hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12560 from geoffw0/testcustominterp

Browse Source 
Swift: Add taint test for custom string interpolation.
This commit is contained in:
Geoffrey White
2023-03-16 17:44:37 +00:00
committed by GitHub
parent a9e5b34ad6 3a04e42ae0
commit 880f948763
3 changed files with 306 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

201
swift/ql/test/library-tests/dataflow/taint/core/LocalTaint.expected
View File

@@ -122,6 +122,207 @@
| simple.swift:85:13:85:20 | call to source() | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... |
| simple.swift:85:26:85:26 | 1 | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... |
| simple.swift:87:14:87:21 | call to source() | simple.swift:87:13:87:21 | call to ~(_:) |
| stringinterpolation.swift:5:7:5:7 | SSA def(self) | stringinterpolation.swift:5:7:5:7 | self[return] |
| stringinterpolation.swift:5:7:5:7 | SSA def(self) | stringinterpolation.swift:5:7:5:7 | self[return] |
| stringinterpolation.swift:5:7:5:7 | self | stringinterpolation.swift:5:7:5:7 | SSA def(self) |
| stringinterpolation.swift:5:7:5:7 | self | stringinterpolation.swift:5:7:5:7 | SSA def(self) |
| stringinterpolation.swift:6:6:6:6 | self | stringinterpolation.swift:6:6:6:6 | SSA def(self) |
| stringinterpolation.swift:6:6:6:6 | self | stringinterpolation.swift:6:6:6:6 | SSA def(self) |
| stringinterpolation.swift:6:6:6:6 | self | stringinterpolation.swift:6:6:6:6 | SSA def(self) |
| stringinterpolation.swift:6:6:6:6 | value | stringinterpolation.swift:6:6:6:6 | SSA def(value) |
| stringinterpolation.swift:7:6:7:6 | self | stringinterpolation.swift:7:6:7:6 | SSA def(self) |
| stringinterpolation.swift:7:6:7:6 | self | stringinterpolation.swift:7:6:7:6 | SSA def(self) |
| stringinterpolation.swift:7:6:7:6 | self | stringinterpolation.swift:7:6:7:6 | SSA def(self) |
| stringinterpolation.swift:7:6:7:6 | value | stringinterpolation.swift:7:6:7:6 | SSA def(value) |
| stringinterpolation.swift:11:16:11:16 | SSA def(self) | stringinterpolation.swift:13:3:13:3 | self |
| stringinterpolation.swift:11:16:11:16 | self | stringinterpolation.swift:11:16:11:16 | SSA def(self) |
| stringinterpolation.swift:11:36:11:44 | SSA def(pair) | stringinterpolation.swift:13:36:13:36 | pair |
| stringinterpolation.swift:11:36:11:44 | pair | stringinterpolation.swift:11:36:11:44 | SSA def(pair) |
| stringinterpolation.swift:13:3:13:3 | &... | stringinterpolation.swift:11:11:14:2 | self[return] |
| stringinterpolation.swift:13:3:13:3 | &... | stringinterpolation.swift:13:3:13:3 | [post] &... |
| stringinterpolation.swift:13:3:13:3 | &... | stringinterpolation.swift:13:23:13:23 | [post] "..." |
| stringinterpolation.swift:13:3:13:3 | [post] &... | stringinterpolation.swift:11:11:14:2 | self[return] |
| stringinterpolation.swift:13:3:13:3 | self | stringinterpolation.swift:13:3:13:3 | &... |
| stringinterpolation.swift:13:23:13:23 | "..." | stringinterpolation.swift:13:3:13:3 | [post] &... |
| stringinterpolation.swift:13:23:13:23 | "..." | stringinterpolation.swift:13:23:13:23 | [post] "..." |
| stringinterpolation.swift:13:23:13:23 | SSA def($interpolation) | stringinterpolation.swift:13:24:13:24 | SSA phi($interpolation) |
| stringinterpolation.swift:13:23:13:23 | TapExpr | stringinterpolation.swift:13:23:13:23 | "..." |
| stringinterpolation.swift:13:23:13:23 | first is: | stringinterpolation.swift:13:23:13:23 | [post] first is: |
| stringinterpolation.swift:13:23:13:23 | first is: | stringinterpolation.swift:13:24:13:24 | [post] &... |
| stringinterpolation.swift:13:24:13:24 | $interpolation | stringinterpolation.swift:13:24:13:24 | &... |
| stringinterpolation.swift:13:24:13:24 | &... | stringinterpolation.swift:13:23:13:23 | [post] first is: |
| stringinterpolation.swift:13:24:13:24 | &... | stringinterpolation.swift:13:24:13:24 | [post] &... |
| stringinterpolation.swift:13:24:13:24 | &... | stringinterpolation.swift:13:35:13:35 | $interpolation |
| stringinterpolation.swift:13:24:13:24 | SSA phi($interpolation) | stringinterpolation.swift:13:24:13:24 | $interpolation |
| stringinterpolation.swift:13:24:13:24 | [post] &... | stringinterpolation.swift:13:35:13:35 | $interpolation |
