hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Model formatting append methods.

Browse Source
This commit is contained in:
Geoffrey White
2023-11-15 17:32:26 +00:00
parent a6fe620bcb
commit 1040561ec1
3 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
swift/ql/lib/codeql/swift/StringFormat.qll
View File

@@ -55,6 +55,19 @@ class LocalizedStringWithFormat extends FormattingFunction, Method {
override int getFormatParameterIndex() { result = 0 }
}
/**
* A method that appends a formatted string.
*/
class StringMethodWithFormat extends FormattingFunction, Method {
StringMethodWithFormat() {
this.hasQualifiedName("NSMutableString", "appendFormat(_:_:)")
or
this.hasQualifiedName("StringProtocol", "appendingFormat(_:_:)")
}
override int getFormatParameterIndex() { result = 0 }
}
/**
* The functions `NSLog` and `NSLogv`.
*/

8
swift/ql/test/query-tests/Security/CWE-134/UncontrolledFormatString.expected
View File

@@ -17,11 +17,14 @@ edges
| UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:115:11:115:11 | tainted |
| UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:116:11:116:11 | tainted |
| UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:118:61:118:61 | tainted |
| UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:130:39:130:39 | tainted |
| UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:135:37:135:37 | tainted |
| UncontrolledFormatString.swift:108:43:108:43 | tainted | UncontrolledFormatString.swift:108:26:108:50 | call to NSString.init(string:) |
| UncontrolledFormatString.swift:109:57:109:57 | tainted | UncontrolledFormatString.swift:109:40:109:64 | call to NSString.init(string:) |
| UncontrolledFormatString.swift:111:50:111:50 | tainted | UncontrolledFormatString.swift:111:33:111:57 | call to NSString.init(string:) |
| UncontrolledFormatString.swift:112:64:112:64 | tainted | UncontrolledFormatString.swift:112:47:112:71 | call to NSString.init(string:) |
| UncontrolledFormatString.swift:116:11:116:11 | tainted | UncontrolledFormatString.swift:77:12:77:22 | format |
| UncontrolledFormatString.swift:135:37:135:37 | tainted | UncontrolledFormatString.swift:135:20:135:44 | call to NSString.init(string:) |
nodes
| UncontrolledFormatString.swift:77:12:77:22 | format | semmle.label | format |
| UncontrolledFormatString.swift:78:22:80:5 | format | semmle.label | format |
@@ -47,6 +50,9 @@ nodes
| UncontrolledFormatString.swift:115:11:115:11 | tainted | semmle.label | tainted |
| UncontrolledFormatString.swift:116:11:116:11 | tainted | semmle.label | tainted |
| UncontrolledFormatString.swift:118:61:118:61 | tainted | semmle.label | tainted |
| UncontrolledFormatString.swift:130:39:130:39 | tainted | semmle.label | tainted |
| UncontrolledFormatString.swift:135:20:135:44 | call to NSString.init(string:) | semmle.label | call to NSString.init(string:) |
| UncontrolledFormatString.swift:135:37:135:37 | tainted | semmle.label | tainted |
subpaths
#select
| UncontrolledFormatString.swift:79:16:79:16 | format | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:79:16:79:16 | format | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
@@ -63,3 +69,5 @@ subpaths
| UncontrolledFormatString.swift:112:47:112:71 | call to NSString.init(string:) | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:112:47:112:71 | call to NSString.init(string:) | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
| UncontrolledFormatString.swift:115:11:115:11 | tainted | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:115:11:115:11 | tainted | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
| UncontrolledFormatString.swift:118:61:118:61 | tainted | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:118:61:118:61 | tainted | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
| UncontrolledFormatString.swift:130:39:130:39 | tainted | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:130:39:130:39 | tainted | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |
| UncontrolledFormatString.swift:135:20:135:44 | call to NSString.init(string:) | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | UncontrolledFormatString.swift:135:20:135:44 | call to NSString.init(string:) | This format string depends on $@. | UncontrolledFormatString.swift:91:24:91:77 | call to String.init(contentsOf:) | this user-provided value |

4
swift/ql/test/query-tests/Security/CWE-134/UncontrolledFormatString.swift
View File

@@ -127,12 +127,12 @@ func tests() throws {
_ = String("abc").appendingFormat("%s", "abc") // GOOD: not tainted
_ = String("abc").appendingFormat("%s", tainted) // GOOD: format not tainted
_ = String("abc").appendingFormat(tainted, "abc") // BAD [NOT DETECTED]
_ = String("abc").appendingFormat(tainted, "abc") // BAD
_ = String(tainted).appendingFormat("%s", "abc") // GOOD: format not tainted
let s = NSMutableString(string: "foo")
s.appendFormat(NSString(string: "%s"), "abc") // GOOD: not tainted
s.appendFormat(NSString(string: tainted), "abc") // BAD [NOT DETECTED]
s.appendFormat(NSString(string: tainted), "abc") // BAD
_ = NSPredicate(format: tainted) // GOOD: this should be flagged by `swift/predicate-injection`, not `swift/uncontrolled-format-string`