Commit Graph

4437 Commits

Author SHA1 Message Date
Geoffrey White
0d7769f687 Merge pull request #13276 from geoffw0/sqlpathinject
Swift: Add path injection sinks for sqlite3 and SQLite.swift
2023-09-12 17:36:27 +01:00
Geoffrey White
7e962dc764 Swift: Accept fixed test cases. 2023-09-12 17:18:29 +01:00
Robert Marsh
c2868fe05a Swift: change note for keypath write dataflow 2023-09-12 15:53:50 +00:00
Robert Marsh
47ac54bb81 Swift: autoformat DataFlowPrivate 2023-09-12 15:52:53 +00:00
Robert Marsh
8f797c7189 Merge branch 'main' into rdmarsh2/swift/keypath-write-flow 2023-09-12 15:51:36 +00:00
Alex Denisov
743fd902a1 Swift: fix CFG for identity expressions (await, dot_self, parent) 2023-09-12 16:04:45 +02:00
Geoffrey White
d65f2b4fa9 Swift: Change note. 2023-09-12 14:36:37 +01:00
Geoffrey White
ae0fcf791b Swift: Expand the additional taint step from the cleartext storage database query to the other sensitive data queries. 2023-09-11 22:25:17 +01:00
Geoffrey White
aa5820c061 Swift: Add some test cases. 2023-09-11 19:33:37 +01:00
Geoffrey White
e038f60640 Swift: Convert some sinks to CSV. 2023-09-11 14:54:32 +01:00
Geoffrey White
7d05446483 Swift: Formatting. 2023-09-11 14:11:11 +01:00
Geoffrey White
1cde183005 Merge branch 'main' into logfix 2023-09-11 13:14:58 +01:00
Geoffrey White
3fd5de83cb Merge branch 'main' into sqlpathinject 2023-09-11 12:42:49 +01:00
Geoffrey White
fc69be4df9 Merge branch 'main' into quicktest 2023-09-11 12:25:38 +01:00
github-actions[bot]
d699880c86 Post-release preparation for codeql-cli-2.14.4 2023-09-08 21:17:52 +00:00
Robert Marsh
988a871999 Swift: add flow through for-in loops 2023-09-08 20:00:27 +00:00
Robert Marsh
a3e250aef5 Swift: extract iterator variable for for-in loops 2023-09-08 19:08:57 +00:00
Robert Marsh
50d23f145b merge main into for-in getnextcall branch 2023-09-08 15:51:27 +00:00
Robert Marsh
161e5a4ca2 Merge branch 'main' into rdmarsh2/swift/keypath-write-flow 2023-09-08 15:39:06 +00:00
Robert Marsh
1082b1d4d1 Swift: use PostUpdateNodeImpl for more postupdate nodes 2023-09-08 15:19:46 +00:00
Robert Marsh
0d79158bb1 Swift: remove TODOs after deciding not to do them 2023-09-07 20:15:12 +00:00
Robert Marsh
603f2cd3b2 Swift: fix test expectation properly 2023-09-07 19:35:02 +00:00
Robert Marsh
0fff540add Swift: update a test expectation for dictionary flow 2023-09-07 16:14:23 +00:00
Robert Marsh
4f4491a876 Swift: autoformat 2023-09-07 16:14:05 +00:