hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12263 from geoffw0/flowsourceinline

Browse Source 
Swift: Convert the flow sources test to inline expectations.
This commit is contained in:
Geoffrey White
2023-02-20 16:13:01 +00:00
committed by GitHub
parent 6894803b14 690b5debf4
commit e19e28fbb9
14 changed files with 144 additions and 237 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
swift/ql/lib/codeql/swift/dataflow/FlowSources.qll
View File

@@ -28,7 +28,7 @@ abstract class RemoteFlowSource extends FlowSource { }
/**
* A data flow source of local user input that is defined through 'models as data'.
*/
private class ExternalLocalFlowSource extends RemoteFlowSource {
private class ExternalLocalFlowSource extends LocalFlowSource {
ExternalLocalFlowSource() { sourceNode(this, "local") }
override string getSourceType() { result = "external" }

3
swift/ql/test/library-tests/dataflow/flowsources/FlowSources.ql → swift/ql/test/library-tests/dataflow/flowsources/FlowConfig.qll
View File

@@ -34,6 +34,3 @@ class CustomTestSourcesCsv extends SourceModelCsv {
]
}
}
from RemoteFlowSource source
select source, concat(source.getSourceType(), ", ")

117
swift/ql/test/library-tests/dataflow/flowsources/FlowSources.expected
View File

