Skip to content

Commit 69b98c7

Browse files
geoffw0geoffw0
authored
Merge pull request github#13354 from geoffw0/sharedsensitive2
Swift: Improve SensitiveExprs.qll Heuristics
2 parents 0b8353e + 1274393 commit 69b98c7

File tree

7 files changed

+150
-69
lines changed

7 files changed

+150
-69
lines changed

‎swift/ql/lib/change-notes/2023-05-30-sensitive-exprs.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added new heuristics to `SensitiveExprs.qll`, enhancing detection from the library.

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll

Lines changed: 38 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ class SensitiveCredential extends SensitiveDataType, TCredential {
3535
result = HeuristicNames::maybeSensitiveRegexp(classification)
3636
)
3737
or
38-
result = "(?is).*(account|accnt|license).?(id|key).*"
38+
result = "(?is).*((account|accnt|licen(se|ce)).?(id|key)|one.?time.?code|pass.?phrase).*"
3939
}
4040
}
4141

@@ -50,21 +50,26 @@ class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
5050
"(?is).*(" +
5151
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
5252
// Government identifiers, such as Social Security Numbers
53-
"social.?security|national.?insurance|" +
53+
"social.?security|employer.?identification|national.?insurance|resident.?id|" +
54+
"passport.?(num|no)|" +
5455
// Contact information, such as home addresses
55-
"post.?code|zip.?code|home.?address|" +
56+
"post.?code|zip.?code|home.?addr|" +
5657
// and telephone numbers
57-
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax).?(num|no)|telephone|" +
58+
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax).?(num|no|phone)|" + "emergency.?contact|" +
5859
// Geographic location - where the user is (or was)
59-
"latitude|longitude|" +
60+
"l(atitude|ongitude)|nationality|" +
6061
// Financial data - such as credit card numbers, salary, bank accounts, and debts
61-
"credit.?card|debit.?card|salary|bank.?account|acc(ou)?nt.?(no|num)|" +
62+
"(credit|debit|bank|visa).?(card|num|no|acc(ou?)nt)|acc(ou)?nt.?(no|num|credit)|" +
63+
"salary|billing|credit.?(rating|score)|" +
6264
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
63-
"email|" +
65+
"e(mail|_mail)|" +
6466
// Health - medical conditions, insurance status, prescription records
65-
"birthday|birth.?date|date.?of.?birth|medical|" +
67+
"birth.?da(te|y)|da(te|y).?(of.?)?birth|" +
68+
"medical|(health|care).?plan|healthkit|appointment|prescription|" +
69+
"blood.?(type|alcohol|glucose|pressure)|heart.?(rate|rhythm)|body.?(mass|fat)|" +
70+
"menstrua|pregnan|insulin|inhaler|" +
6671
// Relationships - work and family
67-
"employer|spouse" +
72+
"employ(er|ee)|spouse|maiden.?name" +
6873
// ---
6974
").*"
7075
}
@@ -80,13 +85,32 @@ private string regexpProbablySafe() {
8085
result = "(?is).*(file|path|url|invalid).*"
8186
}
8287

88+
/**
89+
* Gets a string that is to be tested for sensitivity.
90+
*/
91+
private string sensitiveCandidateStrings() {
92+
result = any(VarDecl v).getName()
93+
or
94+
result = any(Function f).getShortName()
95+
or
96+
result = any(Argument a).getLabel()
97+
}
98+
99+
/**
100+
* Gets a string from the candidates that is sensitive.
101+
*/
102+
private string sensitiveStrings(SensitiveDataType sensitiveType) {
103+
result = sensitiveCandidateStrings() and
104+
result.regexpMatch(sensitiveType.getRegexp())
105+
}
106+
83107
/**
84108
* A `VarDecl` that might be used to contain sensitive data.
85109
*/
86110
private class SensitiveVarDecl extends VarDecl {
87111
SensitiveDataType sensitiveType;
88112

89-
SensitiveVarDecl() { this.getName().regexpMatch(sensitiveType.getRegexp()) }
113+
SensitiveVarDecl() { this.getName() = sensitiveStrings(sensitiveType) }
90114

