Skip to content

Commit 736f287

Browse files
geoffw0geoffw0
committed
Swift: Tweak private info regexps to restore 'account_no' results.
1 parent 0e443da commit 736f287

File tree

6 files changed

+25
-8
lines changed

6 files changed

+25
-8
lines changed

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
5858
// Geographic location - where the user is (or was)
5959
"latitude|longitude|" +
6060
// Financial data - such as credit card numbers, salary, bank accounts, and debts
61-
"credit.?card|debit.?card|salary|bank.?account|" +
61+
"credit.?card|debit.?card|salary|bank.?account|acc(ou)?nt.?(no|num)|" +
6262
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
6363
"email|" +
6464
// Health - medical conditions, insurance status, prescription records

‎swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ edges
1313
| testSend.swift:54:17:54:17 | password | testSend.swift:41:10:41:18 | data |
1414
| testSend.swift:54:17:54:17 | password | testSend.swift:54:13:54:25 | call to pad(_:) |
1515
| testURL.swift:13:54:13:54 | passwd | testURL.swift:13:22:13:54 | ... .+(_:_:) ... |
16+
| testURL.swift:15:55:15:55 | account_no | testURL.swift:15:22:15:55 | ... .+(_:_:) ... |
1617
| testURL.swift:16:55:16:55 | credit_card_no | testURL.swift:16:22:16:55 | ... .+(_:_:) ... |
1718
nodes
1819
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) | semmle.label | [summary] to write: return (return) in Data.init(_:) |
@@ -40,6 +41,8 @@ nodes
4041
| testSend.swift:66:27:66:30 | .mobileNumber | semmle.label | .mobileNumber |
4142
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4243
| testURL.swift:13:54:13:54 | passwd | semmle.label | passwd |
44+
| testURL.swift:15:22:15:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
45+
| testURL.swift:15:55:15:55 | account_no | semmle.label | account_no |
4346
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
4447
| testURL.swift:16:55:16:55 | credit_card_no | semmle.label | credit_card_no |
4548
| testURL.swift:20:22:20:22 | passwd | semmle.label | passwd |
@@ -58,5 +61,6 @@ subpaths
5861
| testSend.swift:65:27:65:27 | license_key | testSend.swift:65:27:65:27 | license_key | testSend.swift:65:27:65:27 | license_key | This operation transmits 'license_key', which may contain unencrypted sensitive data from $@. | testSend.swift:65:27:65:27 | license_key | license_key |
5962
| testSend.swift:66:27:66:30 | .mobileNumber | testSend.swift:66:27:66:30 | .mobileNumber | testSend.swift:66:27:66:30 | .mobileNumber | This operation transmits '.mobileNumber', which may contain unencrypted sensitive data from $@. | testSend.swift:66:27:66:30 | .mobileNumber | .mobileNumber |
6063
| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | testURL.swift:13:54:13:54 | passwd | testURL.swift:13:22:13:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:13:54:13:54 | passwd | passwd |
64+
| testURL.swift:15:22:15:55 | ... .+(_:_:) ... | testURL.swift:15:55:15:55 | account_no | testURL.swift:15:22:15:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:15:55:15:55 | account_no | account_no |
6165
| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | testURL.swift:16:55:16:55 | credit_card_no | testURL.swift:16:22:16:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@. | testURL.swift:16:55:16:55 | credit_card_no | credit_card_no |
6266
| testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@. | testURL.swift:20:22:20:22 | passwd | passwd |

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,5 +129,6 @@
129129
| testSend.swift:66:27:66:30 | .mobileNumber | label:mobileNumber, type:private information |
130130
| testSend.swift:69:27:69:30 | .passwordFeatureEnabled | label:passwordFeatureEnabled, type:credential |
131131
| testURL.swift:13:54:13:54 | passwd | label:passwd, type:credential |
132+
| testURL.swift:15:55:15:55 | account_no | label:account_no, type:private information |
132133
| testURL.swift:16:55:16:55 | credit_card_no | label:credit_card_no, type:private information |
133134
| testURL.swift:20:22:20:22 | passwd | label:passwd, type:credential |

‎swift/ql/test/query-tests/Security/CWE-311/testURL.swift

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ struct URL
1212
func test1(passwd : String, encrypted_passwd : String, account_no : String, credit_card_no : String) {
1313
let a = URL(string: "http://example.com/login?p=" + passwd); // BAD
1414
let b = URL(string: "http://example.com/login?p=" + encrypted_passwd); // GOOD (not sensitive)
15-
let c = URL(string: "http://example.com/login?ac=" + account_no); // BAD [NOT DETECTED]
15+
let c = URL(string: "http://example.com/login?ac=" + account_no); // BAD
1616
let d = URL(string: "http://example.com/login?cc=" + credit_card_no); // BAD
1717

