Skip to content

Commit 32d16b6

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into deprecate-after-repeated-initializers
2 parents f257e85 + 03c2837 commit 32d16b6

24 files changed

+278
-57
lines changed

‎swift/ql/lib/codeql/swift/security/CleartextLoggingQuery.qll

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ private import codeql.swift.security.SensitiveExprs
1212
/**
1313
* A taint-tracking configuration for cleartext logging of sensitive data vulnerabilities.
1414
*/
15-
class CleartextLoggingConfiguration extends TaintTracking::Configuration {
15+
deprecated class CleartextLoggingConfiguration extends TaintTracking::Configuration {
1616
CleartextLoggingConfiguration() { this = "CleartextLoggingConfiguration" }
1717

1818
override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof SensitiveExpr }
@@ -30,3 +30,26 @@ class CleartextLoggingConfiguration extends TaintTracking::Configuration {
3030
any(CleartextLoggingAdditionalTaintStep s).step(n1, n2)
3131
}
3232
}
33+
34+
/**
35+
* A taint-tracking configuration for cleartext logging of sensitive data vulnerabilities.
36+
*/
37+
module CleartextLoggingConfig implements DataFlow::ConfigSig {
38+
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof SensitiveExpr }
39+
40+
predicate isSink(DataFlow::Node sink) { sink instanceof CleartextLoggingSink }
41+
42+
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof CleartextLoggingSanitizer }
43+
44+
// Disregard paths that contain other paths. This helps with performance.
45+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
46+
47+
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
48+
any(CleartextLoggingAdditionalTaintStep s).step(n1, n2)
49+
}
50+
}
51+
52+
/**
53+
* Detect taint flow of cleartext logging of sensitive data vulnerabilities.
54+
*/
55+
module CleartextLoggingFlow = TaintTracking::Global<CleartextLoggingConfig>;

‎swift/ql/lib/codeql/swift/security/CleartextStoragePreferencesQuery.qll

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import codeql.swift.security.CleartextStoragePreferencesExtensions
1313
* A taint configuration from sensitive information to expressions that are
1414
* stored as preferences.
1515
*/
16-
class CleartextStorageConfig extends TaintTracking::Configuration {
16+
deprecated class CleartextStorageConfig extends TaintTracking::Configuration {
1717
CleartextStorageConfig() { this = "CleartextStorageConfig" }
1818

1919
override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
@@ -33,3 +33,32 @@ class CleartextStorageConfig extends TaintTracking::Configuration {
3333
this.isSource(node)
3434
}
3535
}
36+
37+
/**
38+
* A taint configuration from sensitive information to expressions that are
39+
* stored as preferences.
40+
*/
41+
module CleartextStorageConfig implements DataFlow::ConfigSig {
42+
predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
43+
44+
predicate isSink(DataFlow::Node node) { node instanceof CleartextStoragePreferencesSink }
45+
46+
predicate isBarrier(DataFlow::Node sanitizer) {
47+
sanitizer instanceof CleartextStoragePreferencesSanitizer
48+
}
49+
50+
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
51+
any(CleartextStoragePreferencesAdditionalTaintStep s).step(nodeFrom, nodeTo)
52+
}
53+
54+
predicate isBarrierIn(DataFlow::Node node) {
55+
// make sources barriers so that we only report the closest instance
56+
isSource(node)
57+
}
58+
}
59+
60+
/**
61+
* Detect taint flow of sensitive information to expressions that are stored
62+
* as preferences.
63+
*/
64+
module CleartextStorageFlow = TaintTracking::Global<CleartextStorageConfig>;

‎swift/ql/lib/codeql/swift/security/CleartextTransmissionQuery.qll

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import codeql.swift.security.CleartextTransmissionExtensions
1313
* A taint configuration from sensitive information to expressions that are
1414
* transmitted over a network.
1515
*/
16-
class CleartextTransmissionConfig extends TaintTracking::Configuration {
16+
deprecated class CleartextTransmissionConfig extends TaintTracking::Configuration {
1717
CleartextTransmissionConfig() { this = "CleartextTransmissionConfig" }
1818