91115
predicate hasInfo(string label, SensitiveDataType type) {
92116
label = this.getName() and
@@ -99,15 +123,11 @@ private class SensitiveVarDecl extends VarDecl {
99123
*/
100124
private class SensitiveFunction extends Function {
101125
SensitiveDataType sensitiveType;
102-
string name; // name of the function, not including the argument list.
103126

104-
SensitiveFunction() {
105-
name = this.getShortName() and
106-
name.regexpMatch(sensitiveType.getRegexp())
107-
}
127+
SensitiveFunction() { this.getShortName() = sensitiveStrings(sensitiveType) }
108128

109129
predicate hasInfo(string label, SensitiveDataType type) {
110-
label = name and
130+
label = this.getShortName() and
111131
sensitiveType = type
112132
}
113133
}
@@ -118,7 +138,7 @@ private class SensitiveFunction extends Function {
118138
private class SensitiveArgument extends Argument {
119139
SensitiveDataType sensitiveType;
120140

121-
SensitiveArgument() { this.getLabel().regexpMatch(sensitiveType.getRegexp()) }
141+
SensitiveArgument() { this.getLabel() = sensitiveStrings(sensitiveType) }
122142

123143
predicate hasInfo(string label, SensitiveDataType type) {
124144
label = this.getLabel() and
@@ -169,6 +189,7 @@ class SensitiveExpr extends Expr {
169189
* A function that is likely used to encrypt or hash data.
170190
*/
171191
private class EncryptionFunction extends Function {
192+
cached
172193
EncryptionFunction() { this.getName().regexpMatch("(?is).*(crypt|hash|encode|protect).*") }
173194
}
174195

