hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-02 20:30:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Swift: Update the new metatype sinks to not rely on name matching '.Type'.

Browse Source
This commit is contained in:
Geoffrey White
2026-05-28 12:14:10 +01:00
parent 5c2488e304
commit f8ab76e1ba
2 changed files with 32 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
swift/ql/lib/codeql/swift/security/WeakPasswordHashingExtensions.qll
View File

@@ -121,12 +121,23 @@ private class WeakPasswordHashingMetatypeSink extends WeakPasswordHashingSink {
string algorithm;
WeakPasswordHashingMetatypeSink() {
exists(CallExpr c |
c.getAnArgument().getExpr() = this.asExpr() and
exists(CallExpr ce, Type t |
// call target
ce.getStaticTarget().getName() =
["hash(data:)", "hash(bufferPointer:)", "update(data:)", "update(bufferPointer:)"] and
// argument
ce.getAnArgument().getExpr() = this.asExpr() and
// qualifier
t = ce.getQualifier().getType() and
algorithm = ["SHA256", "SHA384", "SHA512"] and
c.getQualifier().getType().getFullName() = algorithm + ["", ".Type"] and
c.getStaticTarget().getName() =
["hash(data:)", "hash(bufferPointer:)", "update(data:)", "update(bufferPointer:)"]
(
t.getFullName() = algorithm
or
exists(TypeDecl td |
td.getInterfaceType() = t and
td.getFullName() = algorithm
)
)
)
}

21
swift/ql/lib/codeql/swift/security/WeakSensitiveDataHashingExtensions.qll
View File

@@ -86,12 +86,23 @@ private class WeakSensitiveDataHashingMetatypeSink extends WeakSensitiveDataHash
string algorithm;
WeakSensitiveDataHashingMetatypeSink() {
exists(CallExpr c |
c.getAnArgument().getExpr() = this.asExpr() and
exists(CallExpr ce, Type t |
// call target
ce.getStaticTarget().getName() =
["hash(data:)", "hash(bufferPointer:)", "update(data:)", "update(bufferPointer:)"] and
// argument
ce.getAnArgument().getExpr() = this.asExpr() and
// qualifier
t = ce.getQualifier().getType() and
algorithm = ["MD5", "SHA1"] and
c.getQualifier().getType().getFullName() = "Insecure." + algorithm + ["", ".Type"] and
c.getStaticTarget().getName() =
["hash(data:)", "hash(bufferPointer:)", "update(data:)", "update(bufferPointer:)"]
(
t.getFullName() = "Insecure." + algorithm
or
exists(TypeDecl td |
td.getInterfaceType() = t and
td.getFullName() = "Insecure." + algorithm
)
)
)
}