Skip to content

Commit cffdc0a

Browse files
geoffw0geoffw0
authored
Merge pull request github#13698 from geoffw0/url2
Swift: Expand taint models for URL
2 parents 92ee318 + 5ef097f commit cffdc0a

File tree

4 files changed

+457
-53
lines changed

4 files changed

+457
-53
lines changed

‎swift/ql/lib/change-notes/2023-07-06-url-models.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
5+
* Added detail to the taint model for `URL`.

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Url.qll

Lines changed: 92 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,36 @@ private class UrlRequestFieldsInheritTaint extends TaintInheritingContent,
3535
}
3636
}
3737

38+
/**
39+
* A content implying that, if a `URLResource` is tainted, then its fields `name`
40+
* and `subdirectory` are tainted.
41+
*/
42+
private class UrlResourceFieldsInheritTaint extends TaintInheritingContent,
43+
DataFlow::Content::FieldContent
44+
{
45+
UrlResourceFieldsInheritTaint() {
46+
this.getField().getEnclosingDecl().asNominalTypeDecl().getName() = "URLResource" and
47+
this.getField().getName() = ["name", "subdirectory"]
48+
}
49+
}
50+
51+
/**
52+
* A content implying that, if a `URLResourceValues` is tainted, then certain
53+
* fields are tainted.
54+
*/
55+
private class UrlResourceValuesFieldsInheritTaint extends TaintInheritingContent,
56+
DataFlow::Content::FieldContent
57+
{
58+
UrlResourceValuesFieldsInheritTaint() {
59+
this.getField().getEnclosingDecl().asNominalTypeDecl().getName() = "URLResourceValues" and
60+
this.getField().getName() =
61+
[
62+
"name", "path", "canonicalPath", "localizedLabel", "localizedName", "parentDirectory",
63+
"thumbnail"
64+
]
65+
}
66+
}
67+
3868
/**
3969
* A model for `URL` members that are sources of remote flow.
4070
*/
@@ -49,14 +79,74 @@ private class UrlRemoteFlowSource extends SourceModelCsv {
4979
}
5080

