Skip to content

Commit 35e2e5d

Browse files
geoffw0geoffw0
committed
Swift: Use SensitiveDataHeuristics.qll in regexpProbablySafe.
1 parent cc72bfb commit 35e2e5d

File tree

5 files changed

+19
-15
lines changed

5 files changed

+19
-15
lines changed

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*/
66

77
import swift
8+
import internal.SensitiveDataHeuristics
89

910
private newtype TSensitiveDataType =
1011
TCredential() or
@@ -69,7 +70,7 @@ class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
6970
* contain hashed or encrypted data, or are only a reference to data that is
7071
* actually stored elsewhere.
7172
*/
72-
private string regexpProbablySafe() { result = ".*(hash|crypt|file|path|url|invalid).*" }
73+
private string regexpProbablySafe() { result = HeuristicNames::notSensitiveRegexp() }
7374

7475
/**
7576
* A `VarDecl` that might be used to contain sensitive data.

‎swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -110,11 +110,14 @@ edges
110110
| testCoreData.swift:18:19:18:26 | value | testCoreData.swift:19:12:19:12 | value |
111111
| testCoreData.swift:31:3:31:3 | newValue | testCoreData.swift:32:13:32:13 | newValue |
112112
| testCoreData.swift:61:25:61:25 | password | testCoreData.swift:18:19:18:26 | value |
113+
| testCoreData.swift:62:25:62:25 | password_file | testCoreData.swift:18:19:18:26 | value |
113114
| testCoreData.swift:64:2:64:2 | [post] obj [myValue] | testCoreData.swift:64:2:64:2 | [post] obj |
114115
| testCoreData.swift:64:16:64:16 | password | testCoreData.swift:31:3:31:3 | newValue |
115116
| testCoreData.swift:64:16:64:16 | password | testCoreData.swift:64:2:64:2 | [post] obj [myValue] |
117+
| testCoreData.swift:65:2:65:2 | [post] obj [myValue] | testCoreData.swift:65:2:65:2 | [post] obj |
118+
| testCoreData.swift:65:16:65:16 | password_file | testCoreData.swift:31:3:31:3 | newValue |
119+
| testCoreData.swift:65:16:65:16 | password_file | testCoreData.swift:65:2:65:2 | [post] obj [myValue] |
116120
| testCoreData.swift:77:24:77:24 | x | testCoreData.swift:78:15:78:15 | x |
117-
| testCoreData.swift:80:10:80:22 | call to getPassword() | testCoreData.swift:81:15:81:15 | y |
118121
| testCoreData.swift:91:10:91:10 | passwd | testCoreData.swift:95:15:95:15 | x |
119122
| testCoreData.swift:92:10:92:10 | passwd | testCoreData.swift:96:15:96:15 | y |
120123
| testCoreData.swift:93:10:93:10 | passwd | testCoreData.swift:97:15:97:15 | z |
@@ -311,14 +314,17 @@ nodes
311314
| testCoreData.swift:48:15:48:15 | password | semmle.label | password |
312315
| testCoreData.swift:51:24:51:24 | password | semmle.label | password |
313316
| testCoreData.swift:58:15:58:15 | password | semmle.label | password |
317+
| testCoreData.swift:59:15:59:15 | password_file | semmle.label | password_file |
314318
| testCoreData.swift:61:25:61:25 | password | semmle.label | password |
319+
| testCoreData.swift:62:25:62:25 | password_file | semmle.label | password_file |
315320
| testCoreData.swift:64:2:64:2 | [post] obj | semmle.label | [post] obj |
316321
| testCoreData.swift:64:2:64:2 | [post] obj [myValue] | semmle.label | [post] obj [myValue] |
317322
| testCoreData.swift:64:16:64:16 | password | semmle.label | password |
323+
| testCoreData.swift:65:2:65:2 | [post] obj | semmle.label | [post] obj |
324+
| testCoreData.swift:65:2:65:2 | [post] obj [myValue] | semmle.label | [post] obj [myValue] |
325+
| testCoreData.swift:65:16:65:16 | password_file | semmle.label | password_file |
318326
| testCoreData.swift:77:24:77:24 | x | semmle.label | x |
319327
| testCoreData.swift:78:15:78:15 | x | semmle.label | x |
320-
| testCoreData.swift:80:10:80:22 | call to getPassword() | semmle.label | call to getPassword() |
321-
| testCoreData.swift:81:15:81:15 | y | semmle.label | y |
322328
| testCoreData.swift:85:15:85:17 | .password | semmle.label | .password |
323329
| testCoreData.swift:91:10:91:10 | passwd | semmle.label | passwd |
324330
| testCoreData.swift:92:10:92:10 | passwd | semmle.label | passwd |
@@ -492,13 +498,16 @@ subpaths
492498
| testCoreData2.swift:104:2:104:2 | dbObj | testCoreData2.swift:101:10:101:10 | bankAccountNo | testCoreData2.swift:104:2:104:2 | [post] dbObj | This operation stores 'dbObj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:101:10:101:10 | bankAccountNo | bankAccountNo |