1919
override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
@@ -33,3 +33,32 @@ class CleartextTransmissionConfig extends TaintTracking::Configuration {
3333
isSource(node)
3434
}
3535
}
36+
37+
/**
38+
* A taint configuration from sensitive information to expressions that are
39+
* transmitted over a network.
40+
*/
41+
module CleartextTransmissionConfig implements DataFlow::ConfigSig {
42+
predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
43+
44+
predicate isSink(DataFlow::Node node) { node instanceof CleartextTransmissionSink }
45+
46+
predicate isBarrier(DataFlow::Node sanitizer) {
47+
sanitizer instanceof CleartextTransmissionSanitizer
48+
}
49+
50+
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
51+
any(CleartextTransmissionAdditionalTaintStep s).step(nodeFrom, nodeTo)
52+
}
53+
54+
predicate isBarrierIn(DataFlow::Node node) {
55+
// make sources barriers so that we only report the closest instance
56+
isSource(node)
57+
}
58+
}
59+
60+
/**
61+
* Detect taint flow of sensitive information to expressions that are transmitted over
62+
* a network.
63+
*/
64+
module CleartextTransmissionFlow = TaintTracking::Global<CleartextTransmissionConfig>;

‎swift/ql/lib/codeql/swift/security/PathInjectionQuery.qll

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ private import codeql.swift.security.PathInjectionExtensions
1313
/**
1414
* A taint-tracking configuration for path injection vulnerabilities.
1515
*/
16-
class PathInjectionConfiguration extends TaintTracking::Configuration {
16+
deprecated class PathInjectionConfiguration extends TaintTracking::Configuration {
1717
PathInjectionConfiguration() { this = "PathInjectionConfiguration" }
1818

1919
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -28,3 +28,23 @@ class PathInjectionConfiguration extends TaintTracking::Configuration {
2828
any(PathInjectionAdditionalTaintStep s).step(node1, node2)
2929
}
3030
}
31+
32+
/**
33+
* A taint-tracking configuration for path injection vulnerabilities.
34+
*/
35+
module PathInjectionConfig implements DataFlow::ConfigSig {
36+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
37+
38+
predicate isSink(DataFlow::Node sink) { sink instanceof PathInjectionSink }
39+
40+
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof PathInjectionSanitizer }
41+
42+
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
43+
any(PathInjectionAdditionalTaintStep s).step(node1, node2)
44+
}
45+
}
46+
47+
/**
48+
* Detect taint flow of path injection vulnerabilities.
49+
*/
50+
module PathInjectionFlow = TaintTracking::Global<PathInjectionConfig>;

‎swift/ql/lib/codeql/swift/security/PredicateInjectionQuery.qll

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ private import codeql.swift.security.PredicateInjectionExtensions
1212
/**
1313
* A taint-tracking configuration for predicate injection vulnerabilities.
1414
*/
15-
class PredicateInjectionConf extends TaintTracking::Configuration {
15+
deprecated class PredicateInjectionConf extends TaintTracking::Configuration {
1616
PredicateInjectionConf() { this = "PredicateInjectionConf" }
1717

1818
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -27,3 +27,23 @@ class PredicateInjectionConf extends TaintTracking::Configuration {
2727
any(PredicateInjectionAdditionalTaintStep s).step(n1, n2)
2828
}
2929
}
30+
31+
/**
32+
* A taint-tracking configuration for predicate injection vulnerabilities.
33+
*/
34+
module PredicateInjectionConfig implements DataFlow::ConfigSig {
35+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
36+
37+
predicate isSink(DataFlow::Node sink) { sink instanceof PredicateInjectionSink }
38+
39+
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof PredicateInjectionSanitizer }
40+
41+
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
42+
any(PredicateInjectionAdditionalTaintStep s).step(n1, n2)
43+
}
44+
}
45+
46+
/**
47+
* Detect taint flow of predicate injection vulnerabilities.
48+
*/
49+
module PredicateInjectionFlow = TaintTracking::Global<PredicateInjectionConfig>;