5181
/**
52-
* A model for `URL` members that permit taint flow.
82+
* A model for `URL` and related class members that permit taint flow.
5383
*/
5484
private class UrlSummaries extends SummaryModelCsv {
5585
override predicate row(string row) {
5686
row =
5787
[
5888
";URL;true;init(string:);(String);;Argument[0];ReturnValue;taint",
59-
";URL;true;init(string:relativeTo:);(String,URL?);;Argument[0,1];ReturnValue;taint"
89+
";URL;true;init(string:relativeTo:);(String,URL?);;Argument[0..1];ReturnValue;taint",
90+
";URL;true;init(fileURLWithPath:);;;Argument[0];ReturnValue;taint",
91+
";URL;true;init(fileURLWithPath:isDirectory:);;;Argument[0];ReturnValue;taint",
92+
";URL;true;init(fileURLWithPath:relativeTo:);;;Argument[0..1];ReturnValue;taint",
93+
";URL;true;init(fileURLWithPath:isDirectory:relativeTo:);;;Argument[0];ReturnValue;taint",
94+
";URL;true;init(fileURLWithPath:isDirectory:relativeTo:);;;Argument[2];ReturnValue;taint",
95+
";URL;true;init(fileURLWithFileSystemRepresentation:isDirectory:relativeTo:);;;Argument[0];ReturnValue;taint",
96+
";URL;true;init(fileURLWithFileSystemRepresentation:isDirectory:relativeTo:);;;Argument[2];ReturnValue;taint",
97+
";URL;true;init(fileReferenceLiteralResourceName:);;;Argument[0];ReturnValue;taint",
98+
";URL;true;init(_:);;;Argument[0];ReturnValue;taint",
99+
";URL;true;init(_:isDirectory:);;;Argument[0];ReturnValue;taint",
100+
";URL;true;init(resolvingBookmarkData:options:relativeTo:bookmarkDataIsStale:);;;Argument[0];ReturnValue;taint",
101+
";URL;true;init(resolvingBookmarkData:options:relativeTo:bookmarkDataIsStale:);;;Argument[2];ReturnValue;taint",
102+
";URL;true;init(resolvingAliasFileAt:options:);;;Argument[0];ReturnValue;taint",
103+
";URL;true;init(resource:);;;Argument[0];ReturnValue;taint",
104+
";URL;true;init(dataRepresentation:relativeTo:isAbsolute:);;;Argument[0..1];ReturnValue;taint",
105+
";URL;true;init(_:strategy:);;;Argument[0];ReturnValue;taint",
106+
";URL;true;init(filePath:directoryHint:);;;Argument[0];ReturnValue;taint",
107+
";URL;true;init(filePath:directoryHint:relativeTo:);;;Argument[0];ReturnValue;taint",
108+
";URL;true;init(filePath:directoryHint:relativeTo:);;;Argument[2];ReturnValue;taint",
109+
";URL;true;init(for:in:appropriateFor:create:);;;Argument[0..2];ReturnValue;taint",
110+
";URL;true;init(string:encodingInvalidCharacters:);;;Argument[0];ReturnValue;taint",
111+
";URL;true;resourceValues(forKeys:);;;Argument[-1];ReturnValue;taint",
112+
";URL;true;setResourceValues(_:);;;Argument[0];Argument[-1];taint",
113+
";URL;true;setTemporaryResourceValue(_:forKey:);;;Argument[-1..0];Argument[-1];taint",
114+
";URL;true;withUnsafeFileSystemRepresentation(_:);;;Argument[-1],Argument[0].Parameter[0];ReturnValue;taint",
115+
";URL;true;withUnsafeFileSystemRepresentation(_:);;;Argument[0].ReturnValue;ReturnValue;taint",
116+
";URL;true;resolvingSymlinksInPath();;;Argument[-1];ReturnValue;taint",
117+
";URL;true;appendPathComponent(_:);;;Argument[-1..0];Argument[-1];taint",
118+
";URL;true;appendPathComponent(_:isDirectory:);;;Argument[-1..0];Argument[-1];taint",
119+
";URL;true;appendPathComponent(_:conformingTo:);;;Argument[-1..0];Argument[-1];taint",
120+
";URL;true;appendingPathComponent(_:);;;Argument[-1..0];ReturnValue;taint",
121+
";URL;true;appendingPathComponent(_:isDirectory:);;;Argument[-1..0];ReturnValue;taint",
122+
";URL;true;appendingPathComponent(_:conformingTo:);;;Argument[-1..0];ReturnValue;taint",
123+
";URL;true;appendPathExtension(_:);;;Argument[-1..0];Argument[-1];taint",
124+
";URL;true;appendingPathExtension(_:);;;Argument[-1..0];ReturnValue;taint",
125+
";URL;true;deletingLastPathComponent();;;Argument[-1];ReturnValue;taint",
126+
";URL;true;deletingPathExtension();;;Argument[-1];ReturnValue;taint",
127+
";URL;true;bookmarkData(options:includingResourceValuesForKeys:relativeTo:);;;Argument[-1];ReturnValue;taint",
128+
";URL;true;bookmarkData(options:includingResourceValuesForKeys:relativeTo:);;;Argument[1..2];ReturnValue;taint",
129+
";URL;true;bookmarkData(withContentsOf:);;;Argument[0];ReturnValue;taint",
130+
";URL;true;resourceValues(forKeys:fromBookmarkData:);;;Argument[1];ReturnValue;taint",
131+
";URL;true;promisedItemResourceValues(forKeys:);;;Argument[-1];ReturnValue;taint",
132+
";URL;true;append(component:directoryHint:);;;Argument[-1..0];Argument[-1];taint",
133+
";URL;true;append(components:directoryHint:);;;Argument[-1..0];Argument[-1];taint",
134+
";URL;true;append(path:directoryHint:);;;Argument[-1..0];Argument[-1];taint",
135+
";URL;true;append(queryItems:);;;Argument[-1..0];Argument[-1];taint",
136+
";URL;true;appending(component:directoryHint:);;;Argument[-1..0];ReturnValue;taint",
137+
";URL;true;appending(components:directoryHint:);;;Argument[-1..0];ReturnValue;taint",
138+
";URL;true;appending(path:directoryHint:);;;Argument[-1..0];ReturnValue;taint",
139+
";URL;true;appending(queryItems:);;;Argument[-1..0];ReturnValue;taint",
140+
";URL;true;formatted();;;Argument[-1];ReturnValue;taint",
141+
";URL;true;formatted(_:);;;Argument[-1..0];ReturnValue;taint",
142+
";URL;true;fragment(percentEncoded:);;;Argument[-1];ReturnValue;taint",
143+
";URL;true;host(percentEncoded:);;;Argument[-1];ReturnValue;taint",
144+
";URL;true;password(percentEncoded:);;;Argument[-1];ReturnValue;taint",
145+
";URL;true;path(percentEncoded:);;;Argument[-1];ReturnValue;taint",
146+
";URL;true;query(percentEncoded:);;;Argument[-1];ReturnValue;taint",
147+
";URL;true;user(percentEncoded:);;;Argument[-1];ReturnValue;taint",
148+
";URL;true;homeDirectory(forUser:);;;Argument[0];ReturnValue;taint",
149+
";URLResource;true;init(name:subdirectory:locale:bundle:);;;Argument[0..1];ReturnValue;taint",
60150
]
61151
}
62152
}

‎swift/ql/test/library-tests/dataflow/taint/libraries/CONSISTENCY/CfgConsistency.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
deadEnd
2+
| url.swift:493:2:493:28 | call to sink(any:) |

0 commit comments

Comments
 (0)