Skip to content

Commit f45b89a

Browse files
geoffw0geoffw0
committed
Swift: Add a few more variant test cases.
1 parent 922fc3a commit f45b89a

File tree

2 files changed

+39
-31
lines changed

2 files changed

+39
-31
lines changed

‎swift/ql/test/query-tests/Security/CWE-116/BadTagFilter.expected

Lines changed: 30 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,31 @@
11
| test.swift:79:26:79:48 | <script.*?>.*?<\\/script> | This regular expression does not match upper case <SCRIPT> tags. |
2-
| test.swift:87:26:87:53 | <script.*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
3-
| test.swift:91:26:91:33 | <!--.*--> | This regular expression does not match comments containing newlines. |
4-
| test.swift:95:26:95:35 | <!--.*--!?> | This regular expression does not match comments containing newlines. |
5-
| test.swift:99:26:99:35 | <!--.*--!?> | This regular expression does not match comments containing newlines. |
6-
| test.swift:103:26:103:58 | <script.*?>(.\|\\s)*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
7-
| test.swift:107:26:107:56 | <script[^>]*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
8-
| test.swift:111:26:111:63 | <script(\\s\|\\w\|=\|")*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
9-
| test.swift:118:28:118:65 | <script(\\s\|\\w\|=\|')*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
10-
| test.swift:122:50:122:87 | <script(\\s\|\\w\|=\|')*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
11-
| test.swift:129:28:129:69 | <script( \|\\n\|\\w\|=\|'\|")*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
12-
| test.swift:133:50:133:91 | <script( \|\\n\|\\w\|=\|'\|")*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
13-
| test.swift:140:28:140:55 | <script.*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
14-
| test.swift:143:50:143:77 | <script.*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
15-
| test.swift:150:28:150:73 | <(script\|SCRIPT).*?>.*?<\\/(script\|SCRIPT)[^>]*> | This regular expression does not match mixed case <sCrIpT> tags. |
16-
| test.swift:153:50:153:95 | <(script\|SCRIPT).*?>.*?<\\/(script\|SCRIPT)[^>]*> | This regular expression does not match mixed case <sCrIpT> tags. |
17-
| test.swift:160:28:160:60 | <script[^>]*?>[\\s\\S]*?<\\/script.*> | This regular expression does not match upper case <SCRIPT> tags. |
18-
| test.swift:163:50:163:82 | <script[^>]*?>[\\s\\S]*?<\\/script.*> | This regular expression does not match upper case <SCRIPT> tags. |
19-
| test.swift:170:28:170:64 | <script[^>]*?>[\\s\\S]*?<\\/script[^>]*?> | This regular expression does not match upper case <SCRIPT> tags. |
20-
| test.swift:173:50:173:86 | <script[^>]*?>[\\s\\S]*?<\\/script[^>]*?> | This regular expression does not match upper case <SCRIPT> tags. |
21-
| test.swift:177:27:177:68 | <(?:!--([\\S\|\\s]*?)-->)\|([^\\/\\s>]+)[\\S\\s]*?> | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 1 and comments ending with --!> are matched with capture group 2. |
22-
| test.swift:180:50:180:91 | <(?:!--([\\S\|\\s]*?)-->)\|([^\\/\\s>]+)[\\S\\s]*?> | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 1 and comments ending with --!> are matched with capture group 2. |
23-
| test.swift:184:27:184:167 | <(?:(?:\\/([^>]+)>)\|(?:!--([\\S\|\\s]*?)-->)\|(?:([^\\/\\s>]+)((?:\\s+[\\w\\-:.]+(?:\\s*=\\s*?(?:(?:"[^"]*")\|(?:'[^']*')\|[^\\s"'\\/>]+))?)*)[\\S\\s]*?(\\/?)>)) | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 2 and comments ending with --!> are matched with capture group 3, 4. |
24-
| test.swift:187:50:187:190 | <(?:(?:\\/([^>]+)>)\|(?:!--([\\S\|\\s]*?)-->)\|(?:([^\\/\\s>]+)((?:\\s+[\\w\\-:.]+(?:\\s*=\\s*?(?:(?:"[^"]*")\|(?:'[^']*')\|[^\\s"'\\/>]+))?)*)[\\S\\s]*?(\\/?)>)) | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 2 and comments ending with --!> are matched with capture group 3, 4. |
25-
| test.swift:191:51:191:84 | <script\\b[^>]*>([\\s\\S]*?)<\\/script> | This regular expression does not match upper case <SCRIPT> tags. |
26-
| test.swift:195:51:195:104 | (<[a-z\\/!$]("[^"]*"\|'[^']*'\|[^'">])*>\|<!(--.*?--\\s*)+>) | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 3 and comments ending with --!> are matched with capture group 1. |
27-
| test.swift:199:51:199:293 | <(?:(?:!--([\\w\\W]*?)-->)\|(?:!\\[CDATA\\[([\\w\\W]*?)\\]\\]>)\|(?:!DOCTYPE([\\w\\W]*?)>)\|(?:\\?([^\\s\\/<>]+) ?([\\w\\W]*?)[?/]>)\|(?:\\/([A-Za-z][A-Za-z0-9\\-_\\:\\.]*)>)\|(?:([A-Za-z][A-Za-z0-9\\-_\\:\\.]*)((?:\\s+[^"'>]+(?:(?:"[^"]*")\|(?:'[^']*')\|[^>]*))*\|\\/\|\\s+)>)) | This regular expression only parses --> (capture group 1) and not --!> as an HTML comment end tag. |
28-
| test.swift:203:51:203:77 | <!--([\\w\\W]*?)-->\|<([^>]*?)> | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 1 and comments ending with --!> are matched with capture group 2. |
29-
