From 97bd91ed19898335a9886b1ebbde20849e7c917c Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 28 Nov 2022 16:05:42 +0000 Subject: [PATCH 1/3] Swift: Simplify using ApplyExpr.getArgumentWithLabel. --- .../queries/Security/CWE-1204/StaticInitializationVector.ql | 6 ++---- swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql | 5 ++--- swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql | 5 ++--- .../queries/Security/CWE-916/InsufficientHashIterations.ql | 5 ++--- 4 files changed, 8 insertions(+), 13 deletions(-) diff --git a/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql b/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql index ccf6584c391..9a0ac0e3d79 100644 --- a/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql +++ b/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql @@ -32,7 +32,7 @@ class StaticInitializationVectorSource extends Expr { class EncryptionInitializationSink extends Expr { EncryptionInitializationSink() { // `iv` arg in `init` is a sink - exists(CallExpr call, string fName, int arg | + exists(CallExpr call, string fName | call.getStaticTarget() .(MethodDecl) .hasQualifiedName([ @@ -40,9 +40,7 @@ class EncryptionInitializationSink extends Expr { "CCM", "CTR" ], fName) and fName.matches("%init(%iv:%") and - arg = [0, 1] and - call.getStaticTarget().(MethodDecl).getParam(pragma[only_bind_into](arg)).getName() = "iv" and - call.getArgument(pragma[only_bind_into](arg)).getExpr() = this + call.getArgumentWithLabel("iv").getExpr() = this ) } } diff --git a/swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql b/swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql index 75af598dc19..e17d8a4c778 100644 --- a/swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql +++ b/swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql @@ -32,13 +32,12 @@ class ConstantPasswordSource extends Expr { class ConstantPasswordSink extends Expr { ConstantPasswordSink() { // `password` arg in `init` is a sink - exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call, int arg | + exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call | c.getFullName() = ["HKDF", "PBKDF1", "PBKDF2", "Scrypt"] and c.getAMember() = f and f.getName().matches("%init(%password:%") and call.getStaticTarget() = f and - f.getParam(pragma[only_bind_into](arg)).getName() = "password" and - call.getArgument(pragma[only_bind_into](arg)).getExpr() = this + call.getArgumentWithLabel("password").getExpr() = this ) } } diff --git a/swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql b/swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql index 9cd6dbd5ace..b351eb710d7 100644 --- a/swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql +++ b/swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql @@ -32,13 +32,12 @@ class ConstantSaltSource extends Expr { class ConstantSaltSink extends Expr { ConstantSaltSink() { // `salt` arg in `init` is a sink - exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call, int arg | + exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call | c.getFullName() = ["HKDF", "PBKDF1", "PBKDF2", "Scrypt"] and c.getAMember() = f and f.getName().matches("%init(%salt:%") and call.getStaticTarget() = f and - f.getParam(pragma[only_bind_into](arg)).getName() = "salt" and - call.getArgument(pragma[only_bind_into](arg)).getExpr() = this + call.getArgumentWithLabel("salt").getExpr() = this ) } } diff --git a/swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql b/swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql index 046c86d2f5c..19d400dfe1b 100644 --- a/swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql +++ b/swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql @@ -33,13 +33,12 @@ class IntLiteralSource extends IterationsSource instanceof IntegerLiteralExpr { class InsufficientHashIterationsSink extends Expr { InsufficientHashIterationsSink() { // `iterations` arg in `init` is a sink - exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call, int arg | + exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call | c.getFullName() = ["PBKDF1", "PBKDF2"] and c.getAMember() = f and f.getName().matches("init(%iterations:%") and call.getStaticTarget() = f and - f.getParam(pragma[only_bind_into](arg)).getName() = "iterations" and - call.getArgument(pragma[only_bind_into](arg)).getExpr() = this + call.getArgumentWithLabel("iterations").getExpr() = this ) } } From aa5c893d5e9c4eec894c1e8988f65515e6b31bb4 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 28 Nov 2022 16:08:24 +0000 Subject: [PATCH 2/3] Swift: Further simplify. --- .../src/queries/Security/CWE-1204/StaticInitializationVector.ql | 2 +- swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql | 2 +- swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql | 2 +- .../src/queries/Security/CWE-916/InsufficientHashIterations.ql | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql b/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql index 9a0ac0e3d79..28dbb45d95c 100644 --- a/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql +++ b/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql @@ -39,7 +39,7 @@ class EncryptionInitializationSink extends Expr { "AES", "ChaCha20", "Blowfish", "Rabbit", "CBC", "CFB", "GCM", "OCB", "OFB", "PCBC", "CCM", "CTR" ], fName) and - fName.matches("%init(%iv:%") and + fName.matches("%init(%") and call.getArgumentWithLabel("iv").getExpr() = this ) } diff --git a/swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql b/swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql index e17d8a4c778..91982a2a2dd 100644 --- a/swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql +++ b/swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql @@ -35,7 +35,7 @@ class ConstantPasswordSink extends Expr { exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call | c.getFullName() = ["HKDF", "PBKDF1", "PBKDF2", "Scrypt"] and c.getAMember() = f and - f.getName().matches("%init(%password:%") and + f.getName().matches("%init(%") and call.getStaticTarget() = f and call.getArgumentWithLabel("password").getExpr() = this ) diff --git a/swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql b/swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql index b351eb710d7..47f84fd9bd7 100644 --- a/swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql +++ b/swift/ql/src/queries/Security/CWE-760/ConstantSalt.ql @@ -35,7 +35,7 @@ class ConstantSaltSink extends Expr { exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call | c.getFullName() = ["HKDF", "PBKDF1", "PBKDF2", "Scrypt"] and c.getAMember() = f and - f.getName().matches("%init(%salt:%") and + f.getName().matches("%init(%") and call.getStaticTarget() = f and call.getArgumentWithLabel("salt").getExpr() = this ) diff --git a/swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql b/swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql index 19d400dfe1b..7349978189d 100644 --- a/swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql +++ b/swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql @@ -36,7 +36,7 @@ class InsufficientHashIterationsSink extends Expr { exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call | c.getFullName() = ["PBKDF1", "PBKDF2"] and c.getAMember() = f and - f.getName().matches("init(%iterations:%") and + f.getName().matches("init(%") and call.getStaticTarget() = f and call.getArgumentWithLabel("iterations").getExpr() = this ) From edb6325117e9b61725334d95c2cdc3a2a46bba90 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 28 Nov 2022 16:11:07 +0000 Subject: [PATCH 3/3] Swift: Fix comment. --- swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql b/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql index 09d5319e11a..8f60c90b2c4 100644 --- a/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql +++ b/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql @@ -162,7 +162,7 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration { call.getStaticTarget() = funcDecl and flowstate = "String" ) and - // match up `funcName`, `paramName`, `arg`, `node`. + // match up `funcName`, `arg`, `node`. funcDecl.getName() = funcName and call.getArgument(arg).getExpr() = node.asExpr() )