:11:88:11 | tainted | semmle.label | tainted |
4537
| UncontrolledFormatString.swift:91:61:91:61 | tainted | semmle.label | tainted |
46-
| UncontrolledFormatString.swift:93:22:93:33 | call to Self.init(_:) | semmle.label | call to Self.init(_:) |
47-
| UncontrolledFormatString.swift:93:26:93:26 | tainted | semmle.label | tainted |
48-
| UncontrolledFormatString.swift:95:28:95:28 | taintedSan | semmle.label | taintedSan |
49-
| UncontrolledFormatString.swift:97:23:97:34 | call to Self.init(_:) | semmle.label | call to Self.init(_:) |
50-
| UncontrolledFormatString.swift:97:27:97:27 | tainted | semmle.label | tainted |
51-
| UncontrolledFormatString.swift:98:23:98:41 | call to String.init(_:) | semmle.label | call to String.init(_:) |
52-
| UncontrolledFormatString.swift:98:30:98:30 | taintedVal2 | semmle.label | taintedVal2 |
53-
| UncontrolledFormatString.swift:99:28:99:28 | taintedSan2 | semmle.label | taintedSan2 |
5438
subpaths
5539
#select
5640
| UncontrolledFormatString.swift:70:28:70:28 | tainted | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:70:28:70:28 | tainted | This format string depends on $@. | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | this user-provided value |
@@ -66,5 +50,3 @@ subpaths
6650
| UncontrolledFormatString.swift:85:55:85:79 | call to NSString.init(string:) | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:85:55:85:79 | call to NSString.init(string:) | This format string depends on $@. | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | this user-provided value |
6751
| UncontrolledFormatString.swift:88:11:88:11 | tainted | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:88:11:88:11 | tainted | This format string depends on $@. | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | this user-provided value |
6852
| UncontrolledFormatString.swift:91:61:91:61 | tainted | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:91:61:91:61 | tainted | This format string depends on $@. | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | this user-provided value |
69-
| UncontrolledFormatString.swift:95:28:95:28 | taintedSan | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:95:28:95:28 | taintedSan | This format string depends on $@. | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | this user-provided value |
70-
| UncontrolledFormatString.swift:99:28:99:28 | taintedSan2 | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:99:28:99:28 | taintedSan2 | This format string depends on $@. | UncontrolledFormatString.swift:64:24:64:77 | call to String.init(contentsOf:) | this user-provided value |

‎swift/ql/test/query-tests/Security/CWE-134/UncontrolledFormatString.swift

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,9 +92,9 @@ func tests() {
9292

9393
let taintedVal = Int(tainted)!
9494
let taintedSan = "\(taintedVal)"
95-
let q = String(format: taintedSan) // GOOD: sufficiently sanitized [FALSE POSITIVE]
95+
let q = String(format: taintedSan) // GOOD: sufficiently sanitized
9696

9797
let taintedVal2 = Int(tainted) ?? 0
9898
let taintedSan2 = String(taintedVal2)
99-
let r = String(format: taintedSan2) // GOOD: sufficiently sanitized [FALSE POSITIVE]
99+
let r = String(format: taintedSan2) // GOOD: sufficiently sanitized
100100
}

0 commit comments

Comments
 (0)