Swift: Update for CollectionContent.

geoffw0 · geoffw0 · commit bbd3c66d5a3e · 2023-10-02T20:32:24.000+01:00
diff --git a/swift/ql/lib/codeql/swift/security/CleartextStorageDatabaseQuery.qll b/swift/ql/lib/codeql/swift/security/CleartextStorageDatabaseQuery.qll
@@ -43,7 +43,7 @@ module CleartextStorageDatabaseConfig implements DataFlow::ConfigSig {
     // flow out from array elements of at the sink,
     // for example in `database.allStatements(sql: "", arguments: [sensitive])`.
     isSink(node) and
-    c.getAReadContent() instanceof DataFlow::Content::ArrayContent
+    c.getAReadContent() instanceof DataFlow::Content::CollectionContent
   }
 }
 
diff --git a/swift/ql/lib/codeql/swift/security/CommandInjectionQuery.qll b/swift/ql/lib/codeql/swift/security/CommandInjectionQuery.qll
@@ -27,7 +27,7 @@ module CommandInjectionConfig implements DataFlow::ConfigSig {
   predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
     // flow out from array elements of at the sink, for example in `task.arguments = [tainted]`.
     isSink(node) and
-    c.getAReadContent() instanceof DataFlow::Content::ArrayContent
+    c.getAReadContent() instanceof DataFlow::Content::CollectionContent
   }
 }
 
diff --git a/swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected b/swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected

Original file line number	Diff line number	Diff line change
`@@ -43,7 +43,7 @@ module CleartextStorageDatabaseConfig implements DataFlow::ConfigSig {`
`43`	`43`	`// flow out from array elements of at the sink,`
`44`	`44`	// for example in `database.allStatements(sql: "", arguments: [sensitive])`.
`45`	`45`	`isSink(node) and`
`46`		`- c.getAReadContent() instanceof DataFlow::Content::ArrayContent`
	`46`	`+ c.getAReadContent() instanceof DataFlow::Content::CollectionContent`
`47`	`47`	`}`
`48`	`48`	`}`
`49`	`49`
Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ module CommandInjectionConfig implements DataFlow::ConfigSig {`
`27`	`27`	`predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {`
`28`	`28`	// flow out from array elements of at the sink, for example in `task.arguments = [tainted]`.
`29`	`29`	`isSink(node) and`
`30`		`- c.getAReadContent() instanceof DataFlow::Content::ArrayContent`
	`30`	`+ c.getAReadContent() instanceof DataFlow::Content::CollectionContent`
`31`	`31`	`}`
`32`	`32`	`}`
`33`	`33`