Skip to content

Commit 6108f78

Browse files
geoffw0geoffw0
committed
Swift: Effect on query tests.
1 parent 0509c0f commit 6108f78

File tree

7 files changed

+449
-19
lines changed

7 files changed

+449
-19
lines changed

‎swift/ql/test/query-tests/Security/CWE-1204/StaticInitializationVector.expected

Lines changed: 287 additions & 0 deletions
Large diffs are not rendered by default.

‎swift/ql/test/query-tests/Security/CWE-1204/test.swift

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ class Rabbit
3434

3535
protocol BlockMode { }
3636

37-
struct CBC: BlockMode {
37+
struct CBC: BlockMode {
3838
init(iv: Array<UInt8>) { }
3939
}
4040

@@ -50,7 +50,7 @@ struct CFB: BlockMode {
5050
final class GCM: BlockMode {
5151
enum Mode { case combined, detached }
5252
init(iv: Array<UInt8>, additionalAuthenticatedData: Array<UInt8>? = nil, tagLength: Int = 16, mode: Mode = .detached) { }
53-
convenience init(iv: Array<UInt8>, authenticationTag: Array<UInt8>, additionalAuthenticatedData: Array<UInt8>? = nil, mode: Mode = .detached) {
53+
convenience init(iv: Array<UInt8>, authenticationTag: Array<UInt8>, additionalAuthenticatedData: Array<UInt8>? = nil, mode: Mode = .detached) {
5454
self.init(iv: iv, additionalAuthenticatedData: additionalAuthenticatedData, tagLength: authenticationTag.count, mode: mode)
5555
}
5656
}
@@ -126,7 +126,7 @@ func test() {
126126

127127
// Rabbit
128128
let rb1 = Rabbit(key: key, iv: iv) // BAD
129-
let rb2 = Rabbit(key: key, iv: iv2) // BAD [NOT DETECTED]
129+
let rb2 = Rabbit(key: key, iv: iv2) // BAD
130130
let rb3 = Rabbit(key: keyString, iv: ivString) // BAD
131131
let rg1 = Rabbit(key: key, iv: randomIv) // GOOD
132132
let rg2 = Rabbit(key: keyString, iv: randomIvString) // GOOD