| test.swift:207:51:207:93 | <script([^>]*)>([\\\\S\\\\s]*?)<\\/script([^>]*)> | This regular expression does not match script end tags like </script >. |
30-
| test.swift:211:51:211:52 | --> | This regular expression only parses --> and not --!> as a HTML comment end tag. |
2+
| test.swift:90:27:90:54 | <script.*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
3+
| test.swift:94:50:94:77 | <script.*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
4+
| test.swift:98:26:98:33 | <!--.*--> | This regular expression does not match comments containing newlines. |
5+
| test.swift:102:26:102:35 | <!--.*--!?> | This regular expression does not match comments containing newlines. |
6+
| test.swift:106:26:106:35 | <!--.*--!?> | This regular expression does not match comments containing newlines. |
7+
| test.swift:110:26:110:58 | <script.*?>(.\|\\s)*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
8+
| test.swift:114:26:114:56 | <script[^>]*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
9+
| test.swift:118:26:118:63 | <script(\\s\|\\w\|=\|")*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
10+
| test.swift:125:28:125:65 | <script(\\s\|\\w\|=\|')*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
11+
| test.swift:129:50:129:87 | <script(\\s\|\\w\|=\|')*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
12+
| test.swift:136:28:136:69 | <script( \|\\n\|\\w\|=\|'\|")*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
13+
| test.swift:140:50:140:91 | <script( \|\\n\|\\w\|=\|'\|")*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
14+
| test.swift:147:28:147:55 | <script.*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
15+
| test.swift:150:50:150:77 | <script.*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
16+
| test.swift:157:28:157:73 | <(script\|SCRIPT).*?>.*?<\\/(script\|SCRIPT)[^>]*> | This regular expression does not match mixed case <sCrIpT> tags. |
17+
| test.swift:160:50:160:95 | <(script\|SCRIPT).*?>.*?<\\/(script\|SCRIPT)[^>]*> | This regular expression does not match mixed case <sCrIpT> tags. |
18+
| test.swift:167:28:167:60 | <script[^>]*?>[\\s\\S]*?<\\/script.*> | This regular expression does not match upper case <SCRIPT> tags. |
19+
| test.swift:170:50:170:82 | <script[^>]*?>[\\s\\S]*?<\\/script.*> | This regular expression does not match upper case <SCRIPT> tags. |
20+
| test.swift:177:28:177:64 | <script[^>]*?>[\\s\\S]*?<\\/script[^>]*?> | This regular expression does not match upper case <SCRIPT> tags. |
21+
| test.swift:180:50:180:86 | <script[^>]*?>[\\s\\S]*?<\\/script[^>]*?> | This regular expression does not match upper case <SCRIPT> tags. |
22+
| test.swift:184:27:184:68 | <(?:!--([\\S\|\\s]*?)-->)\|([^\\/\\s>]+)[\\S\\s]*?> | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 1 and comments ending with --!> are matched with capture group 2. |
23+
| test.swift:187:50:187:91 | <(?:!--([\\S\|\\s]*?)-->)\|([^\\/\\s>]+)[\\S\\s]*?> | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 1 and comments ending with --!> are matched with capture group 2. |
24+
| test.swift:191:27:191:167 | <(?:(?:\\/([^>]+)>)\|(?:!--([\\S\|\\s]*?)-->)\|(?:([^\\/\\s>]+)((?:\\s+[\\w\\-:.]+(?:\\s*=\\s*?(?:(?:"[^"]*")\|(?:'[^']*')\|[^\\s"'\\/>]+))?)*)[\\S\\s]*?(\\/?)>)) | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 2 and comments ending with --!> are matched with capture group 3, 4. |
25+
| test.swift:194:50:194:190 | <(?:(?:\\/([^>]+)>)\|(?:!--([\\S\|\\s]*?)-->)\|(?:([^\\/\\s>]+)((?:\\s+[\\w\\-:.]+(?:\\s*=\\s*?(?:(?:"[^"]*")\|(?:'[^']*')\|[^\\s"'\\/>]+))?)*)[\\S\\s]*?(\\/?)>)) | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 2 and comments ending with --!> are matched with capture group 3, 4. |
26+
| test.swift:198:51:198:84 | <script\\b[^>]*>([\\s\\S]*?)<\\/script> | This regular expression does not match upper case <SCRIPT> tags. |
27+
| test.swift:202:51:202:104 | (<[a-z\\/!$]("[^"]*"\|'[^']*'\|[^'">])*>\|<!(--.*?--\\s*)+>) | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 3 and comments ending with --!> are matched with capture group 1. |
28+
| test.swift:206:51:206:293 | <(?:(?:!--([\\w\\W]*?)-->)\|(?:!\\[CDATA\\[([\\w\\W]*?)\\]\\]>)\|(?:!DOCTYPE([\\w\\W]*?)>)\|(?:\\?([^\\s\\/<>]+) ?([\\w\\W]*?)[?/]>)\|(?:\\/([A-Za-z][A-Za-z0-9\\-_\\:\\.]*)>)\|(?:([A-Za-z][A-Za-z0-9\\-_\\:\\.]*)((?:\\s+[^"'>]+(?:(?:"[^"]*")\|(?:'[^']*')\|[^>]*))*\|\\/\|\\s+)>)) | This regular expression only parses --> (capture group 1) and not --!> as an HTML comment end tag. |
29+
| test.swift:210:51:210:77 | <!--([\\w\\W]*?)-->\|<([^>]*?)> | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 1 and comments ending with --!> are matched with capture group 2. |
30+
| test.swift:214:51:214:93 | <script([^>]*)>([\\\\S\\\\s]*?)<\\/script([^>]*)> | This regular expression does not match script end tags like </script >. |
31+
| test.swift:218:51:218:52 | --> | This regular expression only parses --> and not --!> as a HTML comment end tag. |