‎swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected

Lines changed: 56 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,17 @@ edges
55
| testSend.swift:33:14:33:32 | call to Data.init(_:) | testSend.swift:37:19:37:19 | data2 |
66
| testSend.swift:33:19:33:19 | passwordPlain | testSend.swift:33:14:33:32 | call to Data.init(_:) |
77
| testSend.swift:41:10:41:18 | data | testSend.swift:41:45:41:45 | data |
8-
| testSend.swift:52:13:52:13 | password | testSend.swift:59:27:59:27 | str1 |
9-
| testSend.swift:53:13:53:13 | password | testSend.swift:60:27:60:27 | str2 |
10-
| testSend.swift:54:13:54:25 | call to pad(_:) | testSend.swift:61:27:61:27 | str3 |
11-
| testSend.swift:54:17:54:17 | password | testSend.swift:41:10:41:18 | data |
12-
| testSend.swift:54:17:54:17 | password | testSend.swift:54:13:54:25 | call to pad(_:) |
13-
| testURL.swift:13:54:13:54 | passwd | testURL.swift:13:22:13:54 | ... .+(_:_:) ... |
14-
| testURL.swift:15:55:15:55 | account_no | testURL.swift:15:22:15:55 | ... .+(_:_:) ... |
15-
| testURL.swift:16:55:16:55 | credit_card_no | testURL.swift:16:22:16:55 | ... .+(_:_:) ... |
8+
| testSend.swift:58:13:58:13 | password | testSend.swift:65:27:65:27 | str1 |
9+
| testSend.swift:59:13:59:13 | password | testSend.swift:66:27:66:27 | str2 |
10+
| testSend.swift:60:13:60:25 | call to pad(_:) | testSend.swift:67:27:67:27 | str3 |
11+
| testSend.swift:60:17:60:17 | password | testSend.swift:41:10:41:18 | data |
12+
| testSend.swift:60:17:60:17 | password | testSend.swift:60:13:60:25 | call to pad(_:) |
13+
| testURL.swift:17:54:17:54 | passwd | testURL.swift:17:22:17:54 | ... .+(_:_:) ... |
14+
| testURL.swift:19:55:19:55 | account_no | testURL.swift:19:22:19:55 | ... .+(_:_:) ... |
15+
| testURL.swift:20:55:20:55 | credit_card_no | testURL.swift:20:22:20:55 | ... .+(_:_:) ... |
16+
| testURL.swift:28:55:28:55 | e_mail | testURL.swift:28:22:28:55 | ... .+(_:_:) ... |
17+
| testURL.swift:30:57:30:57 | a_homeaddr_z | testURL.swift:30:22:30:57 | ... .+(_:_:) ... |
18+
| testURL.swift:32:55:32:55 | resident_ID | testURL.swift:32:22:32:55 | ... .+(_:_:) ... |
1619
nodes
1720
| testAlamofire.swift:150:13:150:45 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
1821
| testAlamofire.swift:150:45:150:45 | password | semmle.label | password |
@@ -26,36 +29,55 @@ nodes
2629
| testSend.swift:37:19:37:19 | data2 | semmle.label | data2 |
2730
| testSend.swift:41:10:41:18 | data | semmle.label | data |
2831
| testSend.swift:41:45:41:45 | data | semmle.label | data |
29-
| testSend.swift:52:13:52:13 | password | semmle.label | password |
30-
| testSend.swift:53:13:53:13 | password | semmle.label | password |
31-
| testSend.swift:54:13:54:25 | call to pad(_:) | semmle.label | call to pad(_:) |
32-
| testSend.swift:54:17:54:17 | password | semmle.label | password |
33-
| testSend.swift:59:27:59:27 | str1 | semmle.label | str1 |
34-
| testSend.swift:60:27:60:27 | str2 | semmle.label | str2 |
35-
| testSend.swift:61:27:61:27 | str3 | semmle.label | str3 |
36-
| testSend.swift:65:27:65:27 | license_key | semmle.label | license_key |
37-
| testSend.swift:66:27:66:30 | .mobileNumber | semmle.label | .mobileNumber |
38-
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
39-
| testURL.swift:13:54:13:54 | passwd | semmle.label | passwd |
40-
| testURL.swift:15:22:15:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
41-
| testURL.swift:15:55:15:55 | account_no | semmle.label | account_no |
42-
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
43-
| testURL.swift:16:55:16:55 | credit_card_no | semmle.label | credit_card_no |
44-
| testURL.swift:20:22:20:22 | passwd | semmle.label | passwd |
32+
| testSend.swift:58:13:58:13 | password | semmle.label | password |
33+
| testSend.swift:59:13:59:13 | password | semmle.label | password |
34+
| testSend.swift:60:13:60:25 | call to pad(_:) | semmle.label | call to pad(_:) |
35+
| testSend.swift:60:17:60:17 | password | semmle.label | password |
36+
| testSend.swift:65:27:65:27 | str1 | semmle.label | str1 |
37+
| testSend.swift:66:27:66:27 | str2 | semmle.label | str2 |
38+
| testSend.swift:67:27:67:27 | str3 | semmle.label | str3 |
39+
| testSend.swift:71:27:71:27 | license_key | semmle.label | license_key |
40+
| testSend.swift:72:27:72:30 | .mobileNumber | semmle.label | .mobileNumber |
41+
| testSend.swift:76:27:76:30 | .Telephone | semmle.label | .Telephone |
42+
| testSend.swift:77:27:77:30 | .birth_day | semmle.label | .birth_day |
43+
| testSend.swift:78:27:78:30 | .CarePlanID | semmle.label | .CarePlanID |
44+