1818
let base = URL(string: "http://example.com/"); // GOOD (not sensitive)

‎swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,28 @@ edges
22
nodes
33
| testCryptoKit.swift:56:47:56:47 | passwd | semmle.label | passwd |
44
| testCryptoKit.swift:57:43:57:43 | cert | semmle.label | cert |
5+
| testCryptoKit.swift:59:43:59:43 | account_no | semmle.label | account_no |
56
| testCryptoKit.swift:60:43:60:43 | credit_card_no | semmle.label | credit_card_no |
67
| testCryptoKit.swift:61:43:61:43 | credit_card_no | semmle.label | credit_card_no |
78
| testCryptoKit.swift:63:44:63:44 | passwd | semmle.label | passwd |
89
| testCryptoKit.swift:64:44:64:44 | cert | semmle.label | cert |
10+
| testCryptoKit.swift:66:44:66:44 | account_no | semmle.label | account_no |
911
| testCryptoKit.swift:67:44:67:44 | credit_card_no | semmle.label | credit_card_no |
1012
| testCryptoKit.swift:90:23:90:23 | passwd | semmle.label | passwd |
1113
| testCryptoKit.swift:91:23:91:23 | cert | semmle.label | cert |
14+
| testCryptoKit.swift:93:23:93:23 | account_no | semmle.label | account_no |
1215
| testCryptoKit.swift:94:23:94:23 | credit_card_no | semmle.label | credit_card_no |
1316
| testCryptoKit.swift:99:23:99:23 | passwd | semmle.label | passwd |
1417
| testCryptoKit.swift:100:23:100:23 | cert | semmle.label | cert |
18+
| testCryptoKit.swift:102:23:102:23 | account_no | semmle.label | account_no |
1519
| testCryptoKit.swift:103:23:103:23 | credit_card_no | semmle.label | credit_card_no |
1620
| testCryptoKit.swift:132:32:132:32 | passwd | semmle.label | passwd |
1721
| testCryptoKit.swift:133:32:133:32 | cert | semmle.label | cert |
22+
| testCryptoKit.swift:135:32:135:32 | account_no | semmle.label | account_no |
1823
| testCryptoKit.swift:136:32:136:32 | credit_card_no | semmle.label | credit_card_no |
1924
| testCryptoKit.swift:141:32:141:32 | passwd | semmle.label | passwd |
2025
| testCryptoKit.swift:142:32:142:32 | cert | semmle.label | cert |
26+
| testCryptoKit.swift:144:32:144:32 | account_no | semmle.label | account_no |
2127
| testCryptoKit.swift:145:32:145:32 | credit_card_no | semmle.label | credit_card_no |
2228
| testCryptoSwift.swift:113:30:113:30 | passwdArray | semmle.label | passwdArray |
2329
| testCryptoSwift.swift:115:31:115:31 | passwdArray | semmle.label | passwdArray |
@@ -33,22 +39,28 @@ subpaths
3339
#select
3440
| testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:56:47:56:47 | passwd | sensitive data (credential passwd) |
3541
| testCryptoKit.swift:57:43:57:43 | cert | testCryptoKit.swift:57:43:57:43 | cert | testCryptoKit.swift:57:43:57:43 | cert | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:57:43:57:43 | cert | sensitive data (credential cert) |
42+
| testCryptoKit.swift:59:43:59:43 | account_no | testCryptoKit.swift:59:43:59:43 | account_no | testCryptoKit.swift:59:43:59:43 | account_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:59:43:59:43 | account_no | sensitive data (private information account_no) |
3643
| testCryptoKit.swift:60:43:60:43 | credit_card_no | testCryptoKit.swift:60:43:60:43 | credit_card_no | testCryptoKit.swift:60:43:60:43 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:60:43:60:43 | credit_card_no | sensitive data (private information credit_card_no) |
3744
| testCryptoKit.swift:61:43:61:43 | credit_card_no | testCryptoKit.swift:61:43:61:43 | credit_card_no | testCryptoKit.swift:61:43:61:43 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:61:43:61:43 | credit_card_no | sensitive data (private information credit_card_no) |
3845
| testCryptoKit.swift:63:44:63:44 | passwd | testCryptoKit.swift:63:44:63:44 | passwd | testCryptoKit.swift:63:44:63:44 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:63:44:63:44 | passwd | sensitive data (credential passwd) |
3946
| testCryptoKit.swift:64:44:64:44 | cert | testCryptoKit.swift:64:44:64:44 | cert | testCryptoKit.swift:64:44:64:44 | cert | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:64:44:64:44 | cert | sensitive data (credential cert) |
47+
| testCryptoKit.swift:66:44:66:44 | account_no | testCryptoKit.swift:66:44:66:44 | account_no | testCryptoKit.swift:66:44:66:44 | account_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:66:44:66:44 | account_no | sensitive data (private information account_no) |
4048
| testCryptoKit.swift:67:44:67:44 | credit_card_no | testCryptoKit.swift:67:44:67:44 | credit_card_no | testCryptoKit.swift:67:44:67:44 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:67:44:67:44 | credit_card_no | sensitive data (private information credit_card_no) |
