hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Split off WeakPasswordHashingExtensions.qll as we normally do.

Browse Source
This commit is contained in:
Geoffrey White
2023-12-06 11:15:43 +00:00
parent db1508d108
commit e5bf929cdb
2 changed files with 37 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
swift/ql/lib/codeql/swift/security/WeakPasswordHashingExtensions.qll Normal file
View File

@@ -0,0 +1,36 @@
/**
* Provides classes and predicates for reasoning about use of inappropriate
* cryptographic hashing algorithms on passwords.
*/
import swift
import codeql.swift.security.SensitiveExprs
import codeql.swift.dataflow.DataFlow
import codeql.swift.dataflow.TaintTracking
class WeakPasswordHashingSink extends DataFlow::Node {
string algorithm;
WeakPasswordHashingSink() {
// a call to System.Security.Cryptography.MD5/SHA*.ComputeHash/ComputeHashAsync/HashData/HashDataAsync
exists(MethodCall call, string name |
(
call.getTarget().getName() = name
and name in ["ComputeHash", "ComputeHashAsync", "HashData", "HashDataAsync"]
)
// with this as the first argument - not arg 0, since arg 0 is 'this' for methods
and call.getArgument(0) = this.asExpr()
and
// the call is to a method in the System.Security.Cryptography.MD* class
// or the System.Security.Cryptography.SHA* classes
(
call.getQualifier().getType().getName() = algorithm
and algorithm.matches(["MD%","SHA%"])
)
)
}
string getAlgorithm() {
result = algorithm
}
}

29
swift/ql/lib/codeql/swift/security/WeakPasswordHashingQuery.qll
View File

@@ -7,6 +7,7 @@ import swift
import codeql.swift.security.SensitiveExprs
import codeql.swift.dataflow.DataFlow
import codeql.swift.dataflow.TaintTracking
import codeql.swift.security.WeakPasswordHashingExtensions
/**
* A taint tracking configuration from password expressions to inappropriate
@@ -29,31 +30,3 @@ module WeakHashingPasswordConfig implements DataFlow::ConfigSig {
}
module WeakHashingFlow = TaintTracking::Global<WeakHashingPasswordConfig>;
// TODO: rewrite with data extensions in mind, ref the Swift implementation
class WeakPasswordHashingSink extends DataFlow::Node {
string algorithm;
WeakPasswordHashingSink() {
// a call to System.Security.Cryptography.MD5/SHA*.ComputeHash/ComputeHashAsync/HashData/HashDataAsync
exists(MethodCall call, string name |
(
call.getTarget().getName() = name
and name in ["ComputeHash", "ComputeHashAsync", "HashData", "HashDataAsync"]
)
// with this as the first argument - not arg 0, since arg 0 is 'this' for methods
and call.getArgument(0) = this.asExpr()
and
// the call is to a method in the System.Security.Cryptography.MD* class
// or the System.Security.Cryptography.SHA* classes
(
call.getQualifier().getType().getName() = algorithm
and algorithm.matches(["MD%","SHA%"])
)
)
}
string getAlgorithm() {
result = algorithm
}
}