hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 21:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Add sinks for algorithms that are OK for sensitive data hashing but not for password hashing.

Browse Source
This commit is contained in:
Geoffrey White
2023-12-12 17:37:52 +00:00
parent c2d49c0fff
commit 7ba18e64a0
4 changed files with 125 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
swift/ql/lib/codeql/swift/security/WeakPasswordHashingExtensions.qll
View File

@@ -43,11 +43,62 @@ class WeakPasswordHashingAdditionalFlowStep extends Unit {
* hashing as well.
*/
private class InheritedWeakPasswordHashingSink extends WeakPasswordHashingSink {
InheritedWeakPasswordHashingSink() {
this instanceof WeakSensitiveDataHashingSink
}
InheritedWeakPasswordHashingSink() { this instanceof WeakSensitiveDataHashingSink }
override string getAlgorithm() { result = this.(WeakSensitiveDataHashingSink).getAlgorithm() }
override string getAlgorithm() { result = this.(WeakSensitiveDataHashingSink).getAlgorithm() }
}
private class WeakSensitiveDataHashingSinks extends SinkModelCsv {
override predicate row(string row) {
row =
[
// CryptoKit
// (SHA-256, SHA-384 and SHA-512 are all variants of the SHA-2 algorithm)
";SHA256;true;hash(data:);;;Argument[0];weak-password-hash-input-SHA256",
";SHA256;true;update(data:);;;Argument[0];weak-password-hash-input-SHA256",
";SHA256;true;update(bufferPointer:);;;Argument[0];weak-password-hash-input-SHA256",
";SHA384;true;hash(data:);;;Argument[0];weak-password-hash-input-SHA384",
";SHA384;true;update(data:);;;Argument[0];weak-password-hash-input-SHA384",
";SHA384;true;update(bufferPointer:);;;Argument[0];weak-password-hash-input-SHA384",
";SHA512;true;hash(data:);;;Argument[0];weak-password-hash-input-SHA512",
";SHA512;true;update(data:);;;Argument[0];weak-password-hash-input-SHA512",
";SHA512;true;update(bufferPointer:);;;Argument[0];weak-password-hash-input-SHA512",
// CryptoSwift
";SHA2;true;calculate(for:);;;Argument[0];weak-password-hash-input-SHA2",
";SHA2;true;callAsFunction(_:);;;Argument[0];weak-password-hash-input-SHA2",
";SHA2;true;process64(block:currentHash:);;;Argument[0];weak-password-hash-input-SHA2",
";SHA2;true;process32(block:currentHash:);;;Argument[0];weak-password-hash-input-SHA2",
";SHA2;true;update(withBytes:isLast:);;;Argument[0];weak-password-hash-input-SHA2",
";SHA3;true;calculate(for:);;;Argument[0];weak-password-hash-input-SHA2",
";SHA3;true;callAsFunction(_:);;;Argument[0];weak-password-hash-input-SHA2",
";SHA3;true;process(block:currentHash:);;;Argument[0];weak-password-hash-input-SHA2",
";SHA3;true;update(withBytes:isLast:);;;Argument[0];weak-password-hash-input-SHA2",
";Digest;true;sha2(_:variant:);;;Argument[0];weak-password-hash-input-SHA2",
";Digest;true;sha3(_:variant:);;;Argument[0];weak-password-hash-input-SHA3",
";Digest;true;sha224(_:);;;Argument[0];weak-password-hash-input-SHA224",
";Digest;true;sha256(_:);;;Argument[0];weak-password-hash-input-SHA256",
";Digest;true;sha384(_:);;;Argument[0];weak-password-hash-input-SHA384",
";Digest;true;sha512(_:);;;Argument[0];weak-password-hash-input-SHA512",
";Array;true;sha2(_:);;;Argument[-1];weak-password-hash-input-SHA2",
";Array;true;sha3(_:);;;Argument[-1];weak-password-hash-input-SHA3",
";Array;true;sha224();;;Argument[-1];weak-password-hash-input-SHA224",
";Array;true;sha256();;;Argument[-1];weak-password-hash-input-SHA256",
";Array;true;sha384();;;Argument[-1];weak-password-hash-input-SHA384",
";Array;true;sha512();;;Argument[-1];weak-password-hash-input-SHA512",
";Data;true;sha2(_:);;;Argument[-1];weak-password-hash-input-SHA2",
";Data;true;sha3(_:);;;Argument[-1];weak-password-hash-input-SHA3",
";Data;true;sha224();;;Argument[-1];weak-password-hash-input-SHA224",
";Data;true;sha256();;;Argument[-1];weak-password-hash-input-SHA256",
";Data;true;sha384();;;Argument[-1];weak-password-hash-input-SHA384",
";Data;true;sha512();;;Argument[-1];weak-password-hash-input-SHA512",
";String;true;sha2(_:);;;Argument[-1];weak-password-hash-input-SHA2",
";String;true;sha3(_:);;;Argument[-1];weak-password-hash-input-SHA3",
";String;true;sha224();;;Argument[-1];weak-password-hash-input-SHA224",
";String;true;sha256();;;Argument[-1];weak-password-hash-input-SHA256",
";String;true;sha384();;;Argument[-1];weak-password-hash-input-SHA384",
";String;true;sha512();;;Argument[-1];weak-password-hash-input-SHA512",
]
}
}
/**
@@ -56,9 +107,7 @@ private class InheritedWeakPasswordHashingSink extends WeakPasswordHashingSink {
private class DefaultWeakPasswordHashingSink extends WeakPasswordHashingSink {
string algorithm;
DefaultWeakPasswordHashingSink() {
sinkNode(this, "weak-password-hash-input-" + algorithm)
}
DefaultWeakPasswordHashingSink() { sinkNode(this, "weak-password-hash-input-" + algorithm) }
override string getAlgorithm() { result = algorithm }
}