‎swift/ql/test/query-tests/Security/CWE-116/test.swift

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,9 +83,16 @@ func myRegexpVariantsTests(myUrl: URL) throws {
8383
let re2 = try Regex(#"<script.*?>.*?<\/script>/is"#).ignoresCase(true)
8484
_ = try re2.firstMatch(in: tainted)
8585

86+
// GOOD
87+
let re3a = try Regex(#"(?is)<script.*?>.*?<\/script[^>]*>"#)
88+
_ = try re3a.firstMatch(in: tainted)
89+
// GOOD [FALSE POSITIVE]
90+
let re3b = try Regex(#"<script.*?>.*?<\/script[^>]*>"#).ignoresCase(true).dotMatchesNewlines(true)
91+
_ = try re3b.firstMatch(in: tainted)
8692
// GOOD [FALSE POSITIVE]
87-
let re3 = try Regex(#"<script.*?>.*?<\/script[^>]*>"#).ignoresCase(true).dotMatchesNewlines(true)
88-
_ = try re3.firstMatch(in: tainted)
93+
let options3b: NSRegularExpression.Options = [.caseInsensitive, .dotMatchesLineSeparators]
94+
let ns3b = try NSRegularExpression(pattern: #"<script.*?>.*?<\/script[^>]*>"#, options: options3b)
95+
_ = ns3b.firstMatch(in: tainted, range: NSMakeRange(0, tainted.utf16.count))
8996

9097
// GOOD - we don't care regexps that only match comments [FALSE POSITIVE]
9198
let re4 = try Regex(#"<!--.*-->"#).ignoresCase(true).dotMatchesNewlines(true)

0 commit comments

Comments
 (0)