hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-14 11:34:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Upgrade the query from dataflow to taint tracking, so as to support more flows.

Browse Source
This commit is contained in:
Geoffrey White
2023-01-17 15:53:00 +00:00
parent 28a707a956
commit d42848bb7e
3 changed files with 60 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
swift/ql/src/queries/Security/CWE-321/HardcodedEncryptionKey.ql
View File

@@ -12,6 +12,7 @@
import swift
import codeql.swift.dataflow.DataFlow
import codeql.swift.dataflow.TaintTracking
import DataFlow::PathGraph
/**
@@ -58,10 +59,10 @@ class EncryptionKeySink extends Expr {
}
/**
* A dataflow configuration from the key source to expressions that use
* A taint configuration from the key source to expressions that use
* it to initialize a cipher.
*/
class HardcodedKeyConfig extends DataFlow::Configuration {
class HardcodedKeyConfig extends TaintTracking::Configuration {
HardcodedKeyConfig() { this = "HardcodedKeyConfig" }
override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof KeySource }

46
swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected
View File

@@ -1,4 +1,19 @@
edges
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:65:73:65:73 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:66:73:66:73 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:67:73:67:73 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:68:73:68:73 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:70:94:70:94 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:71:102:71:102 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:72:94:72:94 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:73:102:73:102 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:75:37:75:37 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:76:37:76:37 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:80:94:80:94 | myConstKey |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:81:102:81:102 | myConstKey |
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
| test.swift:76:3:76:3 | this string is constant : | test.swift:92:18:92:36 | call to getConstantString() : |
| test.swift:90:26:90:121 | [...] : | test.swift:117:22:117:22 | key |
| test.swift:90:26:90:121 | [...] : | test.swift:118:22:118:22 | key |
@@ -20,6 +35,22 @@ edges
| test.swift:92:18:92:36 | call to getConstantString() : | test.swift:162:24:162:24 | keyString |
| test.swift:92:18:92:36 | call to getConstantString() : | test.swift:164:24:164:24 | keyString |
nodes
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : |
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | semmle.label | [summary param] 0 in Data.init(_:) : |
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
| rncryptor.swift:60:24:60:24 | abcdef123456 : | semmle.label | abcdef123456 : |
| rncryptor.swift:65:73:65:73 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:66:73:66:73 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:67:73:67:73 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:68:73:68:73 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:70:94:70:94 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:71:102:71:102 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:72:94:72:94 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:73:102:73:102 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:75:37:75:37 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:76:37:76:37 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:80:94:80:94 | myConstKey | semmle.label | myConstKey |
| rncryptor.swift:81:102:81:102 | myConstKey | semmle.label | myConstKey |
| test.swift:76:3:76:3 | this string is constant : | semmle.label | this string is constant : |
| test.swift:90:26:90:121 | [...] : | semmle.label | [...] : |
| test.swift:92:18:92:36 | call to getConstantString() : | semmle.label | call to getConstantString() : |
@@ -43,7 +74,20 @@ nodes
| test.swift:163:24:163:24 | key | semmle.label | key |
| test.swift:164:24:164:24 | keyString | semmle.label | keyString |
subpaths
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
#select
| rncryptor.swift:65:73:65:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:65:73:65:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:66:73:66:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:66:73:66:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:67:73:67:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:67:73:67:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:68:73:68:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:68:73:68:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:70:94:70:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:70:94:70:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:71:102:71:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:71:102:71:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:72:94:72:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:72:94:72:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:73:102:73:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:73:102:73:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:75:37:75:37 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:75:37:75:37 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:76:37:76:37 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:76:37:76:37 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:80:94:80:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:80:94:80:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| rncryptor.swift:81:102:81:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:81:102:81:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
| test.swift:108:21:108:21 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:108:21:108:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
| test.swift:109:21:109:21 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:109:21:109:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
| test.swift:117:22:117:22 | key | test.swift:90:26:90:121 | [...] : | test.swift:117:22:117:22 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] |
@@ -62,4 +106,4 @@ subpaths
| test.swift:161:24:161:24 | key | test.swift:90:26:90:121 | [...] : | test.swift:161:24:161:24 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] |
| test.swift:162:24:162:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:162:24:162:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
| test.swift:163:24:163:24 | key | test.swift:90:26:90:121 | [...] : | test.swift:163:24:163:24 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] |
| test.swift:164:24:164:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
| test.swift:164:24:164:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |

24
swift/ql/test/query-tests/Security/CWE-321/rncryptor.swift
View File

@@ -62,21 +62,21 @@ func test(cond: Bool) {
let myHandler = {}
let myIV = Data(0)
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED]
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED]
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV, handler: myHandler) // BAD [NOT DETECTED]
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV, handler: myHandler) // BAD [NOT DETECTED]
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV, handler: myHandler) // BAD
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV, handler: myHandler) // BAD
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD [NOT DETECTED]
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD [NOT DETECTED]
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV) // BAD [NOT DETECTED]
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV) // BAD [NOT DETECTED]
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV) // BAD
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV) // BAD
let _ = RNDecryptor(encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED]
let _ = RNDecryptor(encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED]
let _ = RNDecryptor(encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD
let _ = RNDecryptor(encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD
let _ = try? myDecryptor.decryptData(myData, withEncryptionKey: myConstKey, hmacKey: myHMACKey) // BAD [NOT DETECTED]
let _ = try? myDecryptor.decryptData(myData, withEncryptionKey: myConstKey, HMACKey: myHMACKey) // BAD [NOT DETECTED]
let _ = try? myDecryptor.decryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD [NOT DETECTED]
let _ = try? myDecryptor.decryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD [NOT DETECTED]
let _ = try? myDecryptor.decryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD
let _ = try? myDecryptor.decryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD
}