| stringinterpolation.swift:13:35:13:35 | $interpolation | stringinterpolation.swift:13:35:13:35 | &... |
| stringinterpolation.swift:13:35:13:35 | &... | stringinterpolation.swift:13:35:13:35 | [post] &... |
| stringinterpolation.swift:13:35:13:35 | &... | stringinterpolation.swift:13:47:13:47 | $interpolation |
| stringinterpolation.swift:13:35:13:35 | [post] &... | stringinterpolation.swift:13:47:13:47 | $interpolation |
| stringinterpolation.swift:13:36:13:41 | .first | stringinterpolation.swift:13:35:13:35 | [post] &... |
| stringinterpolation.swift:13:47:13:47 | | stringinterpolation.swift:13:47:13:47 | [post] |
| stringinterpolation.swift:13:47:13:47 | | stringinterpolation.swift:13:47:13:47 | [post] &... |
| stringinterpolation.swift:13:47:13:47 | $interpolation | stringinterpolation.swift:13:47:13:47 | &... |
| stringinterpolation.swift:13:47:13:47 | &... | stringinterpolation.swift:13:23:13:23 | TapExpr |
| stringinterpolation.swift:13:47:13:47 | &... | stringinterpolation.swift:13:47:13:47 | [post] |
| stringinterpolation.swift:13:47:13:47 | &... | stringinterpolation.swift:13:47:13:47 | [post] &... |
| stringinterpolation.swift:13:47:13:47 | [post] &... | stringinterpolation.swift:13:23:13:23 | TapExpr |
| stringinterpolation.swift:18:6:18:6 | SSA def(p1) | stringinterpolation.swift:19:2:19:2 | p1 |
| stringinterpolation.swift:18:11:18:24 | call to MyStringPair.init() | stringinterpolation.swift:18:6:18:6 | SSA def(p1) |
| stringinterpolation.swift:19:2:19:2 | [post] p1 | stringinterpolation.swift:20:2:20:2 | p1 |
| stringinterpolation.swift:19:2:19:2 | p1 | stringinterpolation.swift:20:2:20:2 | p1 |
| stringinterpolation.swift:20:2:20:2 | [post] p1 | stringinterpolation.swift:22:21:22:21 | p1 |
| stringinterpolation.swift:20:2:20:2 | p1 | stringinterpolation.swift:22:21:22:21 | p1 |
| stringinterpolation.swift:22:12:22:12 | SSA def($interpolation) | stringinterpolation.swift:22:13:22:13 | SSA phi($interpolation) |
| stringinterpolation.swift:22:12:22:12 | TapExpr | stringinterpolation.swift:22:12:22:12 | "..." |
| stringinterpolation.swift:22:12:22:12 | pair: | stringinterpolation.swift:22:12:22:12 | [post] pair: |
| stringinterpolation.swift:22:12:22:12 | pair: | stringinterpolation.swift:22:13:22:13 | [post] &... |
| stringinterpolation.swift:22:13:22:13 | $interpolation | stringinterpolation.swift:22:13:22:13 | &... |
| stringinterpolation.swift:22:13:22:13 | &... | stringinterpolation.swift:22:12:22:12 | [post] pair: |
| stringinterpolation.swift:22:13:22:13 | &... | stringinterpolation.swift:22:13:22:13 | [post] &... |
| stringinterpolation.swift:22:13:22:13 | &... | stringinterpolation.swift:22:20:22:20 | $interpolation |
| stringinterpolation.swift:22:13:22:13 | SSA phi($interpolation) | stringinterpolation.swift:22:13:22:13 | $interpolation |
| stringinterpolation.swift:22:13:22:13 | [post] &... | stringinterpolation.swift:22:20:22:20 | $interpolation |
| stringinterpolation.swift:22:20:22:20 | $interpolation | stringinterpolation.swift:22:20:22:20 | &... |
| stringinterpolation.swift:22:20:22:20 | &... | stringinterpolation.swift:22:20:22:20 | [post] &... |
| stringinterpolation.swift:22:20:22:20 | &... | stringinterpolation.swift:22:30:22:30 | $interpolation |
| stringinterpolation.swift:22:20:22:20 | [post] &... | stringinterpolation.swift:22:30:22:30 | $interpolation |
| stringinterpolation.swift:22:21:22:21 | [post] p1 | stringinterpolation.swift:23:21:23:21 | p1 |
| stringinterpolation.swift:22:21:22:21 | p1 | stringinterpolation.swift:23:21:23:21 | p1 |
| stringinterpolation.swift:22:21:22:24 | .first | stringinterpolation.swift:22:20:22:20 | [post] &... |
| stringinterpolation.swift:22:30:22:30 | | stringinterpolation.swift:22:30:22:30 | [post] |
| stringinterpolation.swift:22:30:22:30 | | stringinterpolation.swift:22:30:22:30 | [post] &... |
| stringinterpolation.swift:22:30:22:30 | $interpolation | stringinterpolation.swift:22:30:22:30 | &... |
| stringinterpolation.swift:22:30:22:30 | &... | stringinterpolation.swift:22:12:22:12 | TapExpr |
| stringinterpolation.swift:22:30:22:30 | &... | stringinterpolation.swift:22:30:22:30 | [post] |
| stringinterpolation.swift:22:30:22:30 | &... | stringinterpolation.swift:22:30:22:30 | [post] &... |
