From d42848bb7e62edee115e16a6480465b7bec239fa Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Tue, 17 Jan 2023 15:53:00 +0000 Subject: [PATCH] Swift: Upgrade the query from dataflow to taint tracking, so as to support more flows. --- .../CWE-321/HardcodedEncryptionKey.ql | 5 +- .../CWE-321/HardcodedEncryptionKey.expected | 46 ++++++++++++++++++- .../Security/CWE-321/rncryptor.swift | 24 +++++----- 3 files changed, 60 insertions(+), 15 deletions(-) diff --git a/swift/ql/src/queries/Security/CWE-321/HardcodedEncryptionKey.ql b/swift/ql/src/queries/Security/CWE-321/HardcodedEncryptionKey.ql index faac1a81dac..7b497384460 100644 --- a/swift/ql/src/queries/Security/CWE-321/HardcodedEncryptionKey.ql +++ b/swift/ql/src/queries/Security/CWE-321/HardcodedEncryptionKey.ql @@ -12,6 +12,7 @@ import swift import codeql.swift.dataflow.DataFlow +import codeql.swift.dataflow.TaintTracking import DataFlow::PathGraph /** @@ -58,10 +59,10 @@ class EncryptionKeySink extends Expr { } /** - * A dataflow configuration from the key source to expressions that use + * A taint configuration from the key source to expressions that use * it to initialize a cipher. */ -class HardcodedKeyConfig extends DataFlow::Configuration { +class HardcodedKeyConfig extends TaintTracking::Configuration { HardcodedKeyConfig() { this = "HardcodedKeyConfig" } override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof KeySource } diff --git a/swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected b/swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected index 74d135c89b2..0707baf71b8 100644 --- a/swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected +++ b/swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected @@ -1,4 +1,19 @@ edges +| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:65:73:65:73 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:66:73:66:73 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:67:73:67:73 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:68:73:68:73 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:70:94:70:94 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:71:102:71:102 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:72:94:72:94 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:73:102:73:102 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:75:37:75:37 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:76:37:76:37 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:80:94:80:94 | myConstKey | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:81:102:81:102 | myConstKey | +| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | +| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | | test.swift:76:3:76:3 | this string is constant : | test.swift:92:18:92:36 | call to getConstantString() : | | test.swift:90:26:90:121 | [...] : | test.swift:117:22:117:22 | key | | test.swift:90:26:90:121 | [...] : | test.swift:118:22:118:22 | key | @@ -20,6 +35,22 @@ edges | test.swift:92:18:92:36 | call to getConstantString() : | test.swift:162:24:162:24 | keyString | | test.swift:92:18:92:36 | call to getConstantString() : | test.swift:164:24:164:24 | keyString | nodes +| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : | +| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | semmle.label | [summary param] 0 in Data.init(_:) : | +| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : | +| rncryptor.swift:60:24:60:24 | abcdef123456 : | semmle.label | abcdef123456 : | +| rncryptor.swift:65:73:65:73 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:66:73:66:73 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:67:73:67:73 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:68:73:68:73 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:70:94:70:94 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:71:102:71:102 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:72:94:72:94 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:73:102:73:102 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:75:37:75:37 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:76:37:76:37 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:80:94:80:94 | myConstKey | semmle.label | myConstKey | +| rncryptor.swift:81:102:81:102 | myConstKey | semmle.label | myConstKey | | test.swift:76:3:76:3 | this string is constant : | semmle.label | this string is constant : | | test.swift:90:26:90:121 | [...] : | semmle.label | [...] : | | test.swift:92:18:92:36 | call to getConstantString() : | semmle.label | call to getConstantString() : | @@ -43,7 +74,20 @@ nodes | test.swift:163:24:163:24 | key | semmle.label | key | | test.swift:164:24:164:24 | keyString | semmle.label | keyString | subpaths +| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | #select +| rncryptor.swift:65:73:65:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:65:73:65:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:66:73:66:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:66:73:66:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:67:73:67:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:67:73:67:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:68:73:68:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:68:73:68:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:70:94:70:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:70:94:70:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:71:102:71:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:71:102:71:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:72:94:72:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:72:94:72:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:73:102:73:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:73:102:73:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:75:37:75:37 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:75:37:75:37 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:76:37:76:37 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:76:37:76:37 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:80:94:80:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:80:94:80:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | +| rncryptor.swift:81:102:81:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:81:102:81:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 | | test.swift:108:21:108:21 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:108:21:108:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant | | test.swift:109:21:109:21 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:109:21:109:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant | | test.swift:117:22:117:22 | key | test.swift:90:26:90:121 | [...] : | test.swift:117:22:117:22 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] | @@ -62,4 +106,4 @@ subpaths | test.swift:161:24:161:24 | key | test.swift:90:26:90:121 | [...] : | test.swift:161:24:161:24 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] | | test.swift:162:24:162:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:162:24:162:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant | | test.swift:163:24:163:24 | key | test.swift:90:26:90:121 | [...] : | test.swift:163:24:163:24 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] | -| test.swift:164:24:164:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant | \ No newline at end of file +| test.swift:164:24:164:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant | diff --git a/swift/ql/test/query-tests/Security/CWE-321/rncryptor.swift b/swift/ql/test/query-tests/Security/CWE-321/rncryptor.swift index 09dad1c41fa..650e4e1e2d6 100644 --- a/swift/ql/test/query-tests/Security/CWE-321/rncryptor.swift +++ b/swift/ql/test/query-tests/Security/CWE-321/rncryptor.swift @@ -62,21 +62,21 @@ func test(cond: Bool) { let myHandler = {} let myIV = Data(0) - let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED] - let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED] - let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV, handler: myHandler) // BAD [NOT DETECTED] - let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV, handler: myHandler) // BAD [NOT DETECTED] + let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD + let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD + let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV, handler: myHandler) // BAD + let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV, handler: myHandler) // BAD - let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD [NOT DETECTED] - let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD [NOT DETECTED] - let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV) // BAD [NOT DETECTED] - let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV) // BAD [NOT DETECTED] + let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD + let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD + let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV) // BAD + let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV) // BAD - let _ = RNDecryptor(encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED] - let _ = RNDecryptor(encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED] + let _ = RNDecryptor(encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD + let _ = RNDecryptor(encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD let _ = try? myDecryptor.decryptData(myData, withEncryptionKey: myConstKey, hmacKey: myHMACKey) // BAD [NOT DETECTED] let _ = try? myDecryptor.decryptData(myData, withEncryptionKey: myConstKey, HMACKey: myHMACKey) // BAD [NOT DETECTED] - let _ = try? myDecryptor.decryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD [NOT DETECTED] - let _ = try? myDecryptor.decryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD [NOT DETECTED] + let _ = try? myDecryptor.decryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD + let _ = try? myDecryptor.decryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD }