Skip to content

Commit e589b1f

Browse files
geoffw0geoffw0
committed
Swift: Fix query barriers.
1 parent 6aa43e0 commit e589b1f

10 files changed

+7
-65
lines changed

‎swift/ql/lib/codeql/swift/security/CommandInjectionExtensions.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,6 @@ private class CommandInjectionSinks extends SinkModelCsv {
6363
private class CommandInjectionDefaultBarrier extends CommandInjectionBarrier {
6464
CommandInjectionDefaultBarrier() {
6565
// any numeric type
66-
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = "Numeric"
66+
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = ["Numeric", "SignedInteger", "UnsignedInteger"]
6767
}
6868
}

‎swift/ql/lib/codeql/swift/security/PredicateInjectionExtensions.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,6 @@ private class PredicateInjectionSinkCsv extends SinkModelCsv {
4646
private class PredicateInjectionDefaultBarrier extends PredicateInjectionBarrier {
4747
PredicateInjectionDefaultBarrier() {
4848
// any numeric type
49-
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = "Numeric"
49+
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = ["Numeric", "SignedInteger", "UnsignedInteger"]
5050
}
5151
}

‎swift/ql/lib/codeql/swift/security/SqlInjectionExtensions.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,6 @@ private class DefaultSqlInjectionSink extends SqlInjectionSink {
190190
private class SqlInjectionDefaultBarrier extends SqlInjectionBarrier {
191191
SqlInjectionDefaultBarrier() {
192192
// any numeric type
193-
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = "Numeric"
193+
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = ["Numeric", "SignedInteger", "UnsignedInteger"]
194194
}
195195
}

‎swift/ql/lib/codeql/swift/security/UncontrolledFormatStringExtensions.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,6 @@ class HeuristicUncontrolledFormatStringSink extends UncontrolledFormatStringSink
9494
private class UncontrolledFormatStringDefaultBarrier extends UncontrolledFormatStringBarrier {
9595
UncontrolledFormatStringDefaultBarrier() {
9696
// any numeric type
97-
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = "Numeric"
97+
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = ["Numeric", "SignedInteger", "UnsignedInteger"]
9898
}
9999
}

‎swift/ql/lib/codeql/swift/security/UnsafeJsEvalExtensions.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,6 @@ private class DefaultUnsafeJsEvalSink extends UnsafeJsEvalSink {
127127
private class UnsafeJsEvalDefaultBarrier extends UnsafeJsEvalBarrier {
128128
UnsafeJsEvalDefaultBarrier() {
129129
// any numeric type
130-
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = "Numeric"
130+
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = ["Numeric", "SignedInteger", "UnsignedInteger"]
131131
}
132132
}

‎swift/ql/lib/codeql/swift/security/UnsafeUnpackExtensions.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,6 @@ private class UnsafeUnpackAdditionalDataFlowStep extends UnsafeUnpackAdditionalF
7373
private class UnsafeUnpackDefaultBarrier extends UnsafeUnpackBarrier {
7474
UnsafeUnpackDefaultBarrier() {
7575
// any numeric type
76-
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = "Numeric"
76+
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = ["Numeric", "SignedInteger", "UnsignedInteger"]
7777
}
7878
}

‎swift/ql/lib/codeql/swift/security/regex/RegexInjectionExtensions.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,6 @@ private class RegexInjectionSinks extends SinkModelCsv {
6464
private class RegexInjectionDefaultBarrier extends RegexInjectionBarrier {
6565
RegexInjectionDefaultBarrier() {
6666
// any numeric type
67-
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = "Numeric"
67+
this.asExpr().getType().getUnderlyingType().getABaseType*().getName() = ["Numeric", "SignedInteger", "UnsignedInteger"]
6868
}
6969
}

