Skip to content

Commit e2080c5

Browse files
geoffw0geoffw0
committed
Swift: SensitiveDataHeuristics.qll expects function names without an (argument:list:).
1 parent 35e2e5d commit e2080c5

File tree

5 files changed

+19
-3
lines changed

5 files changed

+19
-3
lines changed

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,11 +91,15 @@ private class SensitiveVarDecl extends VarDecl {
9191
*/
9292
private class SensitiveFunction extends Function {
9393
SensitiveDataType sensitiveType;
94+
string name; // name of the function, not including the argument list.
9495

95-
SensitiveFunction() { this.getName().toLowerCase().regexpMatch(sensitiveType.getRegexp()) }
96+
SensitiveFunction() {
97+
name = this.getName().splitAt("(", 0) and
98+
name.toLowerCase().regexpMatch(sensitiveType.getRegexp())
99+
}
96100

97101
predicate hasInfo(string label, SensitiveDataType type) {
98-
label = this.getName() and
102+
label = name and
99103
sensitiveType = type
100104
}
101105
}

‎swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ edges
118118
| testCoreData.swift:65:16:65:16 | password_file | testCoreData.swift:31:3:31:3 | newValue |
119119
| testCoreData.swift:65:16:65:16 | password_file | testCoreData.swift:65:2:65:2 | [post] obj [myValue] |
120120
| testCoreData.swift:77:24:77:24 | x | testCoreData.swift:78:15:78:15 | x |
121+
| testCoreData.swift:80:10:80:22 | call to getPassword() | testCoreData.swift:81:15:81:15 | y |
121122
| testCoreData.swift:91:10:91:10 | passwd | testCoreData.swift:95:15:95:15 | x |
122123
| testCoreData.swift:92:10:92:10 | passwd | testCoreData.swift:96:15:96:15 | y |
123124
| testCoreData.swift:93:10:93:10 | passwd | testCoreData.swift:97:15:97:15 | z |
@@ -325,6 +326,8 @@ nodes
325326
| testCoreData.swift:65:16:65:16 | password_file | semmle.label | password_file |
326327
| testCoreData.swift:77:24:77:24 | x | semmle.label | x |
327328
| testCoreData.swift:78:15:78:15 | x | semmle.label | x |
329+
| testCoreData.swift:80:10:80:22 | call to getPassword() | semmle.label | call to getPassword() |
330+
| testCoreData.swift:81:15:81:15 | y | semmle.label | y |
328331
| testCoreData.swift:85:15:85:17 | .password | semmle.label | .password |
329332
| testCoreData.swift:91:10:91:10 | passwd | semmle.label | passwd |
330333
| testCoreData.swift:92:10:92:10 | passwd | semmle.label | passwd |
@@ -508,6 +511,7 @@ subpaths
508511
| testCoreData.swift:64:2:64:2 | obj | testCoreData.swift:64:16:64:16 | password | testCoreData.swift:64:2:64:2 | [post] obj | This operation stores 'obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:64:16:64:16 | password | password |
509512
| testCoreData.swift:65:2:65:2 | obj | testCoreData.swift:65:16:65:16 | password_file | testCoreData.swift:65:2:65:2 | [post] obj | This operation stores 'obj' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:65:16:65:16 | password_file | password_file |
510513
| testCoreData.swift:78:15:78:15 | x | testCoreData.swift:77:24:77:24 | x | testCoreData.swift:78:15:78:15 | x | This operation stores 'x' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:77:24:77:24 | x | x |
514+
| testCoreData.swift:81:15:81:15 | y | testCoreData.swift:80:10:80:22 | call to getPassword() | testCoreData.swift:81:15:81:15 | y | This operation stores 'y' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:80:10:80:22 | call to getPassword() | call to getPassword() |
511515
| testCoreData.swift:85:15:85:17 | .password | testCoreData.swift:85:15:85:17 | .password | testCoreData.swift:85:15:85:17 | .password | This operation stores '.password' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:85:15:85:17 | .password | .password |
512516
| testCoreData.swift:95:15:95:15 | x | testCoreData.swift:91:10:91:10 | passwd | testCoreData.swift:95:15:95:15 | x | This operation stores 'x' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:91:10:91:10 | passwd | passwd |
513517
| testCoreData.swift:96:15:96:15 | y | testCoreData.swift:92:10:92:10 | passwd | testCoreData.swift:96:15:96:15 | y | This operation stores 'y' in a database. It may contain unencrypted sensitive data from $@. | testCoreData.swift:92:10:92:10 | passwd | passwd |