4149
| testCryptoKit.swift:90:23:90:23 | passwd | testCryptoKit.swift:90:23:90:23 | passwd | testCryptoKit.swift:90:23:90:23 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:90:23:90:23 | passwd | sensitive data (credential passwd) |
4250
| testCryptoKit.swift:91:23:91:23 | cert | testCryptoKit.swift:91:23:91:23 | cert | testCryptoKit.swift:91:23:91:23 | cert | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:91:23:91:23 | cert | sensitive data (credential cert) |
51+
| testCryptoKit.swift:93:23:93:23 | account_no | testCryptoKit.swift:93:23:93:23 | account_no | testCryptoKit.swift:93:23:93:23 | account_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:93:23:93:23 | account_no | sensitive data (private information account_no) |
4352
| testCryptoKit.swift:94:23:94:23 | credit_card_no | testCryptoKit.swift:94:23:94:23 | credit_card_no | testCryptoKit.swift:94:23:94:23 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:94:23:94:23 | credit_card_no | sensitive data (private information credit_card_no) |
4453
| testCryptoKit.swift:99:23:99:23 | passwd | testCryptoKit.swift:99:23:99:23 | passwd | testCryptoKit.swift:99:23:99:23 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:99:23:99:23 | passwd | sensitive data (credential passwd) |
4554
| testCryptoKit.swift:100:23:100:23 | cert | testCryptoKit.swift:100:23:100:23 | cert | testCryptoKit.swift:100:23:100:23 | cert | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:100:23:100:23 | cert | sensitive data (credential cert) |
55+
| testCryptoKit.swift:102:23:102:23 | account_no | testCryptoKit.swift:102:23:102:23 | account_no | testCryptoKit.swift:102:23:102:23 | account_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:102:23:102:23 | account_no | sensitive data (private information account_no) |
4656
| testCryptoKit.swift:103:23:103:23 | credit_card_no | testCryptoKit.swift:103:23:103:23 | credit_card_no | testCryptoKit.swift:103:23:103:23 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:103:23:103:23 | credit_card_no | sensitive data (private information credit_card_no) |
4757
| testCryptoKit.swift:132:32:132:32 | passwd | testCryptoKit.swift:132:32:132:32 | passwd | testCryptoKit.swift:132:32:132:32 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:132:32:132:32 | passwd | sensitive data (credential passwd) |
4858
| testCryptoKit.swift:133:32:133:32 | cert | testCryptoKit.swift:133:32:133:32 | cert | testCryptoKit.swift:133:32:133:32 | cert | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:133:32:133:32 | cert | sensitive data (credential cert) |
59+
| testCryptoKit.swift:135:32:135:32 | account_no | testCryptoKit.swift:135:32:135:32 | account_no | testCryptoKit.swift:135:32:135:32 | account_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:135:32:135:32 | account_no | sensitive data (private information account_no) |
4960
| testCryptoKit.swift:136:32:136:32 | credit_card_no | testCryptoKit.swift:136:32:136:32 | credit_card_no | testCryptoKit.swift:136:32:136:32 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:136:32:136:32 | credit_card_no | sensitive data (private information credit_card_no) |
5061
| testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:141:32:141:32 | passwd | sensitive data (credential passwd) |
5162
| testCryptoKit.swift:142:32:142:32 | cert | testCryptoKit.swift:142:32:142:32 | cert | testCryptoKit.swift:142:32:142:32 | cert | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:142:32:142:32 | cert | sensitive data (credential cert) |
63+
| testCryptoKit.swift:144:32:144:32 | account_no | testCryptoKit.swift:144:32:144:32 | account_no | testCryptoKit.swift:144:32:144:32 | account_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:144:32:144:32 | account_no | sensitive data (private information account_no) |
5264
| testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:145:32:145:32 | credit_card_no | sensitive data (private information credit_card_no) |
5365
| testCryptoSwift.swift:113:30:113:30 | passwdArray | testCryptoSwift.swift:113:30:113:30 | passwdArray | testCryptoSwift.swift:113:30:113:30 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:113:30:113:30 | passwdArray | sensitive data (credential passwdArray) |
5466
| testCryptoSwift.swift:115:31:115:31 | passwdArray | testCryptoSwift.swift:115:31:115:31 | passwdArray | testCryptoSwift.swift:115:31:115:31 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:115:31:115:31 | passwdArray | sensitive data (credential passwdArray) |