493499
| testCoreData2.swift:105:2:105:2 | dbObj | testCoreData2.swift:101:10:101:10 | bankAccountNo | testCoreData2.swift:105:2:105:2 | [post] dbObj | This operation stores 'dbObj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData2.swift:101:10:101:10 | bankAccountNo | bankAccountNo |
494500
| testCoreData.swift:19:12:19:12 | value | testCoreData.swift:61:25:61:25 | password | testCoreData.swift:19:12:19:12 | value | This operation stores 'value' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:61:25:61:25 | password | password |
501+
| testCoreData.swift:19:12:19:12 | value | testCoreData.swift:62:25:62:25 | password_file | testCoreData.swift:19:12:19:12 | value | This operation stores 'value' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:62:25:62:25 | password_file | password_file |
495502
| testCoreData.swift:32:13:32:13 | newValue | testCoreData.swift:64:16:64:16 | password | testCoreData.swift:32:13:32:13 | newValue | This operation stores 'newValue' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:64:16:64:16 | password | password |
503+
| testCoreData.swift:32:13:32:13 | newValue | testCoreData.swift:65:16:65:16 | password_file | testCoreData.swift:32:13:32:13 | newValue | This operation stores 'newValue' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:65:16:65:16 | password_file | password_file |
496504
| testCoreData.swift:48:15:48:15 | password | testCoreData.swift:48:15:48:15 | password | testCoreData.swift:48:15:48:15 | password | This operation stores 'password' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:48:15:48:15 | password | password |
497505
| testCoreData.swift:51:24:51:24 | password | testCoreData.swift:51:24:51:24 | password | testCoreData.swift:51:24:51:24 | password | This operation stores 'password' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:51:24:51:24 | password | password |
498506
| testCoreData.swift:58:15:58:15 | password | testCoreData.swift:58:15:58:15 | password | testCoreData.swift:58:15:58:15 | password | This operation stores 'password' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:58:15:58:15 | password | password |
507+
| testCoreData.swift:59:15:59:15 | password_file | testCoreData.swift:59:15:59:15 | password_file | testCoreData.swift:59:15:59:15 | password_file | This operation stores 'password_file' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:59:15:59:15 | password_file | password_file |
499508
| testCoreData.swift:64:2:64:2 | obj | testCoreData.swift:64:16:64:16 | password | testCoreData.swift:64:2:64:2 | [post] obj | This operation stores 'obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:64:16:64:16 | password | password |
509+
| testCoreData.swift:65:2:65:2 | obj | testCoreData.swift:65:16:65:16 | password_file | testCoreData.swift:65:2:65:2 | [post] obj | This operation stores 'obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:65:16:65:16 | password_file | password_file |
500510
| testCoreData.swift:78:15:78:15 | x | testCoreData.swift:77:24:77:24 | x | testCoreData.swift:78:15:78:15 | x | This operation stores 'x' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:77:24:77:24 | x | x |
501-
| testCoreData.swift:81:15:81:15 | y | testCoreData.swift:80:10:80:22 | call to getPassword() | testCoreData.swift:81:15:81:15 | y | This operation stores 'y' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:80:10:80:22 | call to getPassword() | call to getPassword() |
502511
| testCoreData.swift:85:15:85:17 | .password | testCoreData.swift:85:15:85:17 | .password | testCoreData.swift:85:15:85:17 | .password | This operation stores '.password' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:85:15:85:17 | .password | .password |
503512
| testCoreData.swift:95:15:95:15 | x | testCoreData.swift:91:10:91:10 | passwd | testCoreData.swift:95:15:95:15 | x | This operation stores 'x' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:91:10:91:10 | passwd | passwd |
504513
| testCoreData.swift:96:15:96:15 | y | testCoreData.swift:92:10:92:10 | passwd | testCoreData.swift:96:15:96:15 | y | This operation stores 'y' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:92:10:92:10 | passwd | passwd |

