From 0126fbcb8f2cb9d7f38f8adce31716981f7a8422 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 16 Aug 2024 10:56:46 +0100
Subject: [PATCH 01/75] Swift: Clear the language for Swift code snippets that
are rendering incorrectly.
---
.../queries/Security/CWE-020/IncompleteHostnameRegex.qhelp | 4 ++--
swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp | 2 +-
swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp | 4 ++--
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
index ef374fc9752..347a0ee0e29 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
@@ -46,7 +46,7 @@
-
+
@@ -63,7 +63,7 @@
-
+
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
index b406faf8e17..c312fb1a6f5 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
@@ -28,7 +28,7 @@ likely to handle corner cases correctly than a custom implementation.
The following example attempts to filters out all <script> tags.
-
+
The above sanitizer does not filter out all <script> tags.
diff --git a/swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp b/swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp
index ddbb2835bc2..e641d9b4e61 100644
--- a/swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp
+++ b/swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp
@@ -3,7 +3,7 @@
Consider the following regular expression:
-
+
/^_(__|.)+_$/
Its sub-expression "(__|.)+" can match the string
@@ -19,7 +19,7 @@
the ambiguity between the two branches of the alternative inside the
repetition:
-
+
/^_(__|[^_])+_$/
From 2d19d6f61ecc12f8a888f5a5cdd76888e0c01763 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 16 Aug 2024 11:40:57 +0100
Subject: [PATCH 02/75] Swift: Fix two of the qhelps by slightly modifying the
sample code instead.
---
.../queries/Security/CWE-020/IncompleteHostnameRegex.qhelp | 4 ++--
.../queries/Security/CWE-020/IncompleteHostnameRegexBad.swift | 4 ++--
.../Security/CWE-020/IncompleteHostnameRegexGood.swift | 4 ++--
swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp | 2 +-
swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift | 2 +-
5 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
index 347a0ee0e29..ef374fc9752 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
@@ -46,7 +46,7 @@
-
+
@@ -63,7 +63,7 @@
-
+
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
index 3e28022ab98..6f553b2fbee 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
@@ -1,11 +1,11 @@
-func handleUrl(_ urlString: String) {
+func handleUrl(_ urlString: String) throws {
// get the 'url=' parameter from the URL
let components = URLComponents(string: urlString)
let redirectParam = components?.queryItems?.first(where: { $0.name == "url" })
// check we trust the host
- let regex = #/^(www|beta).example.com//# // BAD
+ let regex = try Regex("^(www|beta).example.com/") // BAD
if let match = redirectParam?.value?.firstMatch(of: regex) {
// ... trust the URL ...
}
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
index fad4135a263..1413a7ffa73 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
@@ -1,11 +1,11 @@
-func handleUrl(_ urlString: String) {
+func handleUrl(_ urlString: String) throws {
// get the 'url=' parameter from the URL
let components = URLComponents(string: urlString)
let redirectParam = components?.queryItems?.first(where: { $0.name == "url" })
// check we trust the host
- let regex = #/^(www|beta)\.example\.com//# // GOOD
+ let regex = try Regex("^(www|beta)\\.example\\.com/") // GOOD
if let match = redirectParam?.value?.firstMatch(of: regex) {
// ... trust the URL ...
}
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
index c312fb1a6f5..b406faf8e17 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
@@ -28,7 +28,7 @@ likely to handle corner cases correctly than a custom implementation.
The following example attempts to filters out all <script> tags.
-
+
The above sanitizer does not filter out all <script> tags.
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift b/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
index d399bf5a166..f2a8273d31a 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
@@ -1,4 +1,4 @@
-let script_tag_regex = /")
var old_html = ""
while (html != old_html) {
From 0088ece3ea7772811f7c2c75a2a75e16abb49d66 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 16 Aug 2024 13:24:03 +0100
Subject: [PATCH 03/75] Revert "Swift: Fix two of the qhelps by slightly
modifying the sample code instead."
This reverts commit 2d19d6f61ecc12f8a888f5a5cdd76888e0c01763.
---
.../queries/Security/CWE-020/IncompleteHostnameRegex.qhelp | 4 ++--
.../queries/Security/CWE-020/IncompleteHostnameRegexBad.swift | 4 ++--
.../Security/CWE-020/IncompleteHostnameRegexGood.swift | 4 ++--
swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp | 2 +-
swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift | 2 +-
5 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
index ef374fc9752..347a0ee0e29 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
@@ -46,7 +46,7 @@
-
+
@@ -63,7 +63,7 @@
-
+
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
index 6f553b2fbee..3e28022ab98 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
@@ -1,11 +1,11 @@
-func handleUrl(_ urlString: String) throws {
+func handleUrl(_ urlString: String) {
// get the 'url=' parameter from the URL
let components = URLComponents(string: urlString)
let redirectParam = components?.queryItems?.first(where: { $0.name == "url" })
// check we trust the host
- let regex = try Regex("^(www|beta).example.com/") // BAD
+ let regex = #/^(www|beta).example.com//# // BAD
if let match = redirectParam?.value?.firstMatch(of: regex) {
// ... trust the URL ...
}
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
index 1413a7ffa73..fad4135a263 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
@@ -1,11 +1,11 @@
-func handleUrl(_ urlString: String) throws {
+func handleUrl(_ urlString: String) {
// get the 'url=' parameter from the URL
let components = URLComponents(string: urlString)
let redirectParam = components?.queryItems?.first(where: { $0.name == "url" })
// check we trust the host
- let regex = try Regex("^(www|beta)\\.example\\.com/") // GOOD
+ let regex = #/^(www|beta)\.example\.com//# // GOOD
if let match = redirectParam?.value?.firstMatch(of: regex) {
// ... trust the URL ...
}
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
index b406faf8e17..c312fb1a6f5 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
@@ -28,7 +28,7 @@ likely to handle corner cases correctly than a custom implementation.
The following example attempts to filters out all <script> tags.
-
+
The above sanitizer does not filter out all <script> tags.
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift b/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
index f2a8273d31a..d399bf5a166 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
@@ -1,4 +1,4 @@
-let script_tag_regex = try Regex("")
+let script_tag_regex = /