hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Improve the encryption in examples for swift/cleartext-* queries.

Browse Source
This commit is contained in:
Geoffrey White
2024-07-29 17:02:57 +01:00
parent 1530037eae
commit d66e407c3e
3 changed files with 24 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.swift
View File

@@ -1,5 +1,11 @@
import CryptoKit
func storeMyData(databaseObject : NSManagedObject, faveSong : String, creditCardNo : String) {
private func encrypt(_ text: String, _ encryptionKey: SymmetricKey) -> String {
let sealedBox = try! AES.GCM.seal(Data(text.utf8), using: encryptionKey)
return sealedBox.combined!.base64EncodedString()
}
func storeMyData(databaseObject : NSManagedObject, faveSong : String, creditCardNo : String, key: SymmetricKey) {
// ...
// GOOD: not sensitive information
@@ -9,7 +15,7 @@ func storeMyData(databaseObject : NSManagedObject, faveSong : String, creditCard
databaseObject.setValue(creditCardNo, forKey: "myCreditCardNo")
// GOOD: encrypted sensitive information saved
databaseObject.setValue(encrypt(creditCardNo), forKey: "myCreditCardNo")
databaseObject.setValue(encrypt(creditCardNo, encryptionKey), forKey: "myCreditCardNo")
// ...
}

10
swift/ql/src/queries/Security/CWE-311/CleartextTransmission.swift
View File

@@ -1,5 +1,11 @@
import CryptoKit
func transmitMyData(connection : NWConnection, faveSong : String, creditCardNo : String) {
private func encrypt(_ text: String, _ encryptionKey: SymmetricKey) -> String {
let sealedBox = try! AES.GCM.seal(Data(text.utf8), using: encryptionKey)
return sealedBox.combined!.base64EncodedString()
}
func transmitMyData(connection : NWConnection, faveSong : String, creditCardNo : String, key: SymmetricKey) {
// ...
// GOOD: not sensitive information
@@ -9,7 +15,7 @@ func transmitMyData(connection : NWConnection, faveSong : String, creditCardNo :
connection.send(content: creditCardNo, completion: .idempotent)
// GOOD: encrypted sensitive information saved
connection.send(content: encrypt(creditCardNo), completion: .idempotent)
connection.send(content: encrypt(creditCardNo, encryptionKey), completion: .idempotent)
// ...
}

10
swift/ql/src/queries/Security/CWE-312/CleartextStoragePreferences.swift
View File

@@ -1,5 +1,11 @@
import CryptoKit
func storeMyData(faveSong : String, creditCardNo : String) {
private func encrypt(_ text: String, _ encryptionKey: SymmetricKey) -> String {
let sealedBox = try! AES.GCM.seal(Data(text.utf8), using: encryptionKey)
return sealedBox.combined!.base64EncodedString()
}
func storeMyData(faveSong : String, creditCardNo : String, encryptionKey: SymmetricKey) {
// ...
// GOOD: not sensitive information
@@ -9,7 +15,7 @@ func storeMyData(faveSong : String, creditCardNo : String) {
UserDefaults.standard.set(creditCardNo, forKey: "myCreditCardNo")
// GOOD: encrypted sensitive information saved
UserDefaults.standard.set(encrypt(creditCardNo), forKey: "myCreditCardNo")
UserDefaults.standard.set(encrypt(creditCardNo, encryptionKey), forKey: "myCreditCardNo")
// ...
}