‎swift/ql/lib/codeql/swift/security/SqlInjectionQuery.qll

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import codeql.swift.security.SqlInjectionExtensions
1313
/**
1414
* A taint configuration for tainted data that reaches a SQL sink.
1515
*/
16-
class SqlInjectionConfig extends TaintTracking::Configuration {
16+
deprecated class SqlInjectionConfig extends TaintTracking::Configuration {
1717
SqlInjectionConfig() { this = "SqlInjectionConfig" }
1818

1919
override predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
@@ -28,3 +28,23 @@ class SqlInjectionConfig extends TaintTracking::Configuration {
2828
any(SqlInjectionAdditionalTaintStep s).step(nodeFrom, nodeTo)
2929
}
3030
}
31+
32+
/**
33+
* A taint configuration for tainted data that reaches a SQL sink.
34+
*/
35+
module SqlInjectionConfig implements DataFlow::ConfigSig {
36+
predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
37+
38+
predicate isSink(DataFlow::Node node) { node instanceof SqlInjectionSink }
39+
40+
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof SqlInjectionSanitizer }
41+
42+
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
43+
any(SqlInjectionAdditionalTaintStep s).step(nodeFrom, nodeTo)
44+
}
45+
}
46+
47+
/**
48+
* Detect taint flow of tainted data that reaches a SQL sink.
49+
*/
50+
module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;

‎swift/ql/lib/codeql/swift/security/UncontrolledFormatStringQuery.qll

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import codeql.swift.security.UncontrolledFormatStringExtensions
1313
/**
1414
* A taint configuration for tainted data that reaches a format string.
1515
*/
16-
class TaintedFormatConfiguration extends TaintTracking::Configuration {
16+
deprecated class TaintedFormatConfiguration extends TaintTracking::Configuration {
1717
TaintedFormatConfiguration() { this = "TaintedFormatConfiguration" }
1818

1919
override predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
@@ -28,3 +28,25 @@ class TaintedFormatConfiguration extends TaintTracking::Configuration {
2828
any(UncontrolledFormatStringAdditionalTaintStep s).step(nodeFrom, nodeTo)
2929
}
3030
}
31+
32+
/**
33+
* A taint configuration for tainted data that reaches a format string.
34+
*/
35+
module TaintedFormatConfig implements DataFlow::ConfigSig {
36+
predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
37+
38+
predicate isSink(DataFlow::Node node) { node instanceof UncontrolledFormatStringSink }
39+
40+
predicate isBarrier(DataFlow::Node sanitizer) {
41+
sanitizer instanceof UncontrolledFormatStringSanitizer
42+
}
43+
44+
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
45+
any(UncontrolledFormatStringAdditionalTaintStep s).step(nodeFrom, nodeTo)
46+
}
47+
}
48+
49+
/**
50+
* Detect taint flow of tainted data that reaches a format string.
51+
*/
52+
module TaintedFormatFlow = TaintTracking::Global<TaintedFormatConfig>;

‎swift/ql/lib/codeql/swift/security/UnsafeJsEvalQuery.qll

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import codeql.swift.security.UnsafeJsEvalExtensions
1212
/**
1313
* A taint configuration from taint sources to sinks for this query.
1414
*/
15-
class UnsafeJsEvalConfig extends TaintTracking::Configuration {
15+
deprecated class UnsafeJsEvalConfig extends TaintTracking::Configuration {
1616
UnsafeJsEvalConfig() { this = "UnsafeJsEvalConfig" }
1717