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,12 @@
5151
| testCoreData.swift:48:15:48:15 | password | label:password, type:credential |
5252
| testCoreData.swift:51:24:51:24 | password | label:password, type:credential |
5353
| testCoreData.swift:58:15:58:15 | password | label:password, type:credential |
54+
| testCoreData.swift:59:15:59:15 | password_file | label:password_file, type:credential |
5455
| testCoreData.swift:61:25:61:25 | password | label:password, type:credential |
56+
| testCoreData.swift:62:25:62:25 | password_file | label:password_file, type:credential |
5557
| testCoreData.swift:64:16:64:16 | password | label:password, type:credential |
56-
| testCoreData.swift:77:2:77:25 | call to doSomething(password:) | label:doSomething(password:), type:credential |
58+
| testCoreData.swift:65:16:65:16 | password_file | label:password_file, type:credential |
5759
| testCoreData.swift:77:24:77:24 | x | label:password, type:credential |
58-
| testCoreData.swift:80:10:80:22 | call to getPassword() | label:getPassword(), type:credential |
5960
| testCoreData.swift:85:15:85:17 | .password | label:password, type:credential |
6061
| testCoreData.swift:91:10:91:10 | passwd | label:passwd, type:credential |
6162
| testCoreData.swift:92:10:92:10 | passwd | label:passwd, type:credential |

‎swift/ql/test/query-tests/Security/CWE-312/CleartextLoggingTest.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| cleartextLoggingTest.swift:153:11:154:1 | // $ hasCleartextLogging=152\n | Missing result:hasCleartextLogging=152 |

