hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Fix the versions in 'examples' as well.

Browse Source
This commit is contained in:
Geoffrey White
2023-05-03 14:31:48 +01:00
parent 2999b5fea1
commit 02dc9be239
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
swift/ql/examples/snippets/simple_constant_password.ql
View File

@@ -23,4 +23,4 @@ module ConstantPasswordFlow = TaintTracking::Global<ConstantPasswordConfig>;
from DataFlow::Node sourceNode, DataFlow::Node sinkNode
where ConstantPasswordFlow::flow(sourceNode, sinkNode)
select sinkNode, "The value '" + sourceNode.toString() + "' is used as a constant password."
select sinkNode, "The value $@ is used as a constant password.", sourceNode, sourceNode.toString()

2
swift/ql/examples/snippets/simple_sql_injection.ql
View File

@@ -17,7 +17,7 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node node) {
exists(CallExpr call |
call.getStaticTarget().(MethodDecl).hasQualifiedName("Connection", "execute(_:)") and
call.getStaticTarget().(Method).hasQualifiedName("Connection", "execute(_:)") and
call.getArgument(0).getExpr() = node.asExpr()
)
}

6
swift/ql/examples/snippets/simple_uncontrolled_string_format.ql
View File

@@ -9,12 +9,12 @@
import swift
import codeql.swift.dataflow.DataFlow
from CallExpr call, MethodDecl method, Expr sinkExpr
from CallExpr call, Method method, DataFlow::Node sinkNode
where
call.getStaticTarget() = method and
method.hasQualifiedName("String", "init(format:_:)") and
sinkExpr = call.getArgument(0).getExpr() and
sinkNode.asExpr() = call.getArgument(0).getExpr() and
not exists(StringLiteralExpr sourceLiteral |
DataFlow::localFlow(DataFlow::exprNode(sourceLiteral), DataFlow::exprNode(sinkExpr))
DataFlow::localFlow(DataFlow::exprNode(sourceLiteral), sinkNode)
)
select call, "Format argument to " + method.getName() + " isn't hard-coded."