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757
| testCoreData.swift:64:16:64:16 | password | label:password, type:credential |
5858
| testCoreData.swift:65:16:65:16 | password_file | label:password_file, type:credential |
5959
| testCoreData.swift:77:24:77:24 | x | label:password, type:credential |
60+
| testCoreData.swift:80:10:80:22 | call to getPassword() | label:getPassword, type:credential |
6061
| testCoreData.swift:85:15:85:17 | .password | label:password, type:credential |
6162
| testCoreData.swift:91:10:91:10 | passwd | label:passwd, type:credential |
6263
| testCoreData.swift:92:10:92:10 | passwd | label:passwd, type:credential |

‎swift/ql/test/query-tests/Security/CWE-312/CleartextLoggingTest.expected

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +0,0 @@
1-
| cleartextLoggingTest.swift:153:11:154:1 | // $ hasCleartextLogging=152\n | Missing result:hasCleartextLogging=152 |

‎swift/ql/test/query-tests/Security/CWE-312/CleartextStoragePreferences.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,20 @@
11
edges
22
| testNSUbiquitousKeyValueStore.swift:41:24:41:24 | x | testNSUbiquitousKeyValueStore.swift:42:40:42:40 | x |
3+
| testNSUbiquitousKeyValueStore.swift:44:10:44:22 | call to getPassword() | testNSUbiquitousKeyValueStore.swift:45:40:45:40 | y |
34
| testNSUbiquitousKeyValueStore.swift:55:10:55:10 | passwd | testNSUbiquitousKeyValueStore.swift:59:40:59:40 | x |
45
| testNSUbiquitousKeyValueStore.swift:56:10:56:10 | passwd | testNSUbiquitousKeyValueStore.swift:60:40:60:40 | y |
56
| testNSUbiquitousKeyValueStore.swift:57:10:57:10 | passwd | testNSUbiquitousKeyValueStore.swift:61:40:61:40 | z |
67
| testUserDefaults.swift:41:24:41:24 | x | testUserDefaults.swift:42:28:42:28 | x |
8+
| testUserDefaults.swift:44:10:44:22 | call to getPassword() | testUserDefaults.swift:45:28:45:28 | y |
79
| testUserDefaults.swift:55:10:55:10 | passwd | testUserDefaults.swift:59:28:59:28 | x |
810
| testUserDefaults.swift:56:10:56:10 | passwd | testUserDefaults.swift:60:28:60:28 | y |
911
| testUserDefaults.swift:57:10:57:10 | passwd | testUserDefaults.swift:61:28:61:28 | z |
1012
nodes
1113
| testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | semmle.label | password |
1214
| testNSUbiquitousKeyValueStore.swift:41:24:41:24 | x | semmle.label | x |
1315
| testNSUbiquitousKeyValueStore.swift:42:40:42:40 | x | semmle.label | x |
16+
| testNSUbiquitousKeyValueStore.swift:44:10:44:22 | call to getPassword() | semmle.label | call to getPassword() |
17+
| testNSUbiquitousKeyValueStore.swift:45:40:45:40 | y | semmle.label | y |
1418
| testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | semmle.label | .password |
1519
| testNSUbiquitousKeyValueStore.swift:55:10:55:10 | passwd | semmle.label | passwd |
1620
| testNSUbiquitousKeyValueStore.swift:56:10:56:10 | passwd | semmle.label | passwd |
@@ -21,6 +25,8 @@ nodes
2125
| testUserDefaults.swift:28:15:28:15 | password | semmle.label | password |
2226
| testUserDefaults.swift:41:24:41:24 | x | semmle.label | x |
2327
| testUserDefaults.swift:42:28:42:28 | x | semmle.label | x |
28+
| testUserDefaults.swift:44:10:44:22 | call to getPassword() | semmle.label | call to getPassword() |
29+
| testUserDefaults.swift:45:28:45:28 | y | semmle.label | y |
2430
| testUserDefaults.swift:49:28:49:30 | .password | semmle.label | .password |
2531
| testUserDefaults.swift:55:10:55:10 | passwd | semmle.label | passwd |
2632
| testUserDefaults.swift:56:10:56:10 | passwd | semmle.label | passwd |
@@ -32,12 +38,14 @@ subpaths
