hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Rewrite UnsafeWebViewFetch to use DataFlow::ConfigSig

Browse Source
This commit is contained in:
Jeroen Ketema
2023-04-03 16:23:05 +02:00
parent 56156cfa36
commit 5deafeaf9e
2 changed files with 31 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
swift/ql/lib/codeql/swift/security/UnsafeWebViewFetchQuery.qll
View File

@@ -13,7 +13,7 @@ import codeql.swift.security.UnsafeWebViewFetchExtensions
* A taint configuration from taint sources to sinks (and `baseURL` arguments)
* for this query.
*/
class UnsafeWebViewFetchConfig extends TaintTracking::Configuration {
deprecated class UnsafeWebViewFetchConfig extends TaintTracking::Configuration {
UnsafeWebViewFetchConfig() { this = "UnsafeWebViewFetchConfig" }
override predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
@@ -33,3 +33,29 @@ class UnsafeWebViewFetchConfig extends TaintTracking::Configuration {
any(UnsafeWebViewFetchAdditionalTaintStep s).step(nodeFrom, nodeTo)
}
}
/**
* A taint configuration from taint sources to sinks (and `baseURL` arguments)
* for this query.
*/
module UnsafeWebViewFetchConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
predicate isSink(DataFlow::Node node) {
exists(UnsafeWebViewFetchSink sink |
node = sink or
node.asExpr() = sink.getBaseUrl()
)
}
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof UnsafeWebViewFetchSanitizer }
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
any(UnsafeWebViewFetchAdditionalTaintStep s).step(nodeFrom, nodeTo)
}
}
/**
* Detect taint flow of taint sources to sinks (and `baseURL` arguments) for this query.
*/
module UnsafeWebViewFetchFlow = TaintTracking::Global<UnsafeWebViewFetchConfig>;

8
swift/ql/src/queries/Security/CWE-079/UnsafeWebViewFetch.ql
View File

@@ -15,13 +15,13 @@
import swift
import codeql.swift.dataflow.DataFlow
import codeql.swift.security.UnsafeWebViewFetchQuery
import DataFlow::PathGraph
import UnsafeWebViewFetchFlow::PathGraph
from
UnsafeWebViewFetchConfig config, DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode,
UnsafeWebViewFetchFlow::PathNode sourceNode, UnsafeWebViewFetchFlow::PathNode sinkNode,
UnsafeWebViewFetchSink sink, string message
where
config.hasFlowPath(sourceNode, sinkNode) and
UnsafeWebViewFetchFlow::flowPath(sourceNode, sinkNode) and
sink = sinkNode.getNode() and
(
// no base URL
@@ -33,7 +33,7 @@ where
message = "Tainted data is used in a WebView fetch without restricting the base URL."
or
// base URL is also tainted
config.hasFlowToExpr(sink.getBaseUrl()) and
UnsafeWebViewFetchFlow::flowToExpr(sink.getBaseUrl()) and
message = "Tainted data is used in a WebView fetch with a tainted base URL."
)
select sink, sourceNode, sinkNode, message