‎swift/ql/test/query-tests/Security/CWE-089/SqlInjection.expected

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,6 @@ edges
8282
| GRDB.swift:342:26:342:80 | call to String.init(contentsOf:) | GRDB.swift:349:84:349:84 | remoteString | provenance | |
8383
| GRDB.swift:342:26:342:80 | call to String.init(contentsOf:) | GRDB.swift:350:69:350:69 | remoteString | provenance | |
8484
| GRDB.swift:342:26:342:80 | call to String.init(contentsOf:) | GRDB.swift:351:84:351:84 | remoteString | provenance | |
85-
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:63:25:63:25 | remoteString | provenance | |
8685
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:73:17:73:17 | unsafeQuery1 | provenance | |
8786
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:74:17:74:17 | unsafeQuery2 | provenance | |
8887
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:75:17:75:17 | unsafeQuery3 | provenance | |
@@ -98,25 +97,20 @@ edges
9897
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:117:16:117:16 | unsafeQuery1 | provenance | |
9998
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:119:16:119:16 | unsafeQuery1 | provenance | |
10099
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:132:20:132:20 | remoteString | provenance | |
101-
| SQLite.swift:63:21:63:37 | call to Self.init(_:) | SQLite.swift:77:17:77:17 | safeQuery2 | provenance | |
102-
| SQLite.swift:63:25:63:25 | remoteString | SQLite.swift:63:21:63:37 | call to Self.init(_:) | provenance | |
103100
| other.swift:46:25:46:79 | call to String.init(contentsOf:) | other.swift:50:22:50:22 | remoteString | provenance | |
104101
| other.swift:46:25:46:79 | call to String.init(contentsOf:) | other.swift:52:14:52:14 | remoteString | provenance | |
105102
| other.swift:46:25:46:79 | call to String.init(contentsOf:) | other.swift:53:14:53:14 | remoteString | provenance | |
106103
| other.swift:46:25:46:79 | call to String.init(contentsOf:) | other.swift:54:31:54:31 | remoteString | provenance | |
107104
| other.swift:46:25:46:79 | call to String.init(contentsOf:) | other.swift:55:14:55:14 | remoteString | provenance | |
108105
| other.swift:46:25:46:79 | call to String.init(contentsOf:) | other.swift:57:16:57:16 | remoteString | provenance | |
109106
| other.swift:54:31:54:31 | remoteString | other.swift:54:14:54:43 | call to NSString.init(string:) | provenance | |
110-
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:123:25:123:25 | remoteString | provenance | |
111107
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:133:33:133:33 | unsafeQuery1 | provenance | |
112108
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:134:33:134:33 | unsafeQuery2 | provenance | |
113109
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:135:33:135:33 | unsafeQuery3 | provenance | |
114110
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:145:26:145:26 | unsafeQuery3 | provenance | |
115111
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:175:29:175:29 | unsafeQuery3 | provenance | |
116112
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:183:29:183:29 | unsafeQuery3 | provenance | |
117113
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:189:13:189:13 | unsafeQuery3 | provenance | |
118-
| sqlite3_c_api.swift:123:21:123:37 | call to Self.init(_:) | sqlite3_c_api.swift:137:33:137:33 | safeQuery2 | provenance | |
119-
| sqlite3_c_api.swift:123:25:123:25 | remoteString | sqlite3_c_api.swift:123:21:123:37 | call to Self.init(_:) | provenance | |
120114
| sqlite3_c_api.swift:189:13:189:13 | unsafeQuery3 | sqlite3_c_api.swift:189:13:189:58 | call to data(using:allowLossyConversion:) | provenance | |
121115
| sqlite3_c_api.swift:189:13:189:58 | call to data(using:allowLossyConversion:) | sqlite3_c_api.swift:190:2:190:2 | data | provenance | |
122116
| sqlite3_c_api.swift:190:2:190:2 | data | sqlite3_c_api.swift:190:21:190:21 | [post] buffer | provenance | |
@@ -220,12 +214,9 @@ nodes
220214
| GRDB.swift:350:69:350:69 | remoteString | semmle.label | remoteString |
221215
| GRDB.swift:351:84:351:84 | remoteString | semmle.label | remoteString |
222216
| SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
223-
| SQLite.swift:63:21:63:37 | call to Self.init(_:) | semmle.label | call to Self.init(_:) |
224-
| SQLite.swift:63:25:63:25 | remoteString | semmle.label | remoteString |
225217
| SQLite.swift:73:17:73:17 | unsafeQuery1 | semmle.label | unsafeQuery1 |
226218
| SQLite.swift:74:17:74:17 | unsafeQuery2 | semmle.label | unsafeQuery2 |
227219
| SQLite.swift:75:17:75:17 | unsafeQuery3 | semmle.label | unsafeQuery3 |