@@ -1,117 +0,0 @@
| alamofire.swift:91:27:91:27 | .result | external |
| alamofire.swift:99:27:99:27 | .result | external |
| alamofire.swift:344:23:344:32 | .data | external |
| alamofire.swift:351:22:351:31 | .value | external |
| alamofire.swift:358:23:358:32 | .value | external |
| alamofire.swift:365:22:365:31 | .value | external |
| alamofire.swift:372:23:372:32 | .value | external |
| alamofire.swift:379:28:379:37 | .value | external |
| alamofire.swift:389:28:389:55 | call to String.init(contentsOfFile:) | external |
| alamofire.swift:396:22:396:31 | .value | external |
| alamofire.swift:403:22:403:31 | .value | external |
| alamofire.swift:404:28:404:50 | call to String.init(contentsOf:) | external |
| alamofire.swift:411:23:411:32 | .value | external |
| alamofire.swift:418:22:418:31 | .value | external |
| alamofire.swift:425:23:425:32 | .value | external |
| alamofire.swift:431:28:431:37 | .value | external |
| alamofire.swift:448:20:448:49 | call to String.init(contentsOfFile:) | external |
| alamofire.swift:455:23:455:32 | .data | external |
| alamofire.swift:461:23:461:32 | .data | external |
| customurlschemes.swift:53:44:53:54 | url | external |
| customurlschemes.swift:57:52:57:68 | url | external |
| customurlschemes.swift:61:52:61:62 | url | external |
| customurlschemes.swift:66:9:66:28 | ...[...] | Remote URL in UIApplicationDelegate.application.launchOptions |
| customurlschemes.swift:71:9:71:28 | ...[...] | Remote URL in UIApplicationDelegate.application.launchOptions |
| customurlschemes.swift:77:59:77:76 | options | external |
| customurlschemes.swift:78:28:78:38 | continue | external |
| customurlschemes.swift:79:28:79:39 | didUpdate | external |
| customurlschemes.swift:80:28:80:65 | openURLContexts | external |
| customurlschemes.swift:86:59:86:76 | options | external |
| customurlschemes.swift:87:28:87:38 | continue | external |
| customurlschemes.swift:88:28:88:39 | didUpdate | external |
| customurlschemes.swift:89:28:89:65 | openURLContexts | external |
| data.swift:18:20:18:54 | call to Data.init(contentsOf:options:) | external |
| file://:0:0:0:0 | .data | external |
| file://:0:0:0:0 | .result | external |
| file://:0:0:0:0 | .result | external |
| file://:0:0:0:0 | .source1 | external |
| file://:0:0:0:0 | .source1 | external |
| file://:0:0:0:0 | .source4 | external |
| file://:0:0:0:0 | .source9 | external |
| filemanager.swift:37:23:37:86 | call to contentsOfDirectory(at:includingPropertiesForKeys:options:) | external |
| filemanager.swift:38:23:38:58 | call to contentsOfDirectory(atPath:) | external |
| filemanager.swift:39:19:39:52 | call to directoryContents(atPath:) | external |
| filemanager.swift:41:23:41:58 | call to subpathsOfDirectory(atPath:) | external |
| filemanager.swift:42:19:42:43 | call to subpaths(atPath:) | external |
| filemanager.swift:44:19:44:60 | call to destinationOfSymbolicLink(atPath:) | external |
| filemanager.swift:45:15:45:56 | call to pathContentOfSymbolicLink(atPath:) | external |
| filemanager.swift:47:14:47:38 | call to contents(atPath:) | external |
| generics.swift:10:9:10:16 | .source1 | external |
| generics.swift:11:9:11:16 | .source2 | external |
| generics.swift:12:9:12:24 | call to source3() | external |
| generics.swift:48:9:48:17 | .source1 | external |
| generics.swift:49:9:49:17 | .source2 | external |
| generics.swift:50:9:50:25 | call to source3() | external |
| generics.swift:51:9:51:18 | .source1 | external |
| generics.swift:52:9:52:18 | .source2 | external |
| generics.swift:53:9:53:26 | call to source3() | external |
| generics.swift:54:9:54:17 | .source1 | external |
| generics.swift:55:9:55:17 | .source2 | external |
