hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Rewrite CleartextStoragePreferences to use DataFlow::ConfigSig

Browse Source
This commit is contained in:
Jeroen Ketema
2023-04-03 16:37:51 +02:00
parent a45f381ab9
commit e8bfb87f67
2 changed files with 33 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
swift/ql/lib/codeql/swift/security/CleartextStoragePreferencesQuery.qll
View File

@@ -13,7 +13,7 @@ import codeql.swift.security.CleartextStoragePreferencesExtensions
* A taint configuration from sensitive information to expressions that are
* stored as preferences.
*/
class CleartextStorageConfig extends TaintTracking::Configuration {
deprecated class CleartextStorageConfig extends TaintTracking::Configuration {
CleartextStorageConfig() { this = "CleartextStorageConfig" }
override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
@@ -33,3 +33,32 @@ class CleartextStorageConfig extends TaintTracking::Configuration {
this.isSource(node)
}
}
/**
* A taint configuration from sensitive information to expressions that are
* stored as preferences.
*/
module CleartextStorageConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
predicate isSink(DataFlow::Node node) { node instanceof CleartextStoragePreferencesSink }
predicate isBarrier(DataFlow::Node sanitizer) {
sanitizer instanceof CleartextStoragePreferencesSanitizer
}
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
any(CleartextStoragePreferencesAdditionalTaintStep s).step(nodeFrom, nodeTo)
}
predicate isBarrierIn(DataFlow::Node node) {
// make sources barriers so that we only report the closest instance
isSource(node)
}
}
/**
* Detect taint flow of sensitive information to expressions that are stored
* as preferences.
*/
module CleartextStorageFlow = TaintTracking::Global<CleartextStorageConfig>;

6
swift/ql/src/queries/Security/CWE-312/CleartextStoragePreferences.ql
View File

@@ -13,7 +13,7 @@
import swift
import codeql.swift.dataflow.DataFlow
import codeql.swift.security.CleartextStoragePreferencesQuery
import DataFlow::PathGraph
import CleartextStorageFlow::PathGraph
/**
* Gets a prettier node to use in the results.
@@ -26,10 +26,10 @@ DataFlow::Node cleanupNode(DataFlow::Node n) {
}
from
CleartextStorageConfig config, DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode,
CleartextStorageFlow::PathNode sourceNode, CleartextStorageFlow::PathNode sinkNode,
DataFlow::Node cleanSink
where
config.hasFlowPath(sourceNode, sinkNode) and
CleartextStorageFlow::flowPath(sourceNode, sinkNode) and
cleanSink = cleanupNode(sinkNode.getNode())
select cleanSink, sourceNode, sinkNode,
"This operation stores '" + cleanSink.toString() + "' in " +