hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 00:35:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Add RNCryptor hmacKey encryption-key sinks.

Browse Source
This commit is contained in:
Geoffrey White
2023-04-14 10:47:15 +01:00
parent 46da73cc11
commit 619d572d50
3 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
swift/ql/lib/codeql/swift/security/HardcodedEncryptionKeyExtensions.qll
View File

@@ -57,7 +57,8 @@ private class RnCryptorEncryptionKeySink extends HardcodedEncryptionKeySink {
] and
c.getAMember() = f and
call.getStaticTarget() = f and
call.getArgumentWithLabel(["encryptionKey", "withEncryptionKey"]).getExpr() = this.asExpr()
call.getArgumentWithLabel(["encryptionKey", "withEncryptionKey", "hmacKey"]).getExpr() =
this.asExpr()
)
}
}

3
swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected
View File

@@ -38,6 +38,7 @@ edges
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:79:66:79:66 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:80:94:80:94 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:81:102:81:102 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:83:92:83:92 | myConstKey |
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
nodes
@@ -86,6 +87,7 @@ nodes
| rncryptor.swift:79:66:79:66 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:80:94:80:94 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:81:102:81:102 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:83:92:83:92 | myConstKey | semmle.label | myConstKey |
subpaths
| misc.swift:38:24:38:24 | abcdef123456 : | misc.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | misc.swift:38:19:38:38 | call to Data.init(_:) : |
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
@@ -124,3 +126,4 @@ subpaths
| rncryptor.swift:79:66:79:66 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:79:66:79:66 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:80:94:80:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:80:94:80:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:81:102:81:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:81:102:81:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:83:92:83:92 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:83:92:83:92 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |

2
swift/ql/test/query-tests/Security/CWE-321/rncryptor.swift
View File

@@ -80,5 +80,5 @@ func test(var myVarKey: Data, var myHMACKey: Data) {
let _ = try? myDecryptor.decryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD
let _ = try? myDecryptor.decryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myVarKey, hmacKey: myConstKey, handler: myHandler) // BAD [NOT DETECTED]
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myVarKey, hmacKey: myConstKey, handler: myHandler) // BAD
}