228-
| SQLite.swift:77:17:77:17 | safeQuery2 | semmle.label | safeQuery2 |
229220
| SQLite.swift:83:29:83:29 | unsafeQuery3 | semmle.label | unsafeQuery3 |
230221
| SQLite.swift:95:32:95:32 | remoteString | semmle.label | remoteString |
231222
| SQLite.swift:100:29:100:29 | unsafeQuery1 | semmle.label | unsafeQuery1 |
@@ -247,12 +238,9 @@ nodes
247238
| other.swift:55:14:55:14 | remoteString | semmle.label | remoteString |
248239
| other.swift:57:16:57:16 | remoteString | semmle.label | remoteString |
249240
| sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
250-
| sqlite3_c_api.swift:123:21:123:37 | call to Self.init(_:) | semmle.label | call to Self.init(_:) |
251-
| sqlite3_c_api.swift:123:25:123:25 | remoteString | semmle.label | remoteString |
252241
| sqlite3_c_api.swift:133:33:133:33 | unsafeQuery1 | semmle.label | unsafeQuery1 |
253242
| sqlite3_c_api.swift:134:33:134:33 | unsafeQuery2 | semmle.label | unsafeQuery2 |
254243
| sqlite3_c_api.swift:135:33:135:33 | unsafeQuery3 | semmle.label | unsafeQuery3 |
255-
| sqlite3_c_api.swift:137:33:137:33 | safeQuery2 | semmle.label | safeQuery2 |
256244
| sqlite3_c_api.swift:145:26:145:26 | unsafeQuery3 | semmle.label | unsafeQuery3 |
257245
| sqlite3_c_api.swift:175:29:175:29 | unsafeQuery3 | semmle.label | unsafeQuery3 |
258246
| sqlite3_c_api.swift:183:29:183:29 | unsafeQuery3 | semmle.label | unsafeQuery3 |
@@ -351,7 +339,6 @@ subpaths
351339
| SQLite.swift:73:17:73:17 | unsafeQuery1 | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:73:17:73:17 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | user-provided value |
352340
| SQLite.swift:74:17:74:17 | unsafeQuery2 | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:74:17:74:17 | unsafeQuery2 | This query depends on a $@. | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | user-provided value |
353341
| SQLite.swift:75:17:75:17 | unsafeQuery3 | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:75:17:75:17 | unsafeQuery3 | This query depends on a $@. | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | user-provided value |
354-
| SQLite.swift:77:17:77:17 | safeQuery2 | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:77:17:77:17 | safeQuery2 | This query depends on a $@. | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | user-provided value |
355342
| SQLite.swift:83:29:83:29 | unsafeQuery3 | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:83:29:83:29 | unsafeQuery3 | This query depends on a $@. | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | user-provided value |
356343
| SQLite.swift:95:32:95:32 | remoteString | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:95:32:95:32 | remoteString | This query depends on a $@. | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | user-provided value |
357344
| SQLite.swift:100:29:100:29 | unsafeQuery1 | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | SQLite.swift:100:29:100:29 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | call to String.init(contentsOf:) | user-provided value |
@@ -373,7 +360,6 @@ subpaths
373360
| sqlite3_c_api.swift:133:33:133:33 | unsafeQuery1 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:133:33:133:33 | unsafeQuery1 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
374361
| sqlite3_c_api.swift:134:33:134:33 | unsafeQuery2 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:134:33:134:33 | unsafeQuery2 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
375362
| sqlite3_c_api.swift:135:33:135:33 | unsafeQuery3 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:135:33:135:33 | unsafeQuery3 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
376-
| sqlite3_c_api.swift:137:33:137:33 | safeQuery2 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:137:33:137:33 | safeQuery2 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
377363
| sqlite3_c_api.swift:145:26:145:26 | unsafeQuery3 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:145:26:145:26 | unsafeQuery3 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
378364
| sqlite3_c_api.swift:175:29:175:29 | unsafeQuery3 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:175:29:175:29 | unsafeQuery3 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |
379365
| sqlite3_c_api.swift:183:29:183:29 | unsafeQuery3 | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | sqlite3_c_api.swift:183:29:183:29 | unsafeQuery3 | This query depends on a $@. | sqlite3_c_api.swift:122:26:122:80 | call to String.init(contentsOf:) | user-provided value |

0 commit comments

Comments
 (0)