‎swift/ql/test/query-tests/Security/CWE-259/ConstantPassword.expected

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,18 @@ edges
1717
| rncryptor.swift:69:24:69:24 | abc123 | rncryptor.swift:105:32:105:32 | myConstPassword |
1818
| rncryptor.swift:69:24:69:24 | abc123 | rncryptor.swift:107:61:107:61 | myConstPassword |
1919
| rncryptor.swift:69:24:69:24 | abc123 | rncryptor.swift:108:97:108:97 | myConstPassword |
20+
| test.swift:29:3:29:3 | this string is constant | test.swift:33:10:33:28 | call to getConstantString() |
21+
| test.swift:33:2:33:34 | call to Array<Element>.init(_:) [Collection element] | test.swift:44:31:44:48 | call to getConstantArray() [Collection element] |
22+
| test.swift:33:10:33:28 | call to getConstantString() | test.swift:33:10:33:30 | .utf8 |
23+
| test.swift:33:10:33:30 | .utf8 | test.swift:33:2:33:34 | call to Array<Element>.init(_:) [Collection element] |
2024
| test.swift:43:39:43:134 | [...] | test.swift:51:30:51:30 | constantPassword |
2125
| test.swift:43:39:43:134 | [...] | test.swift:56:40:56:40 | constantPassword |
2226
| test.swift:43:39:43:134 | [...] | test.swift:62:40:62:40 | constantPassword |
2327
| test.swift:43:39:43:134 | [...] | test.swift:67:34:67:34 | constantPassword |
28+
| test.swift:44:31:44:48 | call to getConstantArray() [Collection element] | test.swift:52:30:52:30 | constantStringPassword |
29+
| test.swift:44:31:44:48 | call to getConstantArray() [Collection element] | test.swift:57:40:57:40 | constantStringPassword |
30+
| test.swift:44:31:44:48 | call to getConstantArray() [Collection element] | test.swift:63:40:63:40 | constantStringPassword |
31+
| test.swift:44:31:44:48 | call to getConstantArray() [Collection element] | test.swift:68:34:68:34 | constantStringPassword |
2432
nodes
2533
| rncryptor.swift:69:24:69:24 | abc123 | semmle.label | abc123 |
2634
| rncryptor.swift:77:89:77:89 | myConstPassword | semmle.label | myConstPassword |
@@ -41,11 +49,20 @@ nodes
4149
| rncryptor.swift:105:32:105:32 | myConstPassword | semmle.label | myConstPassword |
4250
| rncryptor.swift:107:61:107:61 | myConstPassword | semmle.label | myConstPassword |
4351
| rncryptor.swift:108:97:108:97 | myConstPassword | semmle.label | myConstPassword |
52+
| test.swift:29:3:29:3 | this string is constant | semmle.label | this string is constant |
53+
| test.swift:33:2:33:34 | call to Array<Element>.init(_:) [Collection element] | semmle.label | call to Array<Element>.init(_:) [Collection element] |
54+
| test.swift:33:10:33:28 | call to getConstantString() | semmle.label | call to getConstantString() |
55+
| test.swift:33:10:33:30 | .utf8 | semmle.label | .utf8 |
4456
| test.swift:43:39:43:134 | [...] | semmle.label | [...] |
57+
| test.swift:44:31:44:48 | call to getConstantArray() [Collection element] | semmle.label | call to getConstantArray() [Collection element] |
4558
| test.swift:51:30:51:30 | constantPassword | semmle.label | constantPassword |
59+
| test.swift:52:30:52:30 | constantStringPassword | semmle.label | constantStringPassword |
4660
| test.swift:56:40:56:40 | constantPassword | semmle.label | constantPassword |
61+
| test.swift:57:40:57:40 | constantStringPassword | semmle.label | constantStringPassword |
4762
| test.swift:62:40:62:40 | constantPassword | semmle.label | constantPassword |
63+
| test.swift:63:40:63:40 | constantStringPassword | semmle.label | constantStringPassword |
4864
| test.swift:67:34:67:34 | constantPassword | semmle.label | constantPassword |
65+
| test.swift:68:34:68:34 | constantStringPassword | semmle.label | constantStringPassword |
4966
subpaths
5067
#select
5168
| rncryptor.swift:77:89:77:89 | myConstPassword | rncryptor.swift:69:24:69:24 | abc123 | rncryptor.swift:77:89:77:89 | myConstPassword | The value 'abc123' is used as a constant password. |
@@ -67,6 +84,10 @@ subpaths
6784
| rncryptor.swift:107:61:107:61 | myConstPassword | rncryptor.swift:69:24:69:24 | abc123 | rncryptor.swift:107:61:107:61 | myConstPassword | The value 'abc123' is used as a constant password. |
6885
| rncryptor.swift:108:97:108:97 | myConstPassword | rncryptor.swift:69:24:69:24 | abc123 | rncryptor.swift:108:97:108:97 | myConstPassword | The value 'abc123' is used as a constant password. |
6986
| test.swift:51:30:51:30 | constantPassword | test.swift:43:39:43:134 | [...] | test.swift:51:30:51:30 | constantPassword | The value '[...]' is used as a constant password. |
87+
| test.swift:52:30:52:30 | constantStringPassword | test.swift:29:3:29:3 | this string is constant | test.swift:52:30:52:30 | constantStringPassword | The value 'this string is constant' is used as a constant password. |
7088
| test.swift:56:40:56:40 | constantPassword | test.swift:43:39:43:134 | [...] | test.swift:56:40:56:40 | constantPassword | The value '[...]' is used as a constant password. |
89+
| test.swift:57:40:57:40 | constantStringPassword | test.swift:29:3:29:3 | this string is constant | test.swift:57:40:57:40 | constantStringPassword | The value 'this string is constant' is used as a constant password. |
7190
| test.swift:62:40:62:40 | constantPassword | test.swift:43:39:43:134 | [...] | test.swift:62:40:62:40 | constantPassword | The value '[...]' is used as a constant password. |
91+
| test.swift:63:40:63:40 | constantStringPassword | test.swift:29:3:29:3 | this string is constant | test.swift:63:40:63:40 | constantStringPassword | The value 'this string is constant' is used as a constant password. |
7292
| test.swift:67:34:67:34 | constantPassword | test.swift:43:39:43:134 | [...] | test.swift:67:34:67:34 | constantPassword | The value '[...]' is used as a constant password. |
93+
| test.swift:68:34:68:34 | constantStringPassword | test.swift:29:3:29:3 | this string is constant | test.swift:68:34:68:34 | constantStringPassword | The value 'this string is constant' is used as a constant password. |

