hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Model NSUserScriptTask sinks.

Browse Source
This commit is contained in:
Geoffrey White
2023-08-04 14:26:00 +01:00
parent 71771890a5
commit 416b731870
3 changed files with 46 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
swift/ql/lib/codeql/swift/security/CommandInjectionExtensions.qll
View File

@@ -64,6 +64,8 @@ private class CommandInjectionSinks extends SinkModelCsv {
";Process;true;standardOutput;;;PostUpdate;command-injection",
";Process;true;currentDirectoryPath;;;PostUpdate;command-injection",
";Process;true;launchPath;;;PostUpdate;command-injection",
";NSUserScriptTask;true;init(url:);;;Argument[0];command-injection",
";NSUserUnixTask;true;execute(withArguments:completionHandler:);;;Argument[0];command-injection",
]
}
}

40
swift/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
View File

@@ -63,6 +63,23 @@ edges
| CommandInjection.swift:146:23:146:55 | call to URL.init(string:) [some:0] | CommandInjection.swift:146:23:146:56 | ...! |
| CommandInjection.swift:146:35:146:35 | userControlledString | CommandInjection.swift:146:23:146:55 | call to URL.init(string:) [some:0] |
| CommandInjection.swift:147:70:147:70 | userControlledString | CommandInjection.swift:147:62:147:90 | [...] |
| CommandInjection.swift:147:70:147:70 | userControlledString | CommandInjection.swift:152:53:152:53 | userControlledString |
| CommandInjection.swift:147:70:147:70 | userControlledString | CommandInjection.swift:155:52:155:52 | userControlledString |
| CommandInjection.swift:147:70:147:70 | userControlledString | CommandInjection.swift:156:33:156:33 | userControlledString |
| CommandInjection.swift:152:41:152:73 | call to URL.init(string:) [some:0] | CommandInjection.swift:152:41:152:74 | ...! |
| CommandInjection.swift:152:53:152:53 | userControlledString | CommandInjection.swift:152:41:152:73 | call to URL.init(string:) [some:0] |
| CommandInjection.swift:155:40:155:72 | call to URL.init(string:) [some:0] | CommandInjection.swift:155:40:155:73 | ...! |
| CommandInjection.swift:155:40:155:72 | call to URL.init(string:) [some:0] | CommandInjection.swift:155:40:155:73 | ...! |
| CommandInjection.swift:155:40:155:73 | ...! | file://:0:0:0:0 | url |
| CommandInjection.swift:155:52:155:52 | userControlledString | CommandInjection.swift:155:40:155:72 | call to URL.init(string:) [some:0] |
| CommandInjection.swift:156:33:156:33 | userControlledString | CommandInjection.swift:156:32:156:53 | [...] |
| CommandInjection.swift:156:33:156:33 | userControlledString | CommandInjection.swift:158:57:158:57 | userControlledString |
| CommandInjection.swift:158:45:158:77 | call to URL.init(string:) [some:0] | CommandInjection.swift:158:45:158:78 | ...! |
| CommandInjection.swift:158:45:158:77 | call to URL.init(string:) [some:0] | CommandInjection.swift:158:45:158:78 | ...! |
| CommandInjection.swift:158:45:158:78 | ...! | file://:0:0:0:0 | url |
| CommandInjection.swift:158:57:158:57 | userControlledString | CommandInjection.swift:158:45:158:77 | call to URL.init(string:) [some:0] |
| file://:0:0:0:0 | url | file://:0:0:0:0 | url |
| file://:0:0:0:0 | url | file://:0:0:0:0 | url |
nodes
| CommandInjection.swift:58:22:58:33 | command | semmle.label | command |
| CommandInjection.swift:58:22:58:33 | command [some:0] | semmle.label | command [some:0] |
@@ -129,6 +146,23 @@ nodes
| CommandInjection.swift:146:35:146:35 | userControlledString | semmle.label | userControlledString |
| CommandInjection.swift:147:62:147:90 | [...] | semmle.label | [...] |
| CommandInjection.swift:147:70:147:70 | userControlledString | semmle.label | userControlledString |
| CommandInjection.swift:152:41:152:73 | call to URL.init(string:) [some:0] | semmle.label | call to URL.init(string:) [some:0] |
| CommandInjection.swift:152:41:152:74 | ...! | semmle.label | ...! |
| CommandInjection.swift:152:53:152:53 | userControlledString | semmle.label | userControlledString |
| CommandInjection.swift:155:40:155:72 | call to URL.init(string:) [some:0] | semmle.label | call to URL.init(string:) [some:0] |
| CommandInjection.swift:155:40:155:73 | ...! | semmle.label | ...! |
| CommandInjection.swift:155:40:155:73 | ...! | semmle.label | ...! |
| CommandInjection.swift:155:52:155:52 | userControlledString | semmle.label | userControlledString |
| CommandInjection.swift:156:32:156:53 | [...] | semmle.label | [...] |