1818
override predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
@@ -27,3 +27,23 @@ class UnsafeJsEvalConfig extends TaintTracking::Configuration {
2727
any(UnsafeJsEvalAdditionalTaintStep s).step(nodeFrom, nodeTo)
2828
}
2929
}
30+
31+
/**
32+
* A taint configuration from taint sources to sinks for this query.
33+
*/
34+
module UnsafeJsEvalConfig implements DataFlow::ConfigSig {
35+
predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
36+
37+
predicate isSink(DataFlow::Node node) { node instanceof UnsafeJsEvalSink }
38+
39+
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof UnsafeJsEvalSanitizer }
40+
41+
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
42+
any(UnsafeJsEvalAdditionalTaintStep s).step(nodeFrom, nodeTo)
43+
}
44+
}
45+
46+
/**
47+
* Detect taint flow of taint sources to sinks for this query.
48+
*/
49+
module UnsafeJsEvalFlow = TaintTracking::Global<UnsafeJsEvalConfig>;

‎swift/ql/lib/codeql/swift/security/UnsafeWebViewFetchQuery.qll

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import codeql.swift.security.UnsafeWebViewFetchExtensions
1313
* A taint configuration from taint sources to sinks (and `baseURL` arguments)
1414
* for this query.
1515
*/
16-
class UnsafeWebViewFetchConfig extends TaintTracking::Configuration {
16+
deprecated class UnsafeWebViewFetchConfig extends TaintTracking::Configuration {
1717
UnsafeWebViewFetchConfig() { this = "UnsafeWebViewFetchConfig" }
1818

1919
override predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
@@ -33,3 +33,29 @@ class UnsafeWebViewFetchConfig extends TaintTracking::Configuration {
3333
any(UnsafeWebViewFetchAdditionalTaintStep s).step(nodeFrom, nodeTo)
3434
}
3535
}
36+
37+
/**
38+
* A taint configuration from taint sources to sinks (and `baseURL` arguments)
39+
* for this query.
40+
*/
41+
module UnsafeWebViewFetchConfig implements DataFlow::ConfigSig {
42+
predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
43+
44+
predicate isSink(DataFlow::Node node) {
45+
exists(UnsafeWebViewFetchSink sink |
46+
node = sink or
47+
node.asExpr() = sink.getBaseUrl()
48+
)
49+
}
50+
51+
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof UnsafeWebViewFetchSanitizer }
52+
53+
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
54+
any(UnsafeWebViewFetchAdditionalTaintStep s).step(nodeFrom, nodeTo)
55+
}
56+
}
57+
58+
/**
59+
* Detect taint flow of taint sources to sinks (and `baseURL` arguments) for this query.
60+
*/
61+
module UnsafeWebViewFetchFlow = TaintTracking::Global<UnsafeWebViewFetchConfig>;

‎swift/ql/lib/codeql/swift/security/XXEQuery.qll

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import codeql.swift.security.XXEExtensions
1212
/**
1313
* A taint-tracking configuration for XML external entities (XXE) vulnerabilities.
1414
*/
15-
class XxeConfiguration extends TaintTracking::Configuration {
15+
deprecated class XxeConfiguration extends TaintTracking::Configuration {
1616
XxeConfiguration() { this = "XxeConfiguration" }
1717

1818
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -25,3 +25,23 @@ class XxeConfiguration extends TaintTracking::Configuration {
2525
any(XxeAdditionalTaintStep s).step(n1, n2)
2626
}
2727
}
28+
29+
/**
30+
* A taint-tracking configuration for XML external entities (XXE) vulnerabilities.
31+
*/
32+
module XxeConfig implements DataFlow::ConfigSig {
33+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
34+
35+
predicate isSink(DataFlow::Node sink) { sink instanceof XxeSink }
36+
37+
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof XxeSanitizer }
38+
39+
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
40+
any(XxeAdditionalTaintStep s).step(n1, n2)
41+
}
42+
}
43+
44+
/**
45+
* Detect taint flow of XML external entities (XXE) vulnerabilities.
46+
*/
47+
module XxeFlow = TaintTracking::Global<XxeConfig>;

0 commit comments

Comments
 (0)