| generics.swift:56:9:56:25 | call to source3() | external |
| generics.swift:57:9:57:17 | .source4 | external |
| generics.swift:58:9:58:17 | .source5 | external |
| generics.swift:59:9:59:25 | call to source6() | external |
| generics.swift:60:9:60:17 | .source7 | external |
| generics.swift:61:9:61:25 | call to source8() | external |
| generics.swift:62:9:62:18 | .source1 | external |
| generics.swift:63:9:63:18 | .source2 | external |
| generics.swift:64:9:64:26 | call to source3() | external |
| generics.swift:65:9:65:18 | .source9 | external |
| generics.swift:66:9:66:18 | .source10 | external |
| generics.swift:67:9:67:27 | call to source11() | external |
| generics.swift:68:9:68:18 | .source12 | external |
| generics.swift:69:9:69:27 | call to source13() | external |
| generics.swift:93:9:93:15 | .source0 | external |
| generics.swift:94:9:94:15 | .source1 | external |
| generics.swift:95:9:95:15 | .source2 | external |
| generics.swift:96:9:96:14 | .source0 | external |
| generics.swift:97:9:97:14 | .source1 | external |
| generics.swift:98:9:98:14 | .source2 | external |
| generics.swift:99:9:99:15 | .source0 | external |
| generics.swift:100:9:100:15 | .source1 | external |
| generics.swift:101:9:101:15 | .source2 | external |
| generics.swift:125:9:125:15 | .source0 | external |
| generics.swift:126:9:126:15 | .source1 | external |
| generics.swift:127:9:127:15 | .source2 | external |
| generics.swift:128:9:128:14 | .source0 | external |
| generics.swift:129:9:129:14 | .source1 | external |
| generics.swift:130:9:130:14 | .source2 | external |
| generics.swift:131:9:131:15 | .source0 | external |
| generics.swift:132:9:132:15 | .source1 | external |
| generics.swift:133:9:133:15 | .source2 | external |
| generics.swift:162:9:162:22 | call to source2() | external |
| generics.swift:163:9:163:22 | call to source3() | external |
| nsdata.swift:18:17:18:40 | call to NSData.init(contentsOf:) | external |
| nsdata.swift:19:17:19:53 | call to NSData.init(contentsOf:options:) | external |
| string.swift:56:21:56:44 | call to String.init(contentsOf:) | external |
| string.swift:57:21:57:77 | call to String.init(contentsOf:encoding:) | external |
| string.swift:59:21:59:69 | call to String.init(contentsOf:usedEncoding:) | external |
| string.swift:62:21:62:48 | call to String.init(contentsOfFile:) | external |
| string.swift:63:21:63:81 | call to String.init(contentsOfFile:encoding:) | external |
| string.swift:64:21:64:73 | call to String.init(contentsOfFile:usedEncoding:) | external |
| url.swift:53:15:53:19 | .resourceBytes | external |
| url.swift:60:15:60:19 | .lines | external |
| url.swift:67:16:67:22 | .lines | external |
| webview.swift:13:32:13:49 | decidePolicyFor | Navigation action of a WebView |
| webview.swift:14:32:14:49 | decidePolicyFor | Navigation action of a WebView |
| webview.swift:41:82:41:102 | message | external |
| webview.swift:46:5:46:13 | .globalObject | external |
| webview.swift:47:5:47:39 | call to objectForKeyedSubscript(_:) | external |
| webview.swift:60:9:60:9 | .tainted | Member of a type exposed through JSExport |
| webview.swift:64:10:64:10 | self | Member of a type exposed through JSExport |
| webview.swift:64:18:64:24 | arg1 | Member of a type exposed through JSExport |
| webview.swift:64:29:64:35 | arg2 | Member of a type exposed through JSExport |
| webview.swift:72:32:72:49 | decidePolicyFor | Navigation action of a WebView |
| webview.swift:73:32:73:49 | decidePolicyFor | Navigation action of a WebView |
| webview.swift:79:32:79:49 | decidePolicyFor | Navigation action of a WebView |
| webview.swift:80:32:80:49 | decidePolicyFor | Navigation action of a WebView |