| stringinterpolation.swift:22:30:22:30 | [post] &... | stringinterpolation.swift:22:12:22:12 | TapExpr |
| stringinterpolation.swift:23:12:23:12 | SSA def($interpolation) | stringinterpolation.swift:23:13:23:13 | SSA phi($interpolation) |
| stringinterpolation.swift:23:12:23:12 | TapExpr | stringinterpolation.swift:23:12:23:12 | "..." |
| stringinterpolation.swift:23:12:23:12 | pair: | stringinterpolation.swift:23:12:23:12 | [post] pair: |
| stringinterpolation.swift:23:12:23:12 | pair: | stringinterpolation.swift:23:13:23:13 | [post] &... |
| stringinterpolation.swift:23:13:23:13 | $interpolation | stringinterpolation.swift:23:13:23:13 | &... |
| stringinterpolation.swift:23:13:23:13 | &... | stringinterpolation.swift:23:12:23:12 | [post] pair: |
| stringinterpolation.swift:23:13:23:13 | &... | stringinterpolation.swift:23:13:23:13 | [post] &... |
| stringinterpolation.swift:23:13:23:13 | &... | stringinterpolation.swift:23:20:23:20 | $interpolation |
| stringinterpolation.swift:23:13:23:13 | SSA phi($interpolation) | stringinterpolation.swift:23:13:23:13 | $interpolation |
| stringinterpolation.swift:23:13:23:13 | [post] &... | stringinterpolation.swift:23:20:23:20 | $interpolation |
| stringinterpolation.swift:23:20:23:20 | $interpolation | stringinterpolation.swift:23:20:23:20 | &... |
| stringinterpolation.swift:23:20:23:20 | &... | stringinterpolation.swift:23:20:23:20 | [post] &... |
| stringinterpolation.swift:23:20:23:20 | &... | stringinterpolation.swift:23:31:23:31 | $interpolation |
| stringinterpolation.swift:23:20:23:20 | [post] &... | stringinterpolation.swift:23:31:23:31 | $interpolation |
| stringinterpolation.swift:23:21:23:21 | [post] p1 | stringinterpolation.swift:24:21:24:21 | p1 |
| stringinterpolation.swift:23:21:23:21 | p1 | stringinterpolation.swift:24:21:24:21 | p1 |
| stringinterpolation.swift:23:21:23:24 | .second | stringinterpolation.swift:23:20:23:20 | [post] &... |
| stringinterpolation.swift:23:31:23:31 | | stringinterpolation.swift:23:31:23:31 | [post] |
| stringinterpolation.swift:23:31:23:31 | | stringinterpolation.swift:23:31:23:31 | [post] &... |
| stringinterpolation.swift:23:31:23:31 | $interpolation | stringinterpolation.swift:23:31:23:31 | &... |
| stringinterpolation.swift:23:31:23:31 | &... | stringinterpolation.swift:23:12:23:12 | TapExpr |
| stringinterpolation.swift:23:31:23:31 | &... | stringinterpolation.swift:23:31:23:31 | [post] |
| stringinterpolation.swift:23:31:23:31 | &... | stringinterpolation.swift:23:31:23:31 | [post] &... |
| stringinterpolation.swift:23:31:23:31 | [post] &... | stringinterpolation.swift:23:12:23:12 | TapExpr |
| stringinterpolation.swift:24:12:24:12 | SSA def($interpolation) | stringinterpolation.swift:24:13:24:13 | SSA phi($interpolation) |
| stringinterpolation.swift:24:12:24:12 | TapExpr | stringinterpolation.swift:24:12:24:12 | "..." |
| stringinterpolation.swift:24:12:24:12 | pair: | stringinterpolation.swift:24:12:24:12 | [post] pair: |
| stringinterpolation.swift:24:12:24:12 | pair: | stringinterpolation.swift:24:13:24:13 | [post] &... |
| stringinterpolation.swift:24:13:24:13 | $interpolation | stringinterpolation.swift:24:13:24:13 | &... |
| stringinterpolation.swift:24:13:24:13 | &... | stringinterpolation.swift:24:12:24:12 | [post] pair: |
| stringinterpolation.swift:24:13:24:13 | &... | stringinterpolation.swift:24:13:24:13 | [post] &... |
| stringinterpolation.swift:24:13:24:13 | &... | stringinterpolation.swift:24:20:24:20 | $interpolation |
| stringinterpolation.swift:24:13:24:13 | SSA phi($interpolation) | stringinterpolation.swift:24:13:24:13 | $interpolation |
| stringinterpolation.swift:24:13:24:13 | [post] &... | stringinterpolation.swift:24:20:24:20 | $interpolation |
| stringinterpolation.swift:24:20:24:20 | $interpolation | stringinterpolation.swift:24:20:24:20 | &... |
| stringinterpolation.swift:24:20:24:20 | &... | stringinterpolation.swift:24:20:24:20 | [post] &... |
| stringinterpolation.swift:24:20:24:20 | &... | stringinterpolation.swift:24:21:24:21 | [post] p1 |
| stringinterpolation.swift:24:20:24:20 | &... | stringinterpolation.swift:24:24:24:24 | $interpolation |
| stringinterpolation.swift:24:20:24:20 | [post] &... | stringinterpolation.swift:24:24:24:24 | $interpolation |
| stringinterpolation.swift:24:21:24:21 | p1 | stringinterpolation.swift:24:20:24:20 | [post] &... |
| stringinterpolation.swift:24:21:24:21 | p1 | stringinterpolation.swift:24:21:24:21 | [post] p1 |
| stringinterpolation.swift:24:24:24:24 | | stringinterpolation.swift:24:24:24:24 | [post] |
| stringinterpolation.swift:24:24:24:24 | | stringinterpolation.swift:24:24:24:24 | [post] &... |
| stringinterpolation.swift:24:24:24:24 | $interpolation | stringinterpolation.swift:24:24:24:24 | &... |
| stringinterpolation.swift:24:24:24:24 | &... | stringinterpolation.swift:24:12:24:12 | TapExpr |
| stringinterpolation.swift:24:24:24:24 | &... | stringinterpolation.swift:24:24:24:24 | [post] |
| stringinterpolation.swift:24:24:24:24 | &... | stringinterpolation.swift:24:24:24:24 | [post] &... |
| stringinterpolation.swift:24:24:24:24 | [post] &... | stringinterpolation.swift:24:12:24:12 | TapExpr |
| stringinterpolation.swift:26:6:26:6 | SSA def(p2) | stringinterpolation.swift:27:2:27:2 | p2 |
| stringinterpolation.swift:26:11:26:24 | call to MyStringPair.init() | stringinterpolation.swift:26:6:26:6 | SSA def(p2) |
| stringinterpolation.swift:27:2:27:2 | [post] p2 | stringinterpolation.swift:28:2:28:2 | p2 |
| stringinterpolation.swift:27:2:27:2 | p2 | stringinterpolation.swift:28:2:28:2 | p2 |
| stringinterpolation.swift:28:2:28:2 | [post] p2 | stringinterpolation.swift:30:21:30:21 | p2 |
| stringinterpolation.swift:28:2:28:2 | p2 | stringinterpolation.swift:30:21:30:21 | p2 |
| stringinterpolation.swift:30:12:30:12 | SSA def($interpolation) | stringinterpolation.swift:30:13:30:13 | SSA phi($interpolation) |
| stringinterpolation.swift:30:12:30:12 | TapExpr | stringinterpolation.swift:30:12:30:12 | "..." |
| stringinterpolation.swift:30:12:30:12 | pair: | stringinterpolation.swift:30:12:30:12 | [post] pair: |
| stringinterpolation.swift:30:12:30:12 | pair: | stringinterpolation.swift:30:13:30:13 | [post] &... |
| stringinterpolation.swift:30:13:30:13 | $interpolation | stringinterpolation.swift:30:13:30:13 | &... |
| stringinterpolation.swift:30:13:30:13 | &... | stringinterpolation.swift:30:12:30:12 | [post] pair: |
| stringinterpolation.swift:30:13:30:13 | &... | stringinterpolation.swift:30:13:30:13 | [post] &... |
| stringinterpolation.swift:30:13:30:13 | &... | stringinterpolation.swift:30:20:30:20 | $interpolation |
| stringinterpolation.swift:30:13:30:13 | SSA phi($interpolation) | stringinterpolation.swift:30:13:30:13 | $interpolation |
| stringinterpolation.swift:30:13:30:13 | [post] &... | stringinterpolation.swift:30:20:30:20 | $interpolation |
| stringinterpolation.swift:30:20:30:20 | $interpolation | stringinterpolation.swift:30:20:30:20 | &... |
| stringinterpolation.swift:30:20:30:20 | &... | stringinterpolation.swift:30:20:30:20 | [post] &... |
| stringinterpolation.swift:30:20:30:20 | &... | stringinterpolation.swift:30:30:30:30 | $interpolation |
| stringinterpolation.swift:30:20:30:20 | [post] &... | stringinterpolation.swift:30:30:30:30 | $interpolation |
| stringinterpolation.swift:30:21:30:21 | [post] p2 | stringinterpolation.swift:31:21:31:21 | p2 |
| stringinterpolation.swift:30:21:30:21 | p2 | stringinterpolation.swift:31:21:31:21 | p2 |
| stringinterpolation.swift:30:21:30:24 | .first | stringinterpolation.swift:30:20:30:20 | [post] &... |
| stringinterpolation.swift:30:30:30:30 | | stringinterpolation.swift:30:30:30:30 | [post] |
| stringinterpolation.swift:30:30:30:30 | | stringinterpolation.swift:30:30:30:30 | [post] &... |
| stringinterpolation.swift:30:30:30:30 | $interpolation | stringinterpolation.swift:30:30:30:30 | &... |
| stringinterpolation.swift:30:30:30:30 | &... | stringinterpolation.swift:30:12:30:12 | TapExpr |
| stringinterpolation.swift:30:30:30:30 | &... | stringinterpolation.swift:30:30:30:30 | [post] |
| stringinterpolation.swift:30:30:30:30 | &... | stringinterpolation.swift:30:30:30:30 | [post] &... |
| stringinterpolation.swift:30:30:30:30 | [post] &... | stringinterpolation.swift:30:12:30:12 | TapExpr |
| stringinterpolation.swift:31:12:31:12 | SSA def($interpolation) | stringinterpolation.swift:31:13:31:13 | SSA phi($interpolation) |
| stringinterpolation.swift:31:12:31:12 | TapExpr | stringinterpolation.swift:31:12:31:12 | "..." |
| stringinterpolation.swift:31:12:31:12 | pair: | stringinterpolation.swift:31:12:31:12 | [post] pair: |
| stringinterpolation.swift:31:12:31:12 | pair: | stringinterpolation.swift:31:13:31:13 | [post] &... |
| stringinterpolation.swift:31:13:31:13 | $interpolation | stringinterpolation.swift:31:13:31:13 | &... |
| stringinterpolation.swift:31:13:31:13 | &... | stringinterpolation.swift:31:12:31:12 | [post] pair: |
| stringinterpolation.swift:31:13:31:13 | &... | stringinterpolation.swift:31:13:31:13 | [post] &... |
| stringinterpolation.swift:31:13:31:13 | &... | stringinterpolation.swift:31:20:31:20 | $interpolation |
| stringinterpolation.swift:31:13:31:13 | SSA phi($interpolation) | stringinterpolation.swift:31:13:31:13 | $interpolation |
| stringinterpolation.swift:31:13:31:13 | [post] &... | stringinterpolation.swift:31:20:31:20 | $interpolation |
| stringinterpolation.swift:31:20:31:20 | $interpolation | stringinterpolation.swift:31:20:31:20 | &... |
| stringinterpolation.swift:31:20:31:20 | &... | stringinterpolation.swift:31:20:31:20 | [post] &... |
| stringinterpolation.swift:31:20:31:20 | &... | stringinterpolation.swift:31:31:31:31 | $interpolation |
| stringinterpolation.swift:31:20:31:20 | [post] &... | stringinterpolation.swift:31:31:31:31 | $interpolation |
| stringinterpolation.swift:31:21:31:21 | [post] p2 | stringinterpolation.swift:32:21:32:21 | p2 |
| stringinterpolation.swift:31:21:31:21 | p2 | stringinterpolation.swift:32:21:32:21 | p2 |
| stringinterpolation.swift:31:21:31:24 | .second | stringinterpolation.swift:31:20:31:20 | [post] &... |
| stringinterpolation.swift:31:31:31:31 | | stringinterpolation.swift:31:31:31:31 | [post] |
| stringinterpolation.swift:31:31:31:31 | | stringinterpolation.swift:31:31:31:31 | [post] &... |
| stringinterpolation.swift:31:31:31:31 | $interpolation | stringinterpolation.swift:31:31:31:31 | &... |
| stringinterpolation.swift:31:31:31:31 | &... | stringinterpolation.swift:31:12:31:12 | TapExpr |
| stringinterpolation.swift:31:31:31:31 | &... | stringinterpolation.swift:31:31:31:31 | [post] |
| stringinterpolation.swift:31:31:31:31 | &... | stringinterpolation.swift:31:31:31:31 | [post] &... |
| stringinterpolation.swift:31:31:31:31 | [post] &... | stringinterpolation.swift:31:12:31:12 | TapExpr |
| stringinterpolation.swift:32:12:32:12 | SSA def($interpolation) | stringinterpolation.swift:32:13:32:13 | SSA phi($interpolation) |
| stringinterpolation.swift:32:12:32:12 | TapExpr | stringinterpolation.swift:32:12:32:12 | "..." |
| stringinterpolation.swift:32:12:32:12 | pair: | stringinterpolation.swift:32:12:32:12 | [post] pair: |
| stringinterpolation.swift:32:12:32:12 | pair: | stringinterpolation.swift:32:13:32:13 | [post] &... |
| stringinterpolation.swift:32:13:32:13 | $interpolation | stringinterpolation.swift:32:13:32:13 | &... |
| stringinterpolation.swift:32:13:32:13 | &... | stringinterpolation.swift:32:12:32:12 | [post] pair: |
| stringinterpolation.swift:32:13:32:13 | &... | stringinterpolation.swift:32:13:32:13 | [post] &... |
| stringinterpolation.swift:32:13:32:13 | &... | stringinterpolation.swift:32:20:32:20 | $interpolation |
| stringinterpolation.swift:32:13:32:13 | SSA phi($interpolation) | stringinterpolation.swift:32:13:32:13 | $interpolation |
| stringinterpolation.swift:32:13:32:13 | [post] &... | stringinterpolation.swift:32:20:32:20 | $interpolation |
| stringinterpolation.swift:32:20:32:20 | $interpolation | stringinterpolation.swift:32:20:32:20 | &... |
| stringinterpolation.swift:32:20:32:20 | &... | stringinterpolation.swift:32:20:32:20 | [post] &... |
| stringinterpolation.swift:32:20:32:20 | &... | stringinterpolation.swift:32:21:32:21 | [post] p2 |
| stringinterpolation.swift:32:20:32:20 | &... | stringinterpolation.swift:32:24:32:24 | $interpolation |
| stringinterpolation.swift:32:20:32:20 | [post] &... | stringinterpolation.swift:32:24:32:24 | $interpolation |
| stringinterpolation.swift:32:21:32:21 | p2 | stringinterpolation.swift:32:20:32:20 | [post] &... |
| stringinterpolation.swift:32:21:32:21 | p2 | stringinterpolation.swift:32:21:32:21 | [post] p2 |
| stringinterpolation.swift:32:24:32:24 | | stringinterpolation.swift:32:24:32:24 | [post] |
| stringinterpolation.swift:32:24:32:24 | | stringinterpolation.swift:32:24:32:24 | [post] &... |
| stringinterpolation.swift:32:24:32:24 | $interpolation | stringinterpolation.swift:32:24:32:24 | &... |
| stringinterpolation.swift:32:24:32:24 | &... | stringinterpolation.swift:32:12:32:12 | TapExpr |
| stringinterpolation.swift:32:24:32:24 | &... | stringinterpolation.swift:32:24:32:24 | [post] |
| stringinterpolation.swift:32:24:32:24 | &... | stringinterpolation.swift:32:24:32:24 | [post] &... |
| stringinterpolation.swift:32:24:32:24 | [post] &... | stringinterpolation.swift:32:12:32:12 | TapExpr |
| subscript.swift:1:7:1:7 | SSA def(self) | subscript.swift:1:7:1:7 | self[return] |
| subscript.swift:1:7:1:7 | SSA def(self) | subscript.swift:1:7:1:7 | self[return] |
| subscript.swift:1:7:1:7 | self | subscript.swift:1:7:1:7 | SSA def(self) |

72
swift/ql/test/library-tests/dataflow/taint/core/Taint.expected
View File

@@ -1,4 +1,8 @@
edges
| file://:0:0:0:0 | self [first] : | file://:0:0:0:0 | .first : |
| file://:0:0:0:0 | self [second] : | file://:0:0:0:0 | .second : |
| file://:0:0:0:0 | value : | file://:0:0:0:0 | [post] self [first] : |
| file://:0:0:0:0 | value : | file://:0:0:0:0 | [post] self [second] : |
| simple.swift:12:17:12:24 | call to source() : | simple.swift:12:13:12:24 | ... .+(_:_:) ... |
| simple.swift:13:13:13:20 | call to source() : | simple.swift:13:13:13:24 | ... .+(_:_:) ... |
| simple.swift:14:17:14:24 | call to source() : | simple.swift:14:13:14:24 | ... .-(_:_:) ... |
@@ -37,12 +41,47 @@ edges
| simple.swift:84:13:84:20 | call to source() : | simple.swift:84:13:84:25 | ... .>>(_:_:) ... |
| simple.swift:85:13:85:20 | call to source() : | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... |
| simple.swift:87:14:87:21 | call to source() : | simple.swift:87:13:87:21 | call to ~(_:) |
| stringinterpolation.swift:6:6:6:6 | self [first] : | file://:0:0:0:0 | self [first] : |
| stringinterpolation.swift:6:6:6:6 | value : | file://:0:0:0:0 | value : |
| stringinterpolation.swift:7:6:7:6 | self [second] : | file://:0:0:0:0 | self [second] : |
| stringinterpolation.swift:7:6:7:6 | value : | file://:0:0:0:0 | value : |
| stringinterpolation.swift:11:36:11:44 | pair [first] : | stringinterpolation.swift:13:36:13:36 | pair [first] : |
| stringinterpolation.swift:13:3:13:3 | [post] &... : | stringinterpolation.swift:11:11:14:2 | self[return] : |
| stringinterpolation.swift:13:36:13:36 | pair [first] : | stringinterpolation.swift:6:6:6:6 | self [first] : |
| stringinterpolation.swift:13:36:13:36 | pair [first] : | stringinterpolation.swift:13:36:13:41 | .first : |
| stringinterpolation.swift:13:36:13:41 | .first : | stringinterpolation.swift:11:11:14:2 | self[return] : |
| stringinterpolation.swift:13:36:13:41 | .first : | stringinterpolation.swift:13:3:13:3 | [post] &... : |
| stringinterpolation.swift:19:2:19:2 | [post] p1 [first] : | stringinterpolation.swift:20:2:20:2 | p1 [first] : |
| stringinterpolation.swift:19:13:19:20 | call to source() : | stringinterpolation.swift:6:6:6:6 | value : |
| stringinterpolation.swift:19:13:19:20 | call to source() : | stringinterpolation.swift:19:2:19:2 | [post] p1 [first] : |
| stringinterpolation.swift:20:2:20:2 | p1 [first] : | stringinterpolation.swift:22:21:22:21 | p1 [first] : |
| stringinterpolation.swift:20:2:20:2 | p1 [first] : | stringinterpolation.swift:24:21:24:21 | p1 [first] : |
| stringinterpolation.swift:22:21:22:21 | p1 [first] : | stringinterpolation.swift:6:6:6:6 | self [first] : |
| stringinterpolation.swift:22:21:22:21 | p1 [first] : | stringinterpolation.swift:22:21:22:24 | .first : |
| stringinterpolation.swift:22:21:22:24 | .first : | stringinterpolation.swift:22:12:22:12 | "..." |
| stringinterpolation.swift:24:20:24:20 | [post] &... : | stringinterpolation.swift:24:12:24:12 | "..." |
| stringinterpolation.swift:24:21:24:21 | p1 [first] : | stringinterpolation.swift:11:36:11:44 | pair [first] : |
| stringinterpolation.swift:24:21:24:21 | p1 [first] : | stringinterpolation.swift:24:20:24:20 | [post] &... : |
| stringinterpolation.swift:28:2:28:2 | [post] p2 [second] : | stringinterpolation.swift:31:21:31:21 | p2 [second] : |
