hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Model Connection.Location.uri sink.

Browse Source
This commit is contained in:
Geoffrey White
2023-07-11 17:14:25 +01:00
parent ebb379f08c
commit 5f8f1b64c6
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
swift/ql/lib/codeql/swift/security/PathInjectionExtensions.qll
View File

@@ -47,6 +47,23 @@ private class GlobalVariablePathInjectionSink extends PathInjectionSink {
}
}
/**
* A sink that is a write to a global variable.
*/
private class EnumConstructorPathInjectionSink extends PathInjectionSink {
EnumConstructorPathInjectionSink() {
// first argument to `Connection.Location.uri(_:parameters:)`
exists(ApplyExpr ae, EnumElementDecl decl, NominalTypeDecl parent |
ae.getFunction().(MethodLookupExpr).getMember() = decl and
decl.getName() = "uri" and
decl.getDeclaringDecl() = parent and
parent.getName() = "Location" and
parent.getDeclaringDecl().(NominalTypeDecl).(NominalTypeDecl).getName() = "Connection" and
this.asExpr() = ae.getArgument(0).getExpr()
)
}
}
private class DefaultPathInjectionBarrier extends PathInjectionBarrier {
DefaultPathInjectionBarrier() {
// This is a simplified implementation.
@@ -154,7 +171,6 @@ private class PathInjectionSinks extends SinkModelCsv {
";;false;sqlite3_filename_wal(_:);;;Argument[0];path-injection",
";;false;sqlite3_free_filename(_:);;;Argument[0];path-injection",
// SQLite.swift
";Connection.Location.uri;true;init(_:parameters:);;;Argument[0];path-injection",
";Connection;true;init(_:readonly:);;;Argument[0];path-injection",
]
}

2
swift/ql/test/query-tests/Security/CWE-022/testPathInjection.swift
View File

@@ -388,7 +388,7 @@ func test(buffer1: UnsafeMutablePointer<UInt8>, buffer2: UnsafeMutablePointer<UI
try! _ = Connection()
try! _ = Connection(Connection.Location.uri("myFile.sqlite3")) // GOOD
try! _ = Connection(Connection.Location.uri(remoteString)) // $ MISSING: hasPathInjection=253
try! _ = Connection(Connection.Location.uri(remoteString)) // $ hasPathInjection=253
try! _ = Connection("myFile.sqlite3") // GOOD
try! _ = Connection(remoteString) // $ hasPathInjection=253
}