hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-18 05:24:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Implement field content as well.

Browse Source
This commit is contained in:
Geoffrey White
2022-11-28 12:27:33 +00:00
parent ffbd201450
commit 30468dd419
4 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
swift/ql/lib/codeql/swift/frameworks/StandardLibrary/WebView.qll
View File

@@ -144,3 +144,16 @@ private class WKUserScriptSummaries extends SummaryModelCsv {
]
}
}
/**
* A content implying that, if a `WKUserScript` is tainted, its `source` field is tainted.
*/
private class WKUserScriptInheritsTaint extends TaintInheritingContent,
DataFlow::Content::FieldContent {
WKUserScriptInheritsTaint() {
exists(FieldDecl f | this.getField() = f |
f.getEnclosingDecl().(ClassOrStructDecl).getName() = "WKUserScript" and
f.getName() = "source"
)
}
}

3
swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected
View File

@@ -166,3 +166,6 @@
| url.swift:101:15:101:57 | ...! | url.swift:101:15:101:59 | .user |
| url.swift:102:15:102:57 | ...! | url.swift:102:15:102:59 | .password |
| webview.swift:77:11:77:18 | call to source() | webview.swift:77:10:77:41 | .body |
| webview.swift:130:10:130:10 | a | webview.swift:130:10:130:12 | .source |
| webview.swift:134:10:134:10 | b | webview.swift:134:10:134:12 | .source |
| webview.swift:139:10:139:10 | c | webview.swift:139:10:139:12 | .source |

6
swift/ql/test/library-tests/dataflow/taint/Taint.expected
View File

@@ -533,9 +533,11 @@ edges
| webview.swift:122:17:122:17 | s : | webview.swift:55:5:55:48 | [summary param] 0 in setValue(_:forProperty:) : |
| webview.swift:122:17:122:17 | s : | webview.swift:122:5:122:5 | [post] v3 : |
| webview.swift:132:13:132:102 | call to init(source:injectionTime:forMainFrameOnly:) : | webview.swift:133:10:133:10 | b |
| webview.swift:132:13:132:102 | call to init(source:injectionTime:forMainFrameOnly:) : | webview.swift:134:10:134:12 | .source |
| webview.swift:132:34:132:41 | call to source() : | webview.swift:65:5:65:93 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:) : |
| webview.swift:132:34:132:41 | call to source() : | webview.swift:132:13:132:102 | call to init(source:injectionTime:forMainFrameOnly:) : |
| webview.swift:137:13:137:113 | call to init(source:injectionTime:forMainFrameOnly:in:) : | webview.swift:138:10:138:10 | c |
| webview.swift:137:13:137:113 | call to init(source:injectionTime:forMainFrameOnly:in:) : | webview.swift:139:10:139:12 | .source |
| webview.swift:137:34:137:41 | call to source() : | webview.swift:66:5:66:126 | [summary param] 0 in init(source:injectionTime:forMainFrameOnly:in:) : |
| webview.swift:137:34:137:41 | call to source() : | webview.swift:137:13:137:113 | call to init(source:injectionTime:forMainFrameOnly:in:) : |
nodes
@@ -1131,9 +1133,11 @@ nodes
| webview.swift:132:13:132:102 | call to init(source:injectionTime:forMainFrameOnly:) : | semmle.label | call to init(source:injectionTime:forMainFrameOnly:) : |
| webview.swift:132:34:132:41 | call to source() : | semmle.label | call to source() : |
| webview.swift:133:10:133:10 | b | semmle.label | b |
| webview.swift:134:10:134:12 | .source | semmle.label | .source |
| webview.swift:137:13:137:113 | call to init(source:injectionTime:forMainFrameOnly:in:) : | semmle.label | call to init(source:injectionTime:forMainFrameOnly:in:) : |
| webview.swift:137:34:137:41 | call to source() : | semmle.label | call to source() : |
| webview.swift:138:10:138:10 | c | semmle.label | c |
| webview.swift:139:10:139:12 | .source | semmle.label | .source |
subpaths
| data.swift:89:41:89:48 | call to source() : | data.swift:25:2:25:66 | [summary param] 0 in init(base64Encoded:options:) : | file://:0:0:0:0 | [summary] to write: return (return) in init(base64Encoded:options:) : | data.swift:89:21:89:71 | call to init(base64Encoded:options:) : |
| data.swift:93:34:93:41 | call to source() : | data.swift:26:2:26:61 | [summary param] 0 in init(buffer:) : | file://:0:0:0:0 | [summary] to write: return (return) in init(buffer:) : | data.swift:93:21:93:73 | call to init(buffer:) : |
@@ -1410,4 +1414,6 @@ subpaths
| webview.swift:119:10:119:10 | v2 | webview.swift:81:13:81:20 | call to source() : | webview.swift:119:10:119:10 | v2 | result |
| webview.swift:123:10:123:10 | v3 | webview.swift:81:13:81:20 | call to source() : | webview.swift:123:10:123:10 | v3 | result |
| webview.swift:133:10:133:10 | b | webview.swift:132:34:132:41 | call to source() : | webview.swift:133:10:133:10 | b | result |
| webview.swift:134:10:134:12 | .source | webview.swift:132:34:132:41 | call to source() : | webview.swift:134:10:134:12 | .source | result |
| webview.swift:138:10:138:10 | c | webview.swift:137:34:137:41 | call to source() : | webview.swift:138:10:138:10 | c | result |
| webview.swift:139:10:139:12 | .source | webview.swift:137:34:137:41 | call to source() : | webview.swift:139:10:139:12 | .source | result |

4
swift/ql/test/library-tests/dataflow/taint/webview.swift
View File

@@ -131,10 +131,10 @@ func testWKUserScript() {
let b = WKUserScript(source: source() as! String, injectionTime: atStart, forMainFrameOnly: false)
sink(b) // $ tainted=132
sink(b.source) // $ MISSING: tainted=132
sink(b.source) // $ tainted=132
let world = WKContentWorld()
let c = WKUserScript(source: source() as! String, injectionTime: atStart, forMainFrameOnly: false, in: world)
sink(c) // $ tainted=137
sink(c.source) // $ MISSING: tainted=137
sink(c.source) // $ tainted=137
}