| stringinterpolation.swift:28:14:28:21 | call to source() : | stringinterpolation.swift:7:6:7:6 | value : |
| stringinterpolation.swift:28:14:28:21 | call to source() : | stringinterpolation.swift:28:2:28:2 | [post] p2 [second] : |
| stringinterpolation.swift:31:21:31:21 | p2 [second] : | stringinterpolation.swift:7:6:7:6 | self [second] : |
| stringinterpolation.swift:31:21:31:21 | p2 [second] : | stringinterpolation.swift:31:21:31:24 | .second : |
| stringinterpolation.swift:31:21:31:24 | .second : | stringinterpolation.swift:31:12:31:12 | "..." |
| subscript.swift:13:15:13:22 | call to source() : | subscript.swift:13:15:13:25 | ...[...] |
| subscript.swift:14:15:14:23 | call to source2() : | subscript.swift:14:15:14:26 | ...[...] |
| try.swift:9:17:9:24 | call to source() : | try.swift:9:13:9:24 | try ... |
| try.swift:15:17:15:24 | call to source() : | try.swift:15:12:15:24 | try! ... |
| try.swift:18:18:18:25 | call to source() : | try.swift:18:12:18:27 | ...! |
nodes
| file://:0:0:0:0 | .first : | semmle.label | .first : |
| file://:0:0:0:0 | .second : | semmle.label | .second : |
| file://:0:0:0:0 | [post] self [first] : | semmle.label | [post] self [first] : |
| file://:0:0:0:0 | [post] self [second] : | semmle.label | [post] self [second] : |
| file://:0:0:0:0 | self [first] : | semmle.label | self [first] : |
| file://:0:0:0:0 | self [second] : | semmle.label | self [second] : |
| file://:0:0:0:0 | value : | semmle.label | value : |
| file://:0:0:0:0 | value : | semmle.label | value : |
| simple.swift:12:13:12:24 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
| simple.swift:12:17:12:24 | call to source() : | semmle.label | call to source() : |
| simple.swift:13:13:13:20 | call to source() : | semmle.label | call to source() : |
@@ -114,6 +153,29 @@ nodes
| simple.swift:85:13:85:26 | ... .&>>(_:_:) ... | semmle.label | ... .&>>(_:_:) ... |
| simple.swift:87:13:87:21 | call to ~(_:) | semmle.label | call to ~(_:) |
| simple.swift:87:14:87:21 | call to source() : | semmle.label | call to source() : |
| stringinterpolation.swift:6:6:6:6 | self [first] : | semmle.label | self [first] : |
| stringinterpolation.swift:6:6:6:6 | value : | semmle.label | value : |
| stringinterpolation.swift:7:6:7:6 | self [second] : | semmle.label | self [second] : |
| stringinterpolation.swift:7:6:7:6 | value : | semmle.label | value : |
| stringinterpolation.swift:11:11:14:2 | self[return] : | semmle.label | self[return] : |
| stringinterpolation.swift:11:36:11:44 | pair [first] : | semmle.label | pair [first] : |
| stringinterpolation.swift:13:3:13:3 | [post] &... : | semmle.label | [post] &... : |
| stringinterpolation.swift:13:36:13:36 | pair [first] : | semmle.label | pair [first] : |
| stringinterpolation.swift:13:36:13:41 | .first : | semmle.label | .first : |
| stringinterpolation.swift:19:2:19:2 | [post] p1 [first] : | semmle.label | [post] p1 [first] : |
| stringinterpolation.swift:19:13:19:20 | call to source() : | semmle.label | call to source() : |
| stringinterpolation.swift:20:2:20:2 | p1 [first] : | semmle.label | p1 [first] : |
| stringinterpolation.swift:22:12:22:12 | "..." | semmle.label | "..." |
| stringinterpolation.swift:22:21:22:21 | p1 [first] : | semmle.label | p1 [first] : |
| stringinterpolation.swift:22:21:22:24 | .first : | semmle.label | .first : |
| stringinterpolation.swift:24:12:24:12 | "..." | semmle.label | "..." |
| stringinterpolation.swift:24:20:24:20 | [post] &... : | semmle.label | [post] &... : |
| stringinterpolation.swift:24:21:24:21 | p1 [first] : | semmle.label | p1 [first] : |
| stringinterpolation.swift:28:2:28:2 | [post] p2 [second] : | semmle.label | [post] p2 [second] : |
| stringinterpolation.swift:28:14:28:21 | call to source() : | semmle.label | call to source() : |
| stringinterpolation.swift:31:12:31:12 | "..." | semmle.label | "..." |
| stringinterpolation.swift:31:21:31:21 | p2 [second] : | semmle.label | p2 [second] : |
| stringinterpolation.swift:31:21:31:24 | .second : | semmle.label | .second : |
| subscript.swift:13:15:13:22 | call to source() : | semmle.label | call to source() : |
| subscript.swift:13:15:13:25 | ...[...] | semmle.label | ...[...] |
| subscript.swift:14:15:14:23 | call to source2() : | semmle.label | call to source2() : |
@@ -125,6 +187,13 @@ nodes
