Skip to content

Commit 664500d

Browse files
geoffw0geoffw0
committed
Swift: Fix member variable sinks in swift/hardcoded-key.
1 parent adbd2c4 commit 664500d

File tree

3 files changed

+23
-2
lines changed

3 files changed

+23
-2
lines changed

‎swift/ql/lib/codeql/swift/security/HardcodedEncryptionKeyExtensions.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ private class EncryptionKeySinks extends SinkModelCsv {
7070
// Realm database library.
7171
";Realm.Configuration;true;init(fileURL:inMemoryIdentifier:syncConfiguration:encryptionKey:readOnly:schemaVersion:migrationBlock:deleteRealmIfMigrationNeeded:shouldCompactOnLaunch:objectTypes:);;;Argument[3];encryption-key",
7272
";Realm.Configuration;true;init(fileURL:inMemoryIdentifier:syncConfiguration:encryptionKey:readOnly:schemaVersion:migrationBlock:deleteRealmIfMigrationNeeded:shouldCompactOnLaunch:objectTypes:seedFilePath:);;;Argument[3];encryption-key",
73-
";Realm.Configuration;true;encryptionKey;;;;encryption-key",
73+
";Realm.Configuration;true;encryptionKey;;;PostUpdate;encryption-key",
7474
]
7575
}
7676
}

