hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-19 05:54:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: More path injection models.

Browse Source
This commit is contained in:
Geoffrey White
2023-02-10 18:00:36 +00:00
parent 82f09b8511
commit d0efbbf5b8
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
swift/ql/lib/codeql/swift/security/PathInjectionExtensions.qll
View File

@@ -108,6 +108,11 @@ private class PathInjectionSinks extends SinkModelCsv {
";NIOFileHandle;true;init(descriptor:);;;Argument[0];path-injection",
";NIOFileHandle;true;init(path:mode:flags:);;;Argument[0];path-injection",
";NIOFileHandle;true;init(path:);;;Argument[0];path-injection",
";String;true;init(contentsOfFile:);;;Argument[0];path-injection",
";String;true;init(contentsOfFile:encoding:);;;Argument[0];path-injection",
";String;true;init(contentsOfFile:usedEncoding:);;;Argument[0];path-injection",
";NSString;true;init(contentsOfFile:encoding:);;;Argument[0];path-injection",
";NSString;true;init(contentsOfFile:usedEncoding:);;;Argument[0];path-injection",
";NSString;true;write(to:atomically:encoding:);;;Argument[0];path-injection",
";NSString;true;write(toFile:atomically:encoding:);;;Argument[0];path-injection",
";NSKeyedUnarchiver;true;unarchiveObject(withFile:);;;Argument[0];path-injection",

10
swift/ql/test/query-tests/Security/CWE-022/testPathInjection.swift
View File

@@ -246,12 +246,12 @@ func test() {
let _ = fm.replaceItemAtURL(originalItemURL: safeNsUrl, withItemAtURL: remoteNsUrl, backupItemName: nil, options: []) // $ hasPathInjection=182
var encoding = String.Encoding.utf8
let _ = try! String(contentsOfFile: remoteString) // $ MISSING: hasPathInjection=232
let _ = try! String(contentsOfFile: remoteString, encoding: String.Encoding.utf8) // $ MISSING: hasPathInjection=234
let _ = try! String(contentsOfFile: remoteString, usedEncoding: &encoding) // $ MISSING: hasPathInjection=235
let _ = try! String(contentsOfFile: remoteString) // $ hasPathInjection=182
let _ = try! String(contentsOfFile: remoteString, encoding: String.Encoding.utf8) // $ hasPathInjection=182
let _ = try! String(contentsOfFile: remoteString, usedEncoding: &encoding) // $ hasPathInjection=182
let _ = try! NSString(contentsOfFile: remoteString, encoding: 0) // $ MISSING: hasPathInjection=237
let _ = try! NSString(contentsOfFile: remoteString, usedEncoding: nil) // $ MISSING: hasPathInjection=238
let _ = try! NSString(contentsOfFile: remoteString, encoding: 0) // $ hasPathInjection=182
let _ = try! NSString(contentsOfFile: remoteString, usedEncoding: nil) // $ hasPathInjection=182
NSString().write(to: remoteUrl, atomically: true, encoding: 0) // $ hasPathInjection=182
NSString().write(toFile: remoteString, atomically: true, encoding: 0) // $ hasPathInjection=182