| try.swift:18:12:18:27 | ...! | semmle.label | ...! |
| try.swift:18:18:18:25 | call to source() : | semmle.label | call to source() : |
subpaths
| stringinterpolation.swift:13:36:13:36 | pair [first] : | stringinterpolation.swift:6:6:6:6 | self [first] : | file://:0:0:0:0 | .first : | stringinterpolation.swift:13:36:13:41 | .first : |
| stringinterpolation.swift:19:13:19:20 | call to source() : | stringinterpolation.swift:6:6:6:6 | value : | file://:0:0:0:0 | [post] self [first] : | stringinterpolation.swift:19:2:19:2 | [post] p1 [first] : |
| stringinterpolation.swift:22:21:22:21 | p1 [first] : | stringinterpolation.swift:6:6:6:6 | self [first] : | file://:0:0:0:0 | .first : | stringinterpolation.swift:22:21:22:24 | .first : |
| stringinterpolation.swift:24:21:24:21 | p1 [first] : | stringinterpolation.swift:11:36:11:44 | pair [first] : | stringinterpolation.swift:11:11:14:2 | self[return] : | stringinterpolation.swift:24:20:24:20 | [post] &... : |
| stringinterpolation.swift:24:21:24:21 | p1 [first] : | stringinterpolation.swift:11:36:11:44 | pair [first] : | stringinterpolation.swift:13:3:13:3 | [post] &... : | stringinterpolation.swift:24:20:24:20 | [post] &... : |
| stringinterpolation.swift:28:14:28:21 | call to source() : | stringinterpolation.swift:7:6:7:6 | value : | file://:0:0:0:0 | [post] self [second] : | stringinterpolation.swift:28:2:28:2 | [post] p2 [second] : |
| stringinterpolation.swift:31:21:31:21 | p2 [second] : | stringinterpolation.swift:7:6:7:6 | self [second] : | file://:0:0:0:0 | .second : | stringinterpolation.swift:31:21:31:24 | .second : |
#select
| simple.swift:12:13:12:24 | ... .+(_:_:) ... | simple.swift:12:17:12:24 | call to source() : | simple.swift:12:13:12:24 | ... .+(_:_:) ... | result |
| simple.swift:13:13:13:24 | ... .+(_:_:) ... | simple.swift:13:13:13:20 | call to source() : | simple.swift:13:13:13:24 | ... .+(_:_:) ... | result |
@@ -164,6 +233,9 @@ subpaths
| simple.swift:84:13:84:25 | ... .>>(_:_:) ... | simple.swift:84:13:84:20 | call to source() : | simple.swift:84:13:84:25 | ... .>>(_:_:) ... | result |
| simple.swift:85:13:85:26 | ... .&>>(_:_:) ... | simple.swift:85:13:85:20 | call to source() : | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... | result |
| simple.swift:87:13:87:21 | call to ~(_:) | simple.swift:87:14:87:21 | call to source() : | simple.swift:87:13:87:21 | call to ~(_:) | result |
| stringinterpolation.swift:22:12:22:12 | "..." | stringinterpolation.swift:19:13:19:20 | call to source() : | stringinterpolation.swift:22:12:22:12 | "..." | result |
| stringinterpolation.swift:24:12:24:12 | "..." | stringinterpolation.swift:19:13:19:20 | call to source() : | stringinterpolation.swift:24:12:24:12 | "..." | result |
| stringinterpolation.swift:31:12:31:12 | "..." | stringinterpolation.swift:28:14:28:21 | call to source() : | stringinterpolation.swift:31:12:31:12 | "..." | result |
| subscript.swift:13:15:13:25 | ...[...] | subscript.swift:13:15:13:22 | call to source() : | subscript.swift:13:15:13:25 | ...[...] | result |
| subscript.swift:14:15:14:26 | ...[...] | subscript.swift:14:15:14:23 | call to source2() : | subscript.swift:14:15:14:26 | ...[...] | result |
| try.swift:9:13:9:24 | try ... | try.swift:9:17:9:24 | call to source() : | try.swift:9:13:9:24 | try ... | result |

33
swift/ql/test/library-tests/dataflow/taint/core/stringinterpolation.swift Normal file
View File

@@ -0,0 +1,33 @@
func clean() -> String { return ""; }
func source() -> String { return ""; }
func sink(arg: String) {}
class MyStringPair {
var first: String = ""
var second: String = ""
}
extension String.StringInterpolation {
mutating func appendInterpolation(_ pair: MyStringPair) {
// for MyStringPair, string interpolation outputs just the `first` value.
appendInterpolation("first is: \(pair.first)")
}
}
func taintThroughCustomStringInterpolation() {
let p1 = MyStringPair()
p1.first = source()
p1.second = clean()
sink(arg: "pair: \(p1.first)") // $ tainted=19
sink(arg: "pair: \(p1.second)")
sink(arg: "pair: \(p1)") // $ tainted=19
let p2 = MyStringPair()
p2.first = clean()
p2.second = source()
sink(arg: "pair: \(p2.first)")
sink(arg: "pair: \(p2.second)") // $ tainted=28
sink(arg: "pair: \(p2)")
}