0
swift/ql/test/library-tests/dataflow/flowsources/FlowSourcesInline.expected Normal file
View File

25
swift/ql/test/library-tests/dataflow/flowsources/FlowSourcesInline.ql Normal file
View File

@@ -0,0 +1,25 @@
import swift
import TestUtilities.InlineExpectationsTest
import FlowConfig
string describe(FlowSource source) {
source instanceof RemoteFlowSource and result = "remote"
or
source instanceof LocalFlowSource and result = "local"
}
class FlowSourcesTest extends InlineExpectationsTest {
FlowSourcesTest() { this = "FlowSourcesTest" }
override string getARelevantTag() { result = "source" }
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(FlowSource source |
location = source.getLocation() and
location.getFile().getBaseName() != "" and
element = source.toString() and
tag = "source" and
value = describe(source)
)
}
}

50
swift/ql/test/library-tests/dataflow/flowsources/alamofire.swift
View File

@@ -88,7 +88,7 @@ struct DataResponse<Success, Failure: Error> {
let result: Result<Success, Failure>
var value: Success? { result.success } // SOURCE
var value: Success? { result.success } // $ source=remote
}
struct DownloadResponse<Success, Failure: Error> {
@@ -96,7 +96,7 @@ struct DownloadResponse<Success, Failure: Error> {
let result: Result<Success, Failure>
var value: Success? { result.success } // SOURCE
var value: Success? { result.success } // $ source=remote
}
typealias AFDataResponse<Success> = DataResponse<Success, AFError>
@@ -341,42 +341,42 @@ func testAlamofire() {
AF.request("http://example.com/").response {
response in
if let data = response.data { // SOURCE
if let data = response.data { // $ source=remote
// ...
}
}
AF.request("http://example.com/").response(responseSerializer: MySerializer()) {
response in
if let obj = response.value { // SOURCE
if let obj = response.value { // $ source=remote
// ...
}
}
AF.request("http://example.com/").responseData {
response in
if let data = response.value { // SOURCE
if let data = response.value { // $ source=remote
// ...
}
}
AF.request("http://example.com/").responseString {
response in
if let str = response.value { // SOURCE
if let str = response.value { // $ source=remote
// ...
}
}
AF.request("http://example.com/").responseJSON {
response in
if let json = response.value { // SOURCE
if let json = response.value { // $ source=remote
// ...
}
}
AF.request("http://example.com/").responseDecodable(of: MyDecodable.self) {
response in
if let decodable = response.value { // SOURCE
if let decodable = response.value { // $ source=remote
// ...
}
}
@@ -386,49 +386,49 @@ func testAlamofire() {
AF.download("http://example.com/").response {
response in
if let path = response.fileURL?.path {
let str = try? String(contentsOfFile: path) // SOURCE
let str = try? String(contentsOfFile: path) // $ MISSING: source=remote $ SPURIOUS: source=local
// ...
}
}
AF.download("http://example.com/").response(responseSerializer: MySerializer()) {
response in
if let obj = response.value { // SOURCE
if let obj = response.value { // $ source=remote
// ...
}
}
AF.download("http://example.com/").responseURL {
response in
if let url = response.value { // just the URL [FALSE POSITIVE]
let str = try? String(contentsOf: url) // SOURCE
if let url = response.value { // $ SPURIOUS: source=remote (this is just the URL)
let str = try? String(contentsOf: url) // $ source=remote
// ...
}
}
AF.download("http://example.com/").responseData {
response in
if let data = response.value { // SOURCE
if let data = response.value { // $ source=remote
// ...
}
}
AF.download("http://example.com/").responseString {
response in
if let str = response.value { // SOURCE
if let str = response.value { // $ source=remote
// ...
}
}
AF.download("http://example.com/").responseJSON {
response in
if let json = response.value { // SOURCE
if let json = response.value { // $ source=remote
}
}
AF.download("http://example.com/").responseDecodable(of: MyDecodable.self) {
response in
if let decodable = response.value { // SOURCE
if let decodable = response.value { // $ source=remote
// ...
}
}
@@ -445,20 +445,20 @@ func testAlamofire() {
// ...
}
// ...
let str = try? String(contentsOfFile: myPath) // SOURCE
let str = try? String(contentsOfFile: myPath) // $ MISSING: source=remote SPURIOUS: source=local
// chaining
// - in practice there are a wide range of calls that can be chained through.
AF.request("http://example.com/").response {
response in
if let data = response.data { // SOURCE
if let data = response.data { // $ source=remote
// ...
}
}
.response {
response in
if let data = response.data { // SOURCE
if let data = response.data { // $ source=remote
// ...
}
}
@@ -470,7 +470,7 @@ func testAlamofire() {
switch stream.event {
case let .stream(result):
switch result {
case let .success(data): // SOURCE [NOT DETECTED]
case let .success(data): // $ MISSING: source=remote
doSomethingWith(data)
// ...
}
@@ -485,7 +485,7 @@ func testAlamofire() {
switch stream.event {
case let .stream(result):
switch result {
case let .success(value): // SOURCE [NOT DETECTED]
case let .success(value): // $ MISSING: source=remote
doSomethingWith(value)
// ...
}
@@ -500,7 +500,7 @@ func testAlamofire() {
switch stream.event {
case let .stream(result):
switch result {
case let .success(value): // SOURCE [NOT DETECTED]
case let .success(value): // MISSING: source=remote
doSomethingWith(value)
// ...
}
@@ -515,7 +515,7 @@ func testAlamofire() {
switch stream.event {
case let .stream(result):
switch result {
case let .success(value): // SOURCE [NOT DETECTED]
case let .success(value): // MISSING: source=remote
doSomethingWith(value)
// ...
}
@@ -530,7 +530,7 @@ func testAlamofire() {
AF.streamRequest("http://example.com/").responseStream {
stream in
if case let .stream(myResult) = stream.event {
if case let .success(myData) = myResult { // SOURCE [NOT DETECTED]
if case let .success(myData) = myResult { // MISSING: source=remote
doSomethingWith(myData)
}
}
@@ -539,7 +539,7 @@ func testAlamofire() {
AF.streamRequest("http://example.com/").responseStream {
stream in
if case let .stream(myResult) = stream.event {
doSomethingWith(myResult.success!) // SOURCE [NOT DETECTED]
doSomethingWith(myResult.success!) // MISSING: source=remote
}
}

27
swift/ql/test/library-tests/dataflow/flowsources/customurlschemes.swift
View File

@@ -1,4 +1,5 @@
// --- stubs ---
class UIApplication {
struct OpenURLOptionsKey : Hashable {
static func == (lhs: OpenURLOptionsKey, rhs: OpenURLOptionsKey) -> Bool {
@@ -50,41 +51,41 @@ protocol UISceneDelegate {
// --- tests ---
class AppDelegate: UIApplicationDelegate {
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any]) -> Bool { // SOURCE
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any]) -> Bool { // $ source=remote
return true
}
func application(_ application: UIApplication, handleOpen url: URL) -> Bool { // SOURCE
func application(_ application: UIApplication, handleOpen url: URL) -> Bool { // $ source=remote
return true
}
func application(_ application: UIApplication, open url: URL, sourceApplication: String?, annotation: Any) -> Bool { // SOURCE
func application(_ application: UIApplication, open url: URL, sourceApplication: String?, annotation: Any) -> Bool { // $ source=remote
return true
}
func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]?) -> Bool {
launchOptions?[.url] // SOURCE
launchOptions?[.url] // $ source=remote
return true
}
func application(_ application: UIApplication, willFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]?) -> Bool {
launchOptions?[.url] // SOURCE
launchOptions?[.url] // $ source=remote
return true
}
}
class SceneDelegate : UISceneDelegate {
func scene(_: UIScene, willConnectTo: UISceneSession, options: UIScene.ConnectionOptions) {} // SOURCE
func scene(_: UIScene, continue: NSUserActivity) {} // SOURCE
func scene(_: UIScene, didUpdate: NSUserActivity) {} // SOURCE
func scene(_: UIScene, openURLContexts: Set<UIOpenURLContext>) {} // SOURCE
func scene(_: UIScene, willConnectTo: UISceneSession, options: UIScene.ConnectionOptions) {} // $ source=remote
func scene(_: UIScene, continue: NSUserActivity) {} // $ source=remote
func scene(_: UIScene, didUpdate: NSUserActivity) {} // $ source=remote
func scene(_: UIScene, openURLContexts: Set<UIOpenURLContext>) {} // $ source=remote
}
class Extended {}
extension Extended : UISceneDelegate {
func scene(_: UIScene, willConnectTo: UISceneSession, options: UIScene.ConnectionOptions) {} // SOURCE
func scene(_: UIScene, continue: NSUserActivity) {} // SOURCE
func scene(_: UIScene, didUpdate: NSUserActivity) {} // SOURCE
func scene(_: UIScene, openURLContexts: Set<UIOpenURLContext>) {} // SOURCE
func scene(_: UIScene, willConnectTo: UISceneSession, options: UIScene.ConnectionOptions) {} // $ source=remote
func scene(_: UIScene, continue: NSUserActivity) {} // $ source=remote
func scene(_: UIScene, didUpdate: NSUserActivity) {} // $ source=remote
func scene(_: UIScene, openURLContexts: Set<UIOpenURLContext>) {} // $ source=remote
}

2
swift/ql/test/library-tests/dataflow/flowsources/data.swift
View File

@@ -15,5 +15,5 @@ struct Data {
func testData() {
let url = URL(string: "http://example.com/")
let data = try Data(contentsOf: url!, options: []) // SOURCE
let data = try Data(contentsOf: url!, options: []) // $ source=remote
}

16
swift/ql/test/library-tests/dataflow/flowsources/filemanager.swift
View File

@@ -34,17 +34,17 @@ class FileManager : NSObject {
func testFileHandle(fm: FileManager, url: URL, path: String) {
do
{
let contents1 = try fm.contentsOfDirectory(at: url, includingPropertiesForKeys: nil) // SOURCE
let contents2 = try fm.contentsOfDirectory(atPath: path) // SOURCE
let contents3 = fm.directoryContents(atPath: path)! // SOURCE
let contents1 = try fm.contentsOfDirectory(at: url, includingPropertiesForKeys: nil) // $ source=local
let contents2 = try fm.contentsOfDirectory(atPath: path) // $ source=local
let contents3 = fm.directoryContents(atPath: path)! // $ source=local
let subpaths1 = try fm.subpathsOfDirectory(atPath: path) // SOURCE
let subpaths2 = fm.subpaths(atPath: path)! // SOURCE
let subpaths1 = try fm.subpathsOfDirectory(atPath: path) // $ source=local
let subpaths2 = fm.subpaths(atPath: path)! // $ source=local
let link1 = try fm.destinationOfSymbolicLink(atPath: path) // SOURCE
let link2 = fm.pathContentOfSymbolicLink(atPath: path)! // SOURCE
let link1 = try fm.destinationOfSymbolicLink(atPath: path) // $ source=local
let link2 = fm.pathContentOfSymbolicLink(atPath: path)! // $ source=local
let data = fm.contents(atPath: path)! // SOURCE
let data = fm.contents(atPath: path)! // $ source=local
} catch {
// ...
}

90
swift/ql/test/library-tests/dataflow/flowsources/generics.swift
View File

@@ -7,9 +7,9 @@ class MySimpleClass
}
func useMySimpleClass(simple: MySimpleClass) {
_ = simple.source1 // SOURCE
_ = simple.source2 // SOURCE
_ = simple.source3() // SOURCE
_ = simple.source1 // $ source=remote
_ = simple.source2 // $ source=remote
_ = simple.source3() // $ source=remote
}
// ---
@@ -45,28 +45,28 @@ extension MyDerived2
}
func useDerived(generic: MyGeneric<Int>, generic2: MyGeneric<Any>, derived: MyDerived<Int>, derived2: MyDerived2) {
_ = generic.source1 // SOURCE
_ = generic.source2 // SOURCE
_ = generic.source3() // SOURCE
_ = generic2.source1 // SOURCE
_ = generic2.source2 // SOURCE
_ = generic2.source3() // SOURCE
_ = derived.source1 // SOURCE
_ = derived.source2 // SOURCE
_ = derived.source3() // SOURCE
_ = derived.source4 // SOURCE
_ = derived.source5 // SOURCE
_ = derived.source6() // SOURCE
_ = derived.source7 // SOURCE
_ = derived.source8() // SOURCE
_ = derived2.source1 // SOURCE
_ = derived2.source2 // SOURCE
_ = derived2.source3() // SOURCE
_ = derived2.source9 // SOURCE
_ = derived2.source10 // SOURCE
_ = derived2.source11() // SOURCE
_ = derived2.source12 // SOURCE
_ = derived2.source13() // SOURCE
_ = generic.source1 // $ source=remote
_ = generic.source2 // $ source=remote
_ = generic.source3() // $ source=remote
_ = generic2.source1 // $ source=remote
_ = generic2.source2 // $ source=remote
_ = generic2.source3() // $ source=remote
_ = derived.source1 // $ source=remote
_ = derived.source2 // $ source=remote
_ = derived.source3() // $ source=remote
_ = derived.source4 // $ source=remote
_ = derived.source5 // $ source=remote
_ = derived.source6() // $ source=remote
_ = derived.source7 // $ source=remote
_ = derived.source8() // $ source=remote
_ = derived2.source1 // $ source=remote
_ = derived2.source2 // $ source=remote
_ = derived2.source3() // $ source=remote
_ = derived2.source9 // $ source=remote
_ = derived2.source10 // $ source=remote
_ = derived2.source11() // $ source=remote
_ = derived2.source12 // $ source=remote
_ = derived2.source13() // $ source=remote
}
// ---
@@ -90,15 +90,15 @@ extension MyImpl {
}
func useProtocol(proto: MyProtocol, impl: MyImpl<Int>, impl2: MyImpl<Any>) {
_ = proto.source0 // SOURCE
_ = proto.source1 // SOURCE
_ = proto.source2 // SOURCE
_ = impl.source0 // SOURCE
_ = impl.source1 // SOURCE
_ = impl.source2 // SOURCE
_ = impl2.source0 // SOURCE
_ = impl2.source1 // SOURCE
_ = impl2.source2 // SOURCE
_ = proto.source0 // $ source=remote
_ = proto.source1 // $ source=remote
_ = proto.source2 // $ source=remote
_ = impl.source0 // $ source=remote
_ = impl.source1 // $ source=remote
_ = impl.source2 // $ source=remote
_ = impl2.source0 // $ source=remote
_ = impl2.source1 // $ source=remote
_ = impl2.source2 // $ source=remote
}
// ---
@@ -122,15 +122,15 @@ extension MyImpl2 : MyProtocol2 {
}
func useProtocol2(proto: MyProtocol2, impl: MyImpl2<Int>, impl2: MyImpl2<Any>) {
_ = proto.source0 // SOURCE
_ = proto.source1 // SOURCE
_ = proto.source2 // SOURCE
_ = impl.source0 // SOURCE
_ = impl.source1 // SOURCE
_ = impl.source2 // SOURCE
_ = impl2.source0 // SOURCE
_ = impl2.source1 // SOURCE
_ = impl2.source2 // SOURCE
_ = proto.source0 // $ source=remote
_ = proto.source1 // $ source=remote
_ = proto.source2 // $ source=remote
_ = impl.source0 // $ source=remote
_ = impl.source1 // $ source=remote
_ = impl.source2 // $ source=remote
_ = impl2.source0 // $ source=remote
_ = impl2.source1 // $ source=remote
_ = impl2.source2 // $ source=remote
}
// ---
@@ -159,6 +159,6 @@ class MyChildClass3: MyClass3 {
func useProtocol3(impl: MyChildClass3) {
_ = impl.source1() // not a source (`MyProtocol3.source1` is the declared source and `MyParentClass3` doesn't extend it)
_ = impl.source2() // SOURCE
_ = impl.source3() // SOURCE
_ = impl.source2() // $ source=remote
_ = impl.source3() // $ source=remote
}