| testSend.swift:79:27:79:30 | .BankCardNo | semmle.label | .BankCardNo |
45+
| testSend.swift:80:27:80:30 | .MyCreditRating | semmle.label | .MyCreditRating |
46+
| testURL.swift:17:22:17:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
47+
| testURL.swift:17:54:17:54 | passwd | semmle.label | passwd |
48+
| testURL.swift:19:22:19:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
49+
| testURL.swift:19:55:19:55 | account_no | semmle.label | account_no |
50+
| testURL.swift:20:22:20:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
51+
| testURL.swift:20:55:20:55 | credit_card_no | semmle.label | credit_card_no |
52+
| testURL.swift:24:22:24:22 | passwd | semmle.label | passwd |
53+
| testURL.swift:28:22:28:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
54+
| testURL.swift:28:55:28:55 | e_mail | semmle.label | e_mail |
55+
| testURL.swift:30:22:30:57 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
56+
| testURL.swift:30:57:30:57 | a_homeaddr_z | semmle.label | a_homeaddr_z |
57+
| testURL.swift:32:22:32:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
58+
| testURL.swift:32:55:32:55 | resident_ID | semmle.label | resident_ID |
4559
subpaths
46-
| testSend.swift:54:17:54:17 | password | testSend.swift:41:10:41:18 | data | testSend.swift:41:45:41:45 | data | testSend.swift:54:13:54:25 | call to pad(_:) |
60+
| testSend.swift:60:17:60:17 | password | testSend.swift:41:10:41:18 | data | testSend.swift:41:45:41:45 | data | testSend.swift:60:13:60:25 | call to pad(_:) |
4761
#select
4862
| testAlamofire.swift:150:13:150:45 | ... .+(_:_:) ... | testAlamofire.swift:150:45:150:45 | password | testAlamofire.swift:150:13:150:45 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testAlamofire.swift:150:45:150:45 | password | password |
4963
| testAlamofire.swift:152:19:152:51 | ... .+(_:_:) ... | testAlamofire.swift:152:51:152:51 | password | testAlamofire.swift:152:19:152:51 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testAlamofire.swift:152:51:152:51 | password | password |
5064
| testAlamofire.swift:154:14:154:46 | ... .+(_:_:) ... | testAlamofire.swift:154:38:154:38 | email | testAlamofire.swift:154:14:154:46 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testAlamofire.swift:154:38:154:38 | email | email |
5165
| testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | This operation transmits 'passwordPlain', which may contain unencrypted sensitive data from $@. | testSend.swift:29:19:29:19 | passwordPlain | passwordPlain |
5266
| testSend.swift:37:19:37:19 | data2 | testSend.swift:33:19:33:19 | passwordPlain | testSend.swift:37:19:37:19 | data2 | This operation transmits 'data2', which may contain unencrypted sensitive data from $@. | testSend.swift:33:19:33:19 | passwordPlain | passwordPlain |
53-
| testSend.swift:59:27:59:27 | str1 | testSend.swift:52:13:52:13 | password | testSend.swift:59:27:59:27 | str1 | This operation transmits 'str1', which may contain unencrypted sensitive data from $@. | testSend.swift:52:13:52:13 | password | password |
54-
| testSend.swift:60:27:60:27 | str2 | testSend.swift:53:13:53:13 | password | testSend.swift:60:27:60:27 | str2 | This operation transmits 'str2', which may contain unencrypted sensitive data from $@. | testSend.swift:53:13:53:13 | password | password |
55-
| testSend.swift:61:27:61:27 | str3 | testSend.swift:54:17:54:17 | password | testSend.swift:61:27:61:27 | str3 | This operation transmits 'str3', which may contain unencrypted sensitive data from $@. | testSend.swift:54:17:54:17 | password | password |
56-
| testSend.swift:65:27:65:27 | license_key | testSend.swift:65:27:65:27 | license_key | testSend.swift:65:27:65:27 | license_key | This operation transmits 'license_key', which may contain unencrypted sensitive data from $@. | testSend.swift:65:27:65:27 | license_key | license_key |
57-
| testSend.swift:66:27:66:30 | .mobileNumber | testSend.swift:66:27:66:30 | .mobileNumber | testSend.swift:66:27:66:30 | .mobileNumber | This operation transmits '.mobileNumber', which may contain unencrypted sensitive data from $@. | testSend.swift:66:27:66:30 | .mobileNumber | .mobileNumber |
58-
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | testURL.swift:13:54:13:54 | passwd | testURL.swift:13:22:13:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:13:54:13:54 | passwd | passwd |
59-
| testURL.swift:15:22:15:55 | ... .+(_:_:) ... | testURL.swift:15:55:15:55 | account_no | testURL.swift:15:22:15:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:15:55:15:55 | account_no | account_no |
60-
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | testURL.swift:16:55:16:55 | credit_card_no | testURL.swift:16:22:16:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:16:55:16:55 | credit_card_no | credit_card_no |
61-
| testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@. | testURL.swift:20:22:20:22 | passwd | passwd |
67+
| testSend.swift:65:27:65:27 | str1 | testSend.swift:58:13:58:13 | password | testSend.swift:65:27:65:27 | str1 | This operation transmits 'str1', which may contain unencrypted sensitive data from $@. | testSend.swift:58:13:58:13 | password | password |
68+
| testSend.swift:66:27:66:27 | str2 | testSend.swift:59:13:59:13 | password | testSend.swift:66:27:66:27 | str2 | This operation transmits 'str2', which may contain unencrypted sensitive data from $@. | testSend.swift:59:13:59:13 | password | password |
69+
| testSend.swift:67:27:67:27 | str3 | testSend.swift:60:17:60:17 | password | testSend.swift:67:27:67:27 | str3 | This operation transmits 'str3', which may contain unencrypted sensitive data from $@. | testSend.swift:60:17:60:17 | password | password |
70+
| testSend.swift:71:27:71:27 | license_key | testSend.swift:71:27:71:27 | license_key | testSend.swift:71:27:71:27 | license_key | This operation transmits 'license_key', which may contain unencrypted sensitive data from $@. | testSend.swift:71:27:71:27 | license_key | license_key |
71+
| testSend.swift:72:27:72:30 | .mobileNumber | testSend.swift:72:27:72:30 | .mobileNumber | testSend.swift:72:27:72:30 | .mobileNumber | This operation transmits '.mobileNumber', which may contain unencrypted sensitive data from $@. | testSend.swift:72:27:72:30 | .mobileNumber | .mobileNumber |
72+
| testSend.swift:76:27:76:30 | .Telephone | testSend.swift:76:27:76:30 | .Telephone | testSend.swift:76:27:76:30 | .Telephone | This operation transmits '.Telephone', which may contain unencrypted sensitive data from $@. | testSend.swift:76:27:76:30 | .Telephone | .Telephone |
73+
| testSend.swift:77:27:77:30 | .birth_day | testSend.swift:77:27:77:30 | .birth_day | testSend.swift:77:27:77:30 | .birth_day | This operation transmits '.birth_day', which may contain unencrypted sensitive data from $@. | testSend.swift:77:27:77:30 | .birth_day | .birth_day |
74+
| testSend.swift:78:27:78:30 | .CarePlanID | testSend.swift:78:27:78:30 | .CarePlanID | testSend.swift:78:27:78:30 | .CarePlanID | This operation transmits '.CarePlanID', which may contain unencrypted sensitive data from $@. | testSend.swift:78:27:78:30 | .CarePlanID | .CarePlanID |
75+
| testSend.swift:79:27:79:30 | .BankCardNo | testSend.swift:79:27:79:30 | .BankCardNo | testSend.swift:79:27:79:30 | .BankCardNo | This operation transmits '.BankCardNo', which may contain unencrypted sensitive data from $@. | testSend.swift:79:27:79:30 | .BankCardNo | .BankCardNo |
76+
| testSend.swift:80:27:80:30 | .MyCreditRating | testSend.swift:80:27:80:30 | .MyCreditRating | testSend.swift:80:27:80:30 | .MyCreditRating | This operation transmits '.MyCreditRating', which may contain unencrypted sensitive data from $@. | testSend.swift:80:27:80:30 | .MyCreditRating | .MyCreditRating |
77+
| testURL.swift:17:22:17:54 | ... .+(_:_:) ... | testURL.swift:17:54:17:54 | passwd | testURL.swift:17:22:17:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:17:54:17:54 | passwd | passwd |
78+
| testURL.swift:19:22:19:55 | ... .+(_:_:) ... | testURL.swift:19:55:19:55 | account_no | testURL.swift:19:22:19:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:19:55:19:55 | account_no | account_no |
79+
| testURL.swift:20:22:20:55 | ... .+(_:_:) ... | testURL.swift:20:55:20:55 | credit_card_no | testURL.swift:20:22:20:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:20:55:20:55 | credit_card_no | credit_card_no |
80+
| testURL.swift:24:22:24:22 | passwd | testURL.swift:24:22:24:22 | passwd | testURL.swift:24:22:24:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@. | testURL.swift:24:22:24:22 | passwd | passwd |
81+
| testURL.swift:28:22:28:55 | ... .+(_:_:) ... | testURL.swift:28:55:28:55 | e_mail | testURL.swift:28:22:28:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:28:55:28:55 | e_mail | e_mail |
82+
| testURL.swift:30:22:30:57 | ... .+(_:_:) ... | testURL.swift:30:57:30:57 | a_homeaddr_z | testURL.swift:30:22:30:57 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:30:57:30:57 | a_homeaddr_z | a_homeaddr_z |
83+
| testURL.swift:32:22:32:55 | ... .+(_:_:) ... | testURL.swift:32:55:32:55 | resident_ID | testURL.swift:32:22:32:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:32:55:32:55 | resident_ID | resident_ID |

0 commit comments

Comments
 (0)