Skip to content

Commit c492b5f

Browse files
geoffw0geoffw0
committed
Swift: Model sinks.
1 parent 8bf6fd6 commit c492b5f

File tree

3 files changed

+25
-4
lines changed

3 files changed

+25
-4
lines changed

‎swift/ql/lib/codeql/swift/security/HardcodedEncryptionKeyExtensions.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,9 @@ private class EncryptionKeySinks extends SinkModelCsv {
7171
";Realm.Configuration;true;init(fileURL:inMemoryIdentifier:syncConfiguration:encryptionKey:readOnly:schemaVersion:migrationBlock:deleteRealmIfMigrationNeeded:shouldCompactOnLaunch:objectTypes:);;;Argument[3];encryption-key",
7272
";Realm.Configuration;true;init(fileURL:inMemoryIdentifier:syncConfiguration:encryptionKey:readOnly:schemaVersion:migrationBlock:deleteRealmIfMigrationNeeded:shouldCompactOnLaunch:objectTypes:seedFilePath:);;;Argument[3];encryption-key",
7373
";Realm.Configuration;true;encryptionKey;;;PostUpdate;encryption-key",
74+
// GRDB
75+
";Database;true;usePassphrase(_:);;;Argument[0];encryption-key",
76+
";Database;true;changePassphrase(_:);;;Argument[0];encryption-key",
7477
]
7578
}
7679
}

‎swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,12 @@ edges
2222
| file://:0:0:0:0 | [post] self [encryptionKey] | file://:0:0:0:0 | [post] self |
2323
| file://:0:0:0:0 | [post] self [encryptionKey] | file://:0:0:0:0 | [post] self |
2424
| file://:0:0:0:0 | value | file://:0:0:0:0 | [post] self [encryptionKey] |
25+
| grdb.swift:21:20:21:20 | abc123 | grdb.swift:27:23:27:23 | constString |
26+
| grdb.swift:21:20:21:20 | abc123 | grdb.swift:31:26:31:26 | constString |
27+
| grdb.swift:22:33:22:50 | [...] | grdb.swift:23:23:23:23 | constArray |
28+
| grdb.swift:23:18:23:33 | call to Data.init(_:) | grdb.swift:29:23:29:23 | constData |
29+
| grdb.swift:23:18:23:33 | call to Data.init(_:) | grdb.swift:33:26:33:26 | constData |
30+
| grdb.swift:23:23:23:23 | constArray | grdb.swift:23:18:23:33 | call to Data.init(_:) |
2531
| misc.swift:30:7:30:7 | value | file://:0:0:0:0 | value |
2632
| misc.swift:46:19:46:38 | call to Data.init(_:) | misc.swift:49:41:49:41 | myConstKey |
2733
| misc.swift:46:19:46:38 | call to Data.init(_:) | misc.swift:53:25:53:25 | myConstKey |
@@ -78,6 +84,14 @@ nodes
7884
| file://:0:0:0:0 | [post] self | semmle.label | [post] self |
7985
| file://:0:0:0:0 | [post] self [encryptionKey] | semmle.label | [post] self [encryptionKey] |
8086
| file://:0:0:0:0 | value | semmle.label | value |
87+
| grdb.swift:21:20:21:20 | abc123 | semmle.label | abc123 |
88+
| grdb.swift:22:33:22:50 | [...] | semmle.label | [...] |
89+
| grdb.swift:23:18:23:33 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
90+
| grdb.swift:23:23:23:23 | constArray | semmle.label | constArray |
91+
| grdb.swift:27:23:27:23 | constString | semmle.label | constString |
92+
| grdb.swift:29:23:29:23 | constData | semmle.label | constData |
93+
| grdb.swift:31:26:31:26 | constString | semmle.label | constString |
94+
| grdb.swift:33:26:33:26 | constData | semmle.label | constData |
8195
| misc.swift:30:7:30:7 | value | semmle.label | value |
8296
| misc.swift:46:19:46:38 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
8397
| misc.swift:46:24:46:24 | abcdef123456 | semmle.label | abcdef123456 |
@@ -131,6 +145,10 @@ subpaths
131145
| cryptoswift.swift:163:24:163:24 | key | cryptoswift.swift:90:26:90:121 | [...] | cryptoswift.swift:163:24:163:24 | key | The key 'key' has been initialized with hard-coded values from $@. | cryptoswift.swift:90:26:90:121 | [...] | [...] |
132146
| cryptoswift.swift:164:24:164:24 | keyString | cryptoswift.swift:76:3:76:3 | this string is constant | cryptoswift.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | cryptoswift.swift:76:3:76:3 | this string is constant | this string is constant |
133147
| file://:0:0:0:0 | [post] self | misc.swift:46:24:46:24 | abcdef123456 | file://:0:0:0:0 | [post] self | The key '[post] self' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
148+
| grdb.swift:27:23:27:23 | constString | grdb.swift:21:20:21:20 | abc123 | grdb.swift:27:23:27:23 | constString | The key 'constString' has been initialized with hard-coded values from $@. | grdb.swift:21:20:21:20 | abc123 | abc123 |
149+
| grdb.swift:29:23:29:23 | constData | grdb.swift:22:33:22:50 | [...] | grdb.swift:29:23:29:23 | constData | The key 'constData' has been initialized with hard-coded values from $@. | grdb.swift:22:33:22:50 | [...] | [...] |
150+
| grdb.swift:31:26:31:26 | constString | grdb.swift:21:20:21:20 | abc123 | grdb.swift:31:26:31:26 | constString | The key 'constString' has been initialized with hard-coded values from $@. | grdb.swift:21:20:21:20 | abc123 | abc123 |
151+
| grdb.swift:33:26:33:26 | constData | grdb.swift:22:33:22:50 | [...] | grdb.swift:33:26:33:26 | constData | The key 'constData' has been initialized with hard-coded values from $@. | grdb.swift:22:33:22:50 | [...] | [...] |
134152
| misc.swift:49:41:49:41 | myConstKey | misc.swift:46:24:46:24 | abcdef123456 | misc.swift:49:41:49:41 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
135153
| misc.swift:53:2:53:2 | [post] config | misc.swift:46:24:46:24 | abcdef123456 | misc.swift:53:2:53:2 | [post] config | The key '[post] config' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |
136154
| misc.swift:57:2:57:18 | [post] getter for .config | misc.swift:46:24:46:24 | abcdef123456 | misc.swift:57:2:57:18 | [post] getter for .config | The key '[post] getter for .config' has been initialized with hard-coded values from $@. | misc.swift:46:24:46:24 | abcdef123456 | abcdef123456 |

‎swift/ql/test/query-tests/Security/CWE-321/grdb.swift

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ func test(db: Database, varString: String, varArray: Array<UInt8>, varData: Data
2424

2525
// GRDB
2626
try db.usePassphrase(varString)
27-
try db.usePassphrase(constString) // BAD: constant key [NOT DETECTED]
27+
try db.usePassphrase(constString) // BAD: constant key
2828
try db.usePassphrase(varData)
29-
try db.usePassphrase(constData) // BAD: constant key [NOT DETECTED]
29+
try db.usePassphrase(constData) // BAD: constant key
3030
try db.changePassphrase(varString)
31-
try db.changePassphrase(constString) // BAD: constant key [NOT DETECTED]
31+
try db.changePassphrase(constString) // BAD: constant key
3232
try db.changePassphrase(Data(varArray))
33-
try db.changePassphrase(constData) // BAD: constant key [NOT DETECTED]
33+
try db.changePassphrase(constData) // BAD: constant key
3434
}

0 commit comments

Comments
 (0)