Skip to content

Commit 7361ad9

Browse files
MathiasVPMathiasVP
authored
Merge pull request github#13291 from geoffw0/correction
Swift: Promote some Data models to DataProtocol
2 parents 5de8934 + 3f3a5d3 commit 7361ad9

File tree

4 files changed

+75
-48
lines changed

4 files changed

+75
-48
lines changed

‎swift/ql/lib/change-notes/2023-05-25-dataprotocol-models.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Some models for the `Data` class have been generalized to `DataProtocol` so that they apply more widely.

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Data.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ private class DataSummaries extends SummaryModelCsv {
2626
";Data;true;base64EncodedData(options:);;;Argument[-1];ReturnValue;taint",
2727
";Data;true;base64EncodedString(options:);;;Argument[-1];ReturnValue;taint",
2828
";Data;true;compactMap(_:);;;Argument[-1];ReturnValue;taint",
29-
";Data;true;copyBytes(to:);;;Argument[-1];Argument[0];taint",
30-
";Data;true;copyBytes(to:count:);;;Argument[-1];Argument[0];taint",
31-
";Data;true;copyBytes(to:from:);;;Argument[-1];Argument[0];taint",
29+
";DataProtocol;true;copyBytes(to:);;;Argument[-1];Argument[0];taint",
30+
";DataProtocol;true;copyBytes(to:count:);;;Argument[-1];Argument[0];taint",
31+
";DataProtocol;true;copyBytes(to:from:);;;Argument[-1];Argument[0];taint",
3232
";Data;true;flatMap(_:);;;Argument[-1];ReturnValue;taint",
3333
";Data;true;insert(contentsOf:at:);;;Argument[0];Argument[-1];taint",
3434
";Data;true;map(_:);;;Argument[-1];ReturnValue;taint",

‎swift/ql/test/library-tests/dataflow/taint/libraries/data.swift

Lines changed: 66 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,19 @@ protocol SortComparator {
77
associatedtype Compared
88
}
99

10-
struct Data : RangeReplaceableCollection
10+
protocol DataProtocol {
11+
}
12+
extension DataProtocol {
13+
func copyBytes(to: UnsafeMutableRawBufferPointer) {}
14+
func copyBytes(to: UnsafeMutablePointer<UInt8>, count: Int) {}
15+
func copyBytes(to: UnsafeMutablePointer<UInt8>, from: Range<Data.Index>) {}
16+
}
17+
extension UnsafeRawBufferPointer : DataProtocol { }
18+
extension Array : DataProtocol where Element == UInt8 { }
19+
20+
protocol MutableDataProtocol : DataProtocol, RangeReplaceableCollection { }
21+
22+
struct Data : MutableDataProtocol
1123
{
1224
struct Base64EncodingOptions : OptionSet { let rawValue: Int }
1325
struct Base64DecodingOptions : OptionSet { let rawValue: Int }
@@ -82,182 +94,193 @@ func taintThroughData() {
8294
let dataTainted2 = Data(dataTainted)
8395

8496
sink(arg: dataClean)
85-
sink(arg: dataTainted) // $ tainted=81
86-
sink(arg: dataTainted2) // $ tainted=81
97+
sink(arg: dataTainted) // $ tainted=93
98+
sink(arg: dataTainted2) // $ tainted=93
8799

88100
// ";Data;true;init(base64Encoded:options:);;;Argument[0];ReturnValue;taint",
89101
let dataTainted3 = Data(base64Encoded: source() as! Data, options: [])
90-
sink(arg: dataTainted3) // $ tainted=89
102+
sink(arg: dataTainted3) // $ tainted=101
91103

92104
// ";Data;true;init(buffer:);;;Argument[0];ReturnValue;taint",
93105
let dataTainted4 = Data(buffer: source() as! UnsafeBufferPointer<UInt8>)
94-
sink(arg: dataTainted4) // $ tainted=93
106+
sink(arg: dataTainted4) // $ tainted=105
95107
let dataTainted5 = Data(buffer: source() as! UnsafeMutablePointer<UInt8>)
96-
sink(arg: dataTainted5) // $ tainted=95
108+
sink(arg: dataTainted5) // $ tainted=107
97109

98110
// ";Data;true;init(bytes:count:);;;Argument[0];ReturnValue;taint",
99111
let dataTainted6 = Data(bytes: source() as! UnsafeRawPointer, count: 0)
100-
sink(arg: dataTainted6) // $ tainted=99
112+
sink(arg: dataTainted6) // $ tainted=111
101113