‎swift/ql/test/query-tests/Security/CWE-312/CleartextStoragePreferences.expected

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,16 @@
11
edges
22
| testNSUbiquitousKeyValueStore.swift:41:24:41:24 | x | testNSUbiquitousKeyValueStore.swift:42:40:42:40 | x |
3-
| testNSUbiquitousKeyValueStore.swift:44:10:44:22 | call to getPassword() | testNSUbiquitousKeyValueStore.swift:45:40:45:40 | y |
43
| testNSUbiquitousKeyValueStore.swift:55:10:55:10 | passwd | testNSUbiquitousKeyValueStore.swift:59:40:59:40 | x |
54
| testNSUbiquitousKeyValueStore.swift:56:10:56:10 | passwd | testNSUbiquitousKeyValueStore.swift:60:40:60:40 | y |
65
| testNSUbiquitousKeyValueStore.swift:57:10:57:10 | passwd | testNSUbiquitousKeyValueStore.swift:61:40:61:40 | z |
76
| testUserDefaults.swift:41:24:41:24 | x | testUserDefaults.swift:42:28:42:28 | x |
8-
| testUserDefaults.swift:44:10:44:22 | call to getPassword() | testUserDefaults.swift:45:28:45:28 | y |
97
| testUserDefaults.swift:55:10:55:10 | passwd | testUserDefaults.swift:59:28:59:28 | x |
108
| testUserDefaults.swift:56:10:56:10 | passwd | testUserDefaults.swift:60:28:60:28 | y |
119
| testUserDefaults.swift:57:10:57:10 | passwd | testUserDefaults.swift:61:28:61:28 | z |
1210
nodes
1311
| testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | semmle.label | password |
1412
| testNSUbiquitousKeyValueStore.swift:41:24:41:24 | x | semmle.label | x |
1513
| testNSUbiquitousKeyValueStore.swift:42:40:42:40 | x | semmle.label | x |
16-
| testNSUbiquitousKeyValueStore.swift:44:10:44:22 | call to getPassword() | semmle.label | call to getPassword() |
17-
| testNSUbiquitousKeyValueStore.swift:45:40:45:40 | y | semmle.label | y |
1814
| testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | semmle.label | .password |
1915
| testNSUbiquitousKeyValueStore.swift:55:10:55:10 | passwd | semmle.label | passwd |
2016
| testNSUbiquitousKeyValueStore.swift:56:10:56:10 | passwd | semmle.label | passwd |
@@ -25,8 +21,6 @@ nodes
2521
| testUserDefaults.swift:28:15:28:15 | password | semmle.label | password |
2622
| testUserDefaults.swift:41:24:41:24 | x | semmle.label | x |
2723
| testUserDefaults.swift:42:28:42:28 | x | semmle.label | x |
28-
| testUserDefaults.swift:44:10:44:22 | call to getPassword() | semmle.label | call to getPassword() |
29-
| testUserDefaults.swift:45:28:45:28 | y | semmle.label | y |
3024
| testUserDefaults.swift:49:28:49:30 | .password | semmle.label | .password |
3125
| testUserDefaults.swift:55:10:55:10 | passwd | semmle.label | passwd |
3226
| testUserDefaults.swift:56:10:56:10 | passwd | semmle.label | passwd |
@@ -38,14 +32,12 @@ subpaths
3832
#select
3933
| testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | This operation stores 'password' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | password |
4034
| testNSUbiquitousKeyValueStore.swift:42:40:42:40 | x | testNSUbiquitousKeyValueStore.swift:41:24:41:24 | x | testNSUbiquitousKeyValueStore.swift:42:40:42:40 | x | This operation stores 'x' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:41:24:41:24 | x | x |
41-
| testNSUbiquitousKeyValueStore.swift:45:40:45:40 | y | testNSUbiquitousKeyValueStore.swift:44:10:44:22 | call to getPassword() | testNSUbiquitousKeyValueStore.swift:45:40:45:40 | y | This operation stores 'y' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:44:10:44:22 | call to getPassword() | call to getPassword() |
4235
| testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | This operation stores '.password' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | .password |
4336
| testNSUbiquitousKeyValueStore.swift:59:40:59:40 | x | testNSUbiquitousKeyValueStore.swift:55:10:55:10 | passwd | testNSUbiquitousKeyValueStore.swift:59:40:59:40 | x | This operation stores 'x' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:55:10:55:10 | passwd | passwd |
4437
| testNSUbiquitousKeyValueStore.swift:60:40:60:40 | y | testNSUbiquitousKeyValueStore.swift:56:10:56:10 | passwd | testNSUbiquitousKeyValueStore.swift:60:40:60:40 | y | This operation stores 'y' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:56:10:56:10 | passwd | passwd |
4538
| testNSUbiquitousKeyValueStore.swift:61:40:61:40 | z | testNSUbiquitousKeyValueStore.swift:57:10:57:10 | passwd | testNSUbiquitousKeyValueStore.swift:61:40:61:40 | z | This operation stores 'z' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:57:10:57:10 | passwd | passwd |
4639
| testUserDefaults.swift:28:15:28:15 | password | testUserDefaults.swift:28:15:28:15 | password | testUserDefaults.swift:28:15:28:15 | password | This operation stores 'password' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:28:15:28:15 | password | password |
4740
| testUserDefaults.swift:42:28:42:28 | x | testUserDefaults.swift:41:24:41:24 | x | testUserDefaults.swift:42:28:42:28 | x | This operation stores 'x' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:41:24:41:24 | x | x |
48-
| testUserDefaults.swift:45:28:45:28 | y | testUserDefaults.swift:44:10:44:22 | call to getPassword() | testUserDefaults.swift:45:28:45:28 | y | This operation stores 'y' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:44:10:44:22 | call to getPassword() | call to getPassword() |
4941
| testUserDefaults.swift:49:28:49:30 | .password | testUserDefaults.swift:49:28:49:30 | .password | testUserDefaults.swift:49:28:49:30 | .password | This operation stores '.password' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:49:28:49:30 | .password | .password |
5042
| testUserDefaults.swift:59:28:59:28 | x | testUserDefaults.swift:55:10:55:10 | passwd | testUserDefaults.swift:59:28:59:28 | x | This operation stores 'x' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:55:10:55:10 | passwd | passwd |
5143
| testUserDefaults.swift:60:28:60:28 | y | testUserDefaults.swift:56:10:56:10 | passwd | testUserDefaults.swift:60:28:60:28 | y | This operation stores 'y' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:56:10:56:10 | passwd | passwd |

0 commit comments

Comments
 (0)