‎swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,19 @@ edges
1919
| cryptoswift.swift:92:18:92:36 | call to getConstantString() : | cryptoswift.swift:153:26:153:26 | keyString |
2020
| cryptoswift.swift:92:18:92:36 | call to getConstantString() : | cryptoswift.swift:162:24:162:24 | keyString |
2121
| cryptoswift.swift:92:18:92:36 | call to getConstantString() : | cryptoswift.swift:164:24:164:24 | keyString |
22+
| file://:0:0:0:0 | [post] self [encryptionKey] : | file://:0:0:0:0 | [post] self |
23+
| file://:0:0:0:0 | [post] self [encryptionKey] : | file://:0:0:0:0 | [post] self : |
24+
| file://:0:0:0:0 | value : | file://:0:0:0:0 | [post] self [encryptionKey] : |
2225
| misc.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : |
26+
| misc.swift:30:7:30:7 | value : | file://:0:0:0:0 | value : |
2327
| misc.swift:38:19:38:38 | call to Data.init(_:) : | misc.swift:41:41:41:41 | myConstKey |
28+
| misc.swift:38:19:38:38 | call to Data.init(_:) : | misc.swift:45:25:45:25 | myConstKey : |
2429
| misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
2530
| misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:38:19:38:38 | call to Data.init(_:) : |
31+
| misc.swift:45:2:45:2 | [post] config [encryptionKey] : | misc.swift:45:2:45:2 | [post] config |
32+
| misc.swift:45:25:45:25 | myConstKey : | misc.swift:30:7:30:7 | value : |
33+
| misc.swift:45:25:45:25 | myConstKey : | misc.swift:45:2:45:2 | [post] config |
34+
| misc.swift:45:25:45:25 | myConstKey : | misc.swift:45:2:45:2 | [post] config [encryptionKey] : |
2635
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : |
2736
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:65:73:65:73 | myConstKey |
2837
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:66:73:66:73 | myConstKey |
@@ -64,12 +73,20 @@ nodes
6473
| cryptoswift.swift:162:24:162:24 | keyString | semmle.label | keyString |
6574
| cryptoswift.swift:163:24:163:24 | key | semmle.label | key |
6675
| cryptoswift.swift:164:24:164:24 | keyString | semmle.label | keyString |
76+
| file://:0:0:0:0 | [post] self | semmle.label | [post] self |
77+
| file://:0:0:0:0 | [post] self : | semmle.label | [post] self : |
78+
| file://:0:0:0:0 | [post] self [encryptionKey] : | semmle.label | [post] self [encryptionKey] : |
6779
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : |
6880
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : |
81+
| file://:0:0:0:0 | value : | semmle.label | value : |
6982
| misc.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | semmle.label | [summary param] 0 in Data.init(_:) : |
83+
| misc.swift:30:7:30:7 | value : | semmle.label | value : |
7084
| misc.swift:38:19:38:38 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
7185
| misc.swift:38:24:38:24 | abcdef123456 : | semmle.label | abcdef123456 : |
7286
| misc.swift:41:41:41:41 | myConstKey | semmle.label | myConstKey |
87+
| misc.swift:45:2:45:2 | [post] config | semmle.label | [post] config |
88+
| misc.swift:45:2:45:2 | [post] config [encryptionKey] : | semmle.label | [post] config [encryptionKey] : |
89+
| misc.swift:45:25:45:25 | myConstKey : | semmle.label | myConstKey : |
7390
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | semmle.label | [summary param] 0 in Data.init(_:) : |
7491
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
7592
| rncryptor.swift:60:24:60:24 | abcdef123456 : | semmle.label | abcdef123456 : |
@@ -90,6 +107,8 @@ nodes
90107
| rncryptor.swift:83:92:83:92 | myConstKey | semmle.label | myConstKey |
91108
subpaths
92109
| misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | misc.swift:38:19:38:38 | call to Data.init(_:) : |
110+
| misc.swift:45:25:45:25 | myConstKey : | misc.swift:30:7:30:7 | value : | file://:0:0:0:0 | [post] self : | misc.swift:45:2:45:2 | [post] config |
111+
| misc.swift:45:25:45:25 | myConstKey : | misc.swift:30:7:30:7 | value : | file://:0:0:0:0 | [post] self [encryptionKey] : | misc.swift:45:2:45:2 | [post] config [encryptionKey] : |
93112
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
94113
#select
95114
| cryptoswift.swift:108:21:108:21 | keyString | cryptoswift.swift:76:3:76:3 | this string is constant : | cryptoswift.swift:108:21:108:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:76:3:76:3 | this string is constant : | this string is constant |
@@ -111,7 +130,9 @@ subpaths
111130
| cryptoswift.swift:162:24:162:24 | keyString | cryptoswift.swift:76:3:76:3 | this string is constant : | cryptoswift.swift:162:24:162:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:76:3:76:3 | this string is constant : | this string is constant |
112131
| cryptoswift.swift:163:24:163:24 | key | cryptoswift.swift:90:26:90:121 | [...] : | cryptoswift.swift:163:24:163:24 | key | The key 'key' has been initialized with hard-coded values from $@. | cryptoswift.swift:90:26:90:121 | [...] : | [...] |
113132
| cryptoswift.swift:164:24:164:24 | keyString | cryptoswift.swift:76:3:76:3 | this string is constant : | cryptoswift.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:76:3:76:3 | this string is constant : | this string is constant |
133+
| file://:0:0:0:0 | [post] self | misc.swift:38:24:38:24 | abcdef123456 : | file://:0:0:0:0 | [post] self | The key '[post] self' has been initialized with hard-coded values from $@. | misc.swift:38:24:38:24 | abcdef123456 : | abcdef123456 |
114134
| misc.swift:41:41:41:41 | myConstKey | misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:41:41:41:41 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | misc.swift:38:24:38:24 | abcdef123456 : | abcdef123456 |
135+
| misc.swift:45:2:45:2 | [post] config | misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:45:2:45:2 | [post] config | The key '[post] config' has been initialized with hard-coded values from $@. | misc.swift:38:24:38:24 | abcdef123456 : | abcdef123456 |
115136
| rncryptor.swift:65:73:65:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:65:73:65:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
116137
| rncryptor.swift:66:73:66:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:66:73:66:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
117138
| rncryptor.swift:67:73:67:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:67:73:67:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |

‎swift/ql/test/query-tests/Security/CWE-321/misc.swift

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,5 +42,5 @@ func test(myVarStr: String) {
4242

4343
var config = Realm.Configuration() // GOOD
4444
config.encryptionKey = myVarKey // GOOD
45-
config.encryptionKey = myConstKey // BAD [NOT DETECTED]
45+
config.encryptionKey = myConstKey // BAD
4646
}

0 commit comments

Comments
 (0)