‎swift/ql/test/query-tests/Security/CWE-328/testCryptoKit.swift

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,14 +56,14 @@ func testHashMethods(passwd : UnsafeRawBufferPointer, cert: String, encrypted_pa
5656
var hash = Crypto.Insecure.MD5.hash(data: passwd) // BAD
5757
hash = Crypto.Insecure.MD5.hash(data: cert) // BAD
5858
hash = Crypto.Insecure.MD5.hash(data: encrypted_passwd) // GOOD (not sensitive)
59-
hash = Crypto.Insecure.MD5.hash(data: account_no) // BAD [NOT DETECTED]
59+
hash = Crypto.Insecure.MD5.hash(data: account_no) // BAD
6060
hash = Crypto.Insecure.MD5.hash(data: credit_card_no) // BAD
6161
hash = Crypto.Insecure.MD5.hash(data: credit_card_no) // BAD
6262

6363
hash = Crypto.Insecure.SHA1.hash(data: passwd) // BAD
6464
hash = Crypto.Insecure.SHA1.hash(data: cert) // BAD
6565
hash = Crypto.Insecure.SHA1.hash(data: encrypted_passwd) // GOOD (not sensitive)
66-
hash = Crypto.Insecure.SHA1.hash(data: account_no) // BAD [NOT DETECTED]
66+
hash = Crypto.Insecure.SHA1.hash(data: account_no) // BAD
6767
hash = Crypto.Insecure.SHA1.hash(data: credit_card_no) // BAD
6868

6969
hash = Crypto.SHA256.hash(data: passwd) // BAD [NOT DETECTED] not a computationally expensive hash
@@ -90,7 +90,7 @@ func testMD5UpdateWithData(passwd : String, cert: String, encrypted_passwd : Str
9090
hash.update(data: passwd) // BAD
9191
hash.update(data: cert) // BAD
9292
hash.update(data: encrypted_passwd) // GOOD (not sensitive)
93-
hash.update(data: account_no) // BAD [NOT DETECTED]
93+
hash.update(data: account_no) // BAD
9494
hash.update(data: credit_card_no) // BAD
9595
}
9696

@@ -99,7 +99,7 @@ func testSHA1UpdateWithData(passwd : String, cert: String, encrypted_passwd : St
9999
hash.update(data: passwd) // BAD
100100
hash.update(data: cert) // BAD
101101
hash.update(data: encrypted_passwd) // GOOD (not sensitive)
102-
hash.update(data: account_no) // BAD [NOT DETECTED]
102+
hash.update(data: account_no) // BAD
103103
hash.update(data: credit_card_no) // BAD
104104
}
105105

@@ -132,7 +132,7 @@ func testMD5UpdateWithUnsafeRawBufferPointer(passwd : UnsafeRawBufferPointer, ce
132132
hash.update(bufferPointer: passwd) // BAD
133133
hash.update(bufferPointer: cert) // BAD
134134
hash.update(bufferPointer: encrypted_passwd) // GOOD (not sensitive)
135-
hash.update(bufferPointer: account_no) // BAD [NOT DETECTED]
135+
hash.update(bufferPointer: account_no) // BAD
136136
hash.update(bufferPointer: credit_card_no) // BAD
137137
}
138138

@@ -141,7 +141,7 @@ func testSHA1UpdateWithUnsafeRawBufferPointer(passwd : UnsafeRawBufferPointer, c
141141
hash.update(bufferPointer: passwd) // BAD
142142
hash.update(bufferPointer: cert) // BAD
143143
hash.update(bufferPointer: encrypted_passwd) // GOOD (not sensitive)
144-
hash.update(bufferPointer: account_no) // BAD [NOT DETECTED]
144+
hash.update(bufferPointer: account_no) // BAD
145145
hash.update(bufferPointer: credit_card_no) // BAD
146146
}
147147

0 commit comments

Comments
 (0)