102114
// ";Data;true;init(bytesNoCopy:count:deallocator:);;;Argument[0];ReturnValue;taint",
103115
let dataTainted7 = Data(bytesNoCopy: source() as! UnsafeRawPointer, count: 0, deallocator: Data.Deallocator.none)
104-
sink(arg: dataTainted7) // $ tainted=103
116+
sink(arg: dataTainted7) // $ tainted=115
105117

106118
// ";Data;true;init(contentsOf:options:);;;Argument[0];ReturnValue;taint",
107119
let urlTainted8 = source() as! URL
108120
let dataTainted8 = Data(contentsOf: urlTainted8, options: [])
109-
sink(arg: dataTainted8) // $ tainted=107
121+
sink(arg: dataTainted8) // $ tainted=119
110122

111123
// ";Data;true;init(referencing:);;;Argument[0];ReturnValue;taint",
112124
let dataTainted9 = Data(referencing: source() as! NSData)
113-
sink(arg: dataTainted9) // $ tainted=112
125+
sink(arg: dataTainted9) // $ tainted=124
114126

115127
// ";Data;true;append(_:);;;Argument[0];Argument[-1];taint",
116128
let dataTainted10 = Data("")
117129
dataTainted10.append(source() as! Data)
118-
sink(arg: dataTainted10) // $ tainted=117
130+
sink(arg: dataTainted10) // $ tainted=129
119131

120132
let dataTainted11 = Data("")
121133
dataTainted11.append(source() as! UInt8)
122-
sink(arg: dataTainted11) // $ tainted=121
134+
sink(arg: dataTainted11) // $ tainted=133
123135

124136
let dataTainted12 = Data("")
125137
dataTainted12.append(source() as! UnsafeBufferPointer<UInt8>)
126-
sink(arg: dataTainted12) // $ tainted=125
138+
sink(arg: dataTainted12) // $ tainted=137
127139

128140
// ";Data;true;append(_:count:);;;Argument[0];Argument[-1];taint",
129141
let dataTainted13 = Data("")
130142
dataTainted13.append(source() as! UnsafePointer<UInt8>, count: 0)
131-
sink(arg: dataTainted13) // $ tainted=130
143+
sink(arg: dataTainted13) // $ tainted=142
132144

133145
// ";Data;true;append(contentsOf:);;;Argument[0];Argument[-1];taint",
134146
let dataTainted14 = Data("")
135147
dataTainted14.append(contentsOf: source() as! [UInt8])
136-
sink(arg: dataTainted14) // $ tainted=135
148+
sink(arg: dataTainted14) // $ tainted=147
137149

138150
// ";Data;true;base64EncodedData(options:);;;Argument[-1];ReturnValue;taint",
139151
let dataTainted15 = source() as! Data
140-
sink(arg: dataTainted15.base64EncodedData(options: [])) // $ tainted=139
152+
sink(arg: dataTainted15.base64EncodedData(options: [])) // $ tainted=151
141153

142154
// ";Data;true;base64EncodedString(options:);;;Argument[-1];ReturnValue;taint",
143155
let dataTainted16 = source() as! Data
144-
sink(arg: dataTainted16.base64EncodedString(options: [])) // $ tainted=143
156+
sink(arg: dataTainted16.base64EncodedString(options: [])) // $ tainted=155
145157

146158
// ";Data;true;compactMap(_:);;;Argument[-1];ReturnValue;taint",
147159
let dataTainted17 = source() as! Data
148160
let compactMapped: [Int] = dataTainted17.compactMap { str in Int(str) }
149-
sink(arg: compactMapped) // $ tainted=147
161+
sink(arg: compactMapped) // $ tainted=159
150162

151163
// ";Data;true;copyBytes(to:);;;Argument[-1];Argument[0];taint",
152164
let dataTainted18 = source() as! Data
153165
let pointerTainted18 = UnsafeMutableRawBufferPointer.allocate(byteCount: 0, alignment: 0)
154166
dataTainted18.copyBytes(to: pointerTainted18)
155-
sink(arg: pointerTainted18) // $ tainted=152
167+
sink(arg: pointerTainted18) // $ tainted=164
156168

157169
// ";Data;true;copyBytes(to:count:);;;Argument[-1];Argument[0];taint",
158170
let dataTainted19 = source() as! Data
159171
let pointerTainted19 = UnsafeMutablePointer<UInt8>.allocate(capacity: 0)
160172
dataTainted19.copyBytes(to: pointerTainted19, count: 0)
161-
sink(arg: pointerTainted19) // $ tainted=158
173+
sink(arg: pointerTainted19) // $ tainted=170
162174