4
swift/ql/test/library-tests/dataflow/flowsources/nsdata.swift
View File

@@ -15,6 +15,6 @@ class NSData {
func testNSData() {
let url = URL(string: "http://example.com/")
let _ = try NSData(contentsOf: url!) // SOURCE
let _ = try NSData(contentsOf: url!, options: []) // SOURCE
let _ = try NSData(contentsOf: url!) // $ source=remote
let _ = try NSData(contentsOf: url!, options: []) // $ source=remote
}

12
swift/ql/test/library-tests/dataflow/flowsources/string.swift
View File

@@ -53,15 +53,15 @@ func testStrings() {
let string2 = String(repeating: "abc", count: 10)
let url = URL(string: "http://example.com/")
let string3 = try String(contentsOf: url!) // SOURCE
let string4 = try String(contentsOf: url!, encoding: String.Encoding.ascii) // SOURCE
let string3 = try String(contentsOf: url!) // $ source=remote
let string4 = try String(contentsOf: url!, encoding: String.Encoding.ascii) // $ source=remote
var encoding = String.Encoding.ascii
let string5 = try String(contentsOf: url!, usedEncoding: &encoding) // SOURCE
let string5 = try String(contentsOf: url!, usedEncoding: &encoding) // $ source=remote
let path = "file.txt"
let string6 = try String(contentsOfFile: path) // SOURCE
let string7 = try String(contentsOfFile: path, encoding: String.Encoding.ascii) // SOURCE
let string8 = try String(contentsOfFile: path, usedEncoding: &encoding) // SOURCE
let string6 = try String(contentsOfFile: path) // $ source=local
let string7 = try String(contentsOfFile: path, encoding: String.Encoding.ascii) // $ source=local
let string8 = try String(contentsOfFile: path, usedEncoding: &encoding) // $ source=local
} catch {
// ...
}