| CommandInjection.swift:156:33:156:33 | userControlledString | semmle.label | userControlledString |
| CommandInjection.swift:158:45:158:77 | call to URL.init(string:) [some:0] | semmle.label | call to URL.init(string:) [some:0] |
| CommandInjection.swift:158:45:158:78 | ...! | semmle.label | ...! |
| CommandInjection.swift:158:45:158:78 | ...! | semmle.label | ...! |
| CommandInjection.swift:158:57:158:57 | userControlledString | semmle.label | userControlledString |
| file://:0:0:0:0 | url | semmle.label | url |
| file://:0:0:0:0 | url | semmle.label | url |
| file://:0:0:0:0 | url | semmle.label | url |
| file://:0:0:0:0 | url | semmle.label | url |
subpaths
| CommandInjection.swift:78:43:78:43 | userControlledString | CommandInjection.swift:58:22:58:33 | command | CommandInjection.swift:62:16:62:16 | command [some:0] | CommandInjection.swift:78:27:78:63 | call to validateCommand(_:) [some:0] |
| CommandInjection.swift:78:43:78:43 | userControlledString [some:0] | CommandInjection.swift:58:22:58:33 | command [some:0] | CommandInjection.swift:62:16:62:16 | command [some:0] | CommandInjection.swift:78:27:78:63 | call to validateCommand(_:) [some:0] |
@@ -145,3 +179,9 @@ subpaths
| CommandInjection.swift:143:67:143:95 | [...] | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | CommandInjection.swift:143:67:143:95 | [...] | This command depends on a $@. | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | user-provided value |
| CommandInjection.swift:146:23:146:56 | ...! | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | CommandInjection.swift:146:23:146:56 | ...! | This command depends on a $@. | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | user-provided value |
| CommandInjection.swift:147:62:147:90 | [...] | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | CommandInjection.swift:147:62:147:90 | [...] | This command depends on a $@. | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | user-provided value |
| CommandInjection.swift:152:41:152:74 | ...! | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | CommandInjection.swift:152:41:152:74 | ...! | This command depends on a $@. | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | user-provided value |
| CommandInjection.swift:155:40:155:73 | ...! | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | CommandInjection.swift:155:40:155:73 | ...! | This command depends on a $@. | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | user-provided value |
| CommandInjection.swift:156:32:156:53 | [...] | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | CommandInjection.swift:156:32:156:53 | [...] | This command depends on a $@. | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | user-provided value |
| CommandInjection.swift:158:45:158:78 | ...! | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | CommandInjection.swift:158:45:158:78 | ...! | This command depends on a $@. | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | user-provided value |
| file://:0:0:0:0 | url | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | file://:0:0:0:0 | url | This command depends on a $@. | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | user-provided value |
| file://:0:0:0:0 | url | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | file://:0:0:0:0 | url | This command depends on a $@. | CommandInjection.swift:99:40:99:94 | call to String.init(contentsOf:) | user-provided value |

8
swift/ql/test/query-tests/Security/CWE-078/CommandInjection.swift
View File

@@ -149,13 +149,13 @@ func testCommandInjectionMore(mySafeString: String) {
let task8 = try! NSUserScriptTask(url: URL(string: mySafeString)!) // GOOD
task8.execute()
let task9 = try! NSUserScriptTask(url: URL(string: userControlledString)!) // BAD [NOT DETECTED]
let task9 = try! NSUserScriptTask(url: URL(string: userControlledString)!) // BAD
task9.execute()
let task10 = try! NSUserUnixTask(url: URL(string: userControlledString)!) // BAD [NOT DETECTED]
task10.execute(withArguments: [userControlledString]) // BAD [NOT DETECTED]
let task10 = try! NSUserUnixTask(url: URL(string: userControlledString)!) // BAD
task10.execute(withArguments: [userControlledString]) // BAD
let task11 = try! NSUserAutomatorTask(url: URL(string: userControlledString)!) // BAD [NOT DETECTED]
let task11 = try! NSUserAutomatorTask(url: URL(string: userControlledString)!) // BAD
task11.variables = ["abc": userControlledString] // BAD [NOT DETECTED]
task11.execute(withInput: nil)
}