163175
// ";Data;true;copyBytes(to:from:);;;Argument[-1];Argument[0];taint",
164176
let dataTainted20 = source() as! Data
165177
let pointerTainted20 = UnsafeMutablePointer<UInt8>.allocate(capacity: 0)
166178
dataTainted20.copyBytes(to: pointerTainted20, from: 0..<1)
167-
sink(arg: pointerTainted20) // $ tainted=164
179+
sink(arg: pointerTainted20) // $ tainted=176
168180

169181
// ";Data;true;flatMap(_:);;;Argument[-1];ReturnValue;taint",
170182
let dataTainted21 = source() as! Data
171183
let flatMapped = dataTainted21.flatMap { Array(repeating: $0, count: 0) }
172-
sink(arg: flatMapped) // $ tainted=170
184+
sink(arg: flatMapped) // $ tainted=182
173185

174186
let dataTainted22 = source() as! Data
175187
let flatMapped2 = dataTainted22.flatMap { str in Int(str) }
176-
sink(arg: flatMapped2) // $ tainted=174
188+
sink(arg: flatMapped2) // $ tainted=186
177189

178190
// ";Data;true;insert(_:at:);;;Argument[0];Argument[-1];taint",
179191
let dataTainted23 = Data("")
180192
dataTainted23.insert(source() as! UInt8, at: 0)
181-
sink(arg: dataTainted23) // $ tainted=180
193+
sink(arg: dataTainted23) // $ tainted=192
182194

183195
// ";Data;true;insert(contentsOf:at:);;;Argument[0];Argument[-1];taint",
184196
let dataTainted24 = Data("")
185197
dataTainted24.insert(contentsOf: source() as! [UInt8], at: 0)
186-
sink(arg: dataTainted24) // $ tainted=185
198+
sink(arg: dataTainted24) // $ tainted=197
187199

188200
// ";Data;true;map(_:);;;Argument[-1];ReturnValue;taint",
189201
let dataTainted25 = source() as! Data
190202
let mapped = dataTainted25.map { $0 }
191-
sink(arg: mapped) // $ tainted=189
203+
sink(arg: mapped) // $ tainted=201
192204

193205
// ";Data;true;reduce(into:_:);;;Argument[-1];ReturnValue;taint",
194206
let dataTainted26 = source() as! Data
195207
let reduced = dataTainted26.reduce(into: [:]) { c, i in c[i, default: 0] += 1 }
196-
sink(arg: reduced) // $ tainted=194
208+
sink(arg: reduced) // $ tainted=206
197209

198210
// ";Data;true;replace(_:with:maxReplacements:);;;Argument[1];Argument[-1];taint",
199211
let dataTainted27 = Data("")
200212
dataTainted27.replace([0], with: source() as! [UInt8], maxReplacements: .max)
201-
sink(arg: dataTainted27) // $ tainted=200
213+
sink(arg: dataTainted27) // $ tainted=212
202214

203215
// ";Data;true;replaceSubrange(_:with:);;;Argument[1];Argument[-1];taint",
204216
let dataTainted28 = Data("")
205217
dataTainted28.replaceSubrange(1..<3, with: source() as! Data)
206-
sink(arg: dataTainted28) // $ tainted=205
218+
sink(arg: dataTainted28) // $ tainted=217
207219

208220
let dataTainted29 = Data("")
209221
dataTainted29.replaceSubrange(1..<3, with: source() as! [UInt8])
210-
sink(arg: dataTainted29) // $ tainted=209
222+
sink(arg: dataTainted29) // $ tainted=221
211223

212224
let dataTainted30 = Data("")
213225
dataTainted30.replaceSubrange(1..<3, with: source() as! UnsafeBufferPointer<UInt8>)
214-
sink(arg: dataTainted30) // $ tainted=213
226+
sink(arg: dataTainted30) // $ tainted=225
215227

216228
// ";Data;true;replaceSubrange(_:with:count:);;;Argument[1];Argument[-1];taint",
217229
let dataTainted31 = Data("")
218230
dataTainted31.replaceSubrange(1..<3, with: source() as! UnsafeRawPointer, count: 0)
219-
sink(arg: dataTainted31) // $ tainted=218
231+
sink(arg: dataTainted31) // $ tainted=230
220232

221233
// ";Data;true;replacing(_:with:maxReplacements:);;;Argument[1];Argument[-1];taint",
222234
let dataTainted32 = Data("")
223235
let _ = dataTainted32.replacing([0], with: source() as! [UInt8], maxReplacements: 0)
224-
sink(arg: dataTainted32) // $ tainted=223
236+
sink(arg: dataTainted32) // $ tainted=235
225237