6
swift/ql/test/library-tests/dataflow/flowsources/url.swift
View File

@@ -50,21 +50,21 @@ func testURLs() async {
do
{
let url = URL(string: "http://example.com/")!
let bytes = url.resourceBytes // SOURCE
let bytes = url.resourceBytes // $ source=remote
for try await byte in bytes
{
print(byte)
}
let lines = url.lines // SOURCE
let lines = url.lines // $ source=remote
for try await line in lines
{
print(line)
}
let lines2 = bytes.lines // SOURCE
let lines2 = bytes.lines // $ source=remote
for try await line in lines2
{

27
swift/ql/test/library-tests/dataflow/flowsources/webview.swift
View File

@@ -10,8 +10,8 @@ protocol WKScriptMessageHandler {
}
protocol WKNavigationDelegate {
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, preferences: WKWebpagePreferences, decisionHandler: (WKNavigationActionPolicy, WKWebpagePreferences) -> Void)
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, decisionHandler: (WKNavigationActionPolicy) -> Void)
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, preferences: WKWebpagePreferences, decisionHandler: (WKNavigationActionPolicy, WKWebpagePreferences) -> Void) // $ SPURIOUS?: source=remote
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, decisionHandler: (WKNavigationActionPolicy) -> Void) // $ SPURIOUS?: source=remote
}
class WKWebView {}
@@ -30,21 +30,22 @@ class JSValue {}
class JSContext {
var globalObject: JSValue { get { return JSValue() } }
func objectForKeyedSubscript(_: Any!) -> JSValue! { return JSValue() }
func objectForKeyedSubscript(_: Any!) -> JSValue! { return JSValue() }
func setObject(_: Any, forKeyedSubscript: (NSCopying & NSObjectProtocol) ) {}
}
protocol JSExport {}
// --- tests ---
class TestMessageHandler: WKScriptMessageHandler {
func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) { // SOURCE
func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) { // $ source=remote
}
}
func testJsContext(context: JSContext) {
context.globalObject // SOURCE
context.objectForKeyedSubscript("") // SOURCE
context.globalObject // $ source=remote
context.objectForKeyedSubscript("") // $ source=remote
}
protocol Exported : JSExport {
@@ -57,25 +58,25 @@ class ExportedImpl : Exported {
var notTainted: Any { get { return ""} }
func readFields() {
tainted // SOURCE
tainted // $ source=remote
notTainted
}
func tainted(arg1: Any, arg2: Any) { // SOURCES
func tainted(arg1: Any, arg2: Any) { // $ source=remote
}
func notTainted(arg1: Any, arg2: Any) {
}
}
}
class WebViewDelegate : WKNavigationDelegate {
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, preferences: WKWebpagePreferences, decisionHandler: (WKNavigationActionPolicy, WKWebpagePreferences) -> Void) {} // SOURCE
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, decisionHandler: (WKNavigationActionPolicy) -> Void) {} // SOURCE
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, preferences: WKWebpagePreferences, decisionHandler: (WKNavigationActionPolicy, WKWebpagePreferences) -> Void) {} // $ source=remote
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, decisionHandler: (WKNavigationActionPolicy) -> Void) {} // $ source=remote
}
class Extended {}
extension Extended : WKNavigationDelegate {
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, preferences: WKWebpagePreferences, decisionHandler: (WKNavigationActionPolicy, WKWebpagePreferences) -> Void) {} // SOURCE
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, decisionHandler: (WKNavigationActionPolicy) -> Void) {} // SOURCE
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, preferences: WKWebpagePreferences, decisionHandler: (WKNavigationActionPolicy, WKWebpagePreferences) -> Void) {} // $ source=remote
func webView(_: WKWebView, decidePolicyFor: WKNavigationAction, decisionHandler: (WKNavigationActionPolicy) -> Void) {} // $ source=remote
}