hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Rewrite PredicateInjection to use DataFlow::ConfigSig

Browse Source
This commit is contained in:
Jeroen Ketema
2023-04-03 16:19:30 +02:00
parent 4d3fc02d7e
commit 70d0e987c4
3 changed files with 28 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
swift/ql/lib/codeql/swift/security/PredicateInjectionQuery.qll
View File

@@ -12,7 +12,7 @@ private import codeql.swift.security.PredicateInjectionExtensions
/**
* A taint-tracking configuration for predicate injection vulnerabilities.
*/
class PredicateInjectionConf extends TaintTracking::Configuration {
deprecated class PredicateInjectionConf extends TaintTracking::Configuration {
PredicateInjectionConf() { this = "PredicateInjectionConf" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -27,3 +27,25 @@ class PredicateInjectionConf extends TaintTracking::Configuration {
any(PredicateInjectionAdditionalTaintStep s).step(n1, n2)
}
}
/**
* A taint-tracking configuration for predicate injection vulnerabilities.
*/
module PredicateInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof PredicateInjectionSink }
predicate isBarrier(DataFlow::Node sanitizer) {
sanitizer instanceof PredicateInjectionSanitizer
}
predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
any(PredicateInjectionAdditionalTaintStep s).step(n1, n2)
}
}
/**
* Detect taint flow of predicate injection vulnerabilities.
*/
module PredicateInjectionFlow = TaintTracking::Global<PredicateInjectionConfig>;

6
swift/ql/src/queries/Security/CWE-943/PredicateInjection.ql
View File

@@ -14,9 +14,9 @@
import swift
import codeql.swift.dataflow.DataFlow
import codeql.swift.security.PredicateInjectionQuery
import DataFlow::PathGraph
import PredicateInjectionFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink
where any(PredicateInjectionConf c).hasFlowPath(source, sink)
from PredicateInjectionFlow::PathNode source, PredicateInjectionFlow::PathNode sink
where PredicateInjectionFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "This predicate depends on a $@.", source.getNode(),
"user-provided value"

6
swift/ql/test/query-tests/Security/CWE-946/PredicateInjectionTest.ql
View File

@@ -9,10 +9,8 @@ class PredicateInjectionTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "hasPredicateInjection" }
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(
PredicateInjectionConf config, DataFlow::Node source, DataFlow::Node sink, Expr sinkExpr
|
config.hasFlow(source, sink) and
exists(DataFlow::Node source, DataFlow::Node sink, Expr sinkExpr |
PredicateInjectionFlow::flow(source, sink) and
sinkExpr = sink.asExpr() and
location = sinkExpr.getLocation() and
element = sinkExpr.toString() and