3238
#select
3339
| testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | This operation stores 'password' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:28:12:28:12 | password | password |
3440
| testNSUbiquitousKeyValueStore.swift:42:40:42:40 | x | testNSUbiquitousKeyValueStore.swift:41:24:41:24 | x | testNSUbiquitousKeyValueStore.swift:42:40:42:40 | x | This operation stores 'x' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:41:24:41:24 | x | x |
41+
| testNSUbiquitousKeyValueStore.swift:45:40:45:40 | y | testNSUbiquitousKeyValueStore.swift:44:10:44:22 | call to getPassword() | testNSUbiquitousKeyValueStore.swift:45:40:45:40 | y | This operation stores 'y' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:44:10:44:22 | call to getPassword() | call to getPassword() |
3542
| testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | This operation stores '.password' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:49:40:49:42 | .password | .password |
3643
| testNSUbiquitousKeyValueStore.swift:59:40:59:40 | x | testNSUbiquitousKeyValueStore.swift:55:10:55:10 | passwd | testNSUbiquitousKeyValueStore.swift:59:40:59:40 | x | This operation stores 'x' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:55:10:55:10 | passwd | passwd |
3744
| testNSUbiquitousKeyValueStore.swift:60:40:60:40 | y | testNSUbiquitousKeyValueStore.swift:56:10:56:10 | passwd | testNSUbiquitousKeyValueStore.swift:60:40:60:40 | y | This operation stores 'y' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:56:10:56:10 | passwd | passwd |
3845
| testNSUbiquitousKeyValueStore.swift:61:40:61:40 | z | testNSUbiquitousKeyValueStore.swift:57:10:57:10 | passwd | testNSUbiquitousKeyValueStore.swift:61:40:61:40 | z | This operation stores 'z' in iCloud. It may contain unencrypted sensitive data from $@. | testNSUbiquitousKeyValueStore.swift:57:10:57:10 | passwd | passwd |
3946
| testUserDefaults.swift:28:15:28:15 | password | testUserDefaults.swift:28:15:28:15 | password | testUserDefaults.swift:28:15:28:15 | password | This operation stores 'password' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:28:15:28:15 | password | password |
4047
| testUserDefaults.swift:42:28:42:28 | x | testUserDefaults.swift:41:24:41:24 | x | testUserDefaults.swift:42:28:42:28 | x | This operation stores 'x' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:41:24:41:24 | x | x |
48+
| testUserDefaults.swift:45:28:45:28 | y | testUserDefaults.swift:44:10:44:22 | call to getPassword() | testUserDefaults.swift:45:28:45:28 | y | This operation stores 'y' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:44:10:44:22 | call to getPassword() | call to getPassword() |
4149
| testUserDefaults.swift:49:28:49:30 | .password | testUserDefaults.swift:49:28:49:30 | .password | testUserDefaults.swift:49:28:49:30 | .password | This operation stores '.password' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:49:28:49:30 | .password | .password |
4250
| testUserDefaults.swift:59:28:59:28 | x | testUserDefaults.swift:55:10:55:10 | passwd | testUserDefaults.swift:59:28:59:28 | x | This operation stores 'x' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:55:10:55:10 | passwd | passwd |
4351
| testUserDefaults.swift:60:28:60:28 | y | testUserDefaults.swift:56:10:56:10 | passwd | testUserDefaults.swift:60:28:60:28 | y | This operation stores 'y' in the user defaults database. It may contain unencrypted sensitive data from $@. | testUserDefaults.swift:56:10:56:10 | passwd | passwd |

0 commit comments

Comments
 (0)