226238
// ";Data;true;replacing(_:with:subrange:maxReplacements:);;;Argument[1];Argument[-1];taint",
227239
let dataTainted33 = Data("")
228240
let _ = dataTainted33.replacing([0], with: source() as! [UInt8], subrange: 1..<3, maxReplacements: 0)
229-
sink(arg: dataTainted33) // $ tainted=228
241+
sink(arg: dataTainted33) // $ tainted=240
230242

231243
// ";Data;true;reversed();;;Argument[-1];ReturnValue;taint",
232244
let dataTainted34 = source() as! Data
233-
sink(arg: dataTainted34.reversed()) // $ tainted=232
245+
sink(arg: dataTainted34.reversed()) // $ tainted=244
234246

235247
// ";Data;true;sorted();;;Argument[-1];ReturnValue;taint",
236248
let dataTainted35 = source() as! Data
237-
sink(arg: dataTainted35.sorted()) // $ tainted=236
249+
sink(arg: dataTainted35.sorted()) // $ tainted=248
238250

239251
// ";Data;true;sorted(by:);;;Argument[-1];ReturnValue;taint",
240252
let dataTainted36 = source() as! Data
241-
sink(arg: dataTainted36.sorted{ _,_ in return false }) // $ tainted=240
253+
sink(arg: dataTainted36.sorted{ _,_ in return false }) // $ tainted=252
242254

243255
// ";Data;true;sorted(using:);;;Argument[-1];ReturnValue;taint",
244256
let dataTainted37 = source() as! Data
245-
sink(arg: dataTainted37.sorted(using: cmp()!)) // $ tainted=244
257+
sink(arg: dataTainted37.sorted(using: cmp()!)) // $ tainted=256
246258

247259
// ";Data;true;shuffled();;;Argument[-1];ReturnValue;taint",
248260
let dataTainted38 = source() as! Data
249-
sink(arg: dataTainted38.shuffled()) // $ tainted=248
261+
sink(arg: dataTainted38.shuffled()) // $ tainted=260
250262

251263
// ";Data;true;shuffled(using:);;;Argument[-1];ReturnValue;taint",
252264
let dataTainted39 = source() as! Data
253-
var rng = rng()!
254-
sink(arg: dataTainted39.shuffled(using: &rng)) // $ tainted=252
265+
var myRng = rng()!
266+
sink(arg: dataTainted39.shuffled(using: &myRng)) // $ tainted=264
255267

256268
// ";Data;true;trimmingPrefix(_:);;;Argument[-1];ReturnValue;taint",
257269
let dataTainted40 = source() as! Data
258-
sink(arg: dataTainted40.trimmingPrefix([0])) // $ tainted=257
270+
sink(arg: dataTainted40.trimmingPrefix([0])) // $ tainted=269
259271

260272
// ";Data;true;trimmingPrefix(while:);;;Argument[-1];ReturnValue;taint"
261273
let dataTainted41 = source() as! Data
262-
sink(arg: dataTainted41.trimmingPrefix { _ in false }) // $ tainted=261
274+
sink(arg: dataTainted41.trimmingPrefix { _ in false }) // $ tainted=273
275+
276+
// ";DataProtocol;true;copyBytes(to:);;;Argument[-1];Argument[0];taint",
277+
let dataTainted43 = source() as! UnsafeRawBufferPointer
278+
let pointerTainted43 = UnsafeMutableRawBufferPointer.allocate(byteCount: 0, alignment: 0)
279+
dataTainted43.copyBytes(to: pointerTainted43)
280+
sink(arg: pointerTainted43) // $ tainted=277
281+
282+
let dataTainted44 = source() as! Array<UInt8>
283+
let pointerTainted44 = UnsafeMutableRawBufferPointer.allocate(byteCount: 0, alignment: 0)
284+
dataTainted44.copyBytes(to: pointerTainted44)
285+
sink(arg: pointerTainted44) // $ tainted=282
263286
}

‎swift/ql/test/query-tests/Security/CWE-089/sqlite3_c_api.swift

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ struct URL
66
init?(string: String) {}
77
init?(string: String, relativeTo: URL?) {}
88
}
9-
10-
struct Data {
9+
protocol DataProtocol { }
10+
struct Data : DataProtocol {
1111
init<S>(_ elements: S) { count = 0 }
1212

1313
var count: Int

0 commit comments

Comments
 (0)