‎swift/ql/test/query-tests/Security/CWE-259/test.swift

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46,25 +46,25 @@ func test() {
4646
let randomArray = getRandomArray()
4747
let variant = Variant.sha2
4848
let iterations = 120120
49-
49+
5050
// HKDF test cases
5151
let hkdfb1 = HKDF(password: constantPassword, salt: randomArray, info: randomArray, keyLength: 0, variant: variant) // BAD
52-
let hkdfb2 = HKDF(password: constantStringPassword, salt: randomArray, info: randomArray, keyLength: 0, variant: variant) // BAD [NOT DETECTED]
52+
let hkdfb2 = HKDF(password: constantStringPassword, salt: randomArray, info: randomArray, keyLength: 0, variant: variant) // BAD
5353
let hkdfg1 = HKDF(password: randomPassword, salt: randomArray, info: randomArray, keyLength: 0, variant: variant) // GOOD
5454

5555
// PBKDF1 test cases
5656
let pbkdf1b1 = PKCS5.PBKDF1(password: constantPassword, salt: randomArray, iterations: iterations, keyLength: 0) // BAD
57-
let pbkdf1b2 = PKCS5.PBKDF1(password: constantStringPassword, salt: randomArray, iterations: iterations, keyLength: 0) // BAD [NOT DETECTED]
57+
let pbkdf1b2 = PKCS5.PBKDF1(password: constantStringPassword, salt: randomArray, iterations: iterations, keyLength: 0) // BAD
5858
let pbkdf1g1 = PKCS5.PBKDF1(password: randomPassword, salt: randomArray, iterations: iterations, keyLength: 0) // GOOD
5959

6060

6161
// PBKDF2 test cases
6262
let pbkdf2b1 = PKCS5.PBKDF2(password: constantPassword, salt: randomArray, iterations: iterations, keyLength: 0) // BAD
63-
let pbkdf2b2 = PKCS5.PBKDF2(password: constantStringPassword, salt: randomArray, iterations: iterations, keyLength: 0) // BAD [NOT DETECTED]
63+
let pbkdf2b2 = PKCS5.PBKDF2(password: constantStringPassword, salt: randomArray, iterations: iterations, keyLength: 0) // BAD
6464
let pbkdf2g1 = PKCS5.PBKDF2(password: randomPassword, salt: randomArray, iterations: iterations, keyLength: 0) // GOOD
6565

6666
// Scrypt test cases
6767
let scryptb1 = Scrypt(password: constantPassword, salt: randomArray, dkLen: 64, N: 16384, r: 8, p: 1) // BAD
68-
let scryptb2 = Scrypt(password: constantStringPassword, salt: randomArray, dkLen: 64, N: 16384, r: 8, p: 1) // BAD [NOT DETECTED]
68+
let scryptb2 = Scrypt(password: constantStringPassword, salt: randomArray, dkLen: 64, N: 16384, r: 8, p: 1) // BAD
6969
let scryptg1 = Scrypt(password: randomPassword, salt: randomArray, dkLen: 64, N: 16384, r: 8, p: 1) // GOOD
70-
}
70+
}

‎swift/ql/test/query-tests/Security/CWE-321/cryptoswift.swift

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ enum Variant {
6161

6262
protocol BlockMode { }
6363

64-
struct CBC: BlockMode {
64+
struct CBC: BlockMode {
6565
init() { }
6666
}
6767

@@ -98,13 +98,13 @@ func test() {
9898
let blockMode = CBC()
9999
let padding = Padding.noPadding
100100
let variant = Variant.sha2
101-
101+
102102
let iv = getRandomArray()
103103
let ivString = String(cString: iv)
104104

105105
// AES test cases
106-
let ab1 = AES(key: key2, blockMode: blockMode, padding: padding) // BAD [NOT DETECTED]
107-
let ab2 = AES(key: key2, blockMode: blockMode) // BAD [NOT DETECTED]
106+
let ab1 = AES(key: key2, blockMode: blockMode, padding: padding) // BAD
107+
let ab2 = AES(key: key2, blockMode: blockMode) // BAD
108108
let ab3 = AES(key: keyString, iv: ivString) // BAD
109109
let ab4 = AES(key: keyString, iv: ivString, padding: padding) // BAD
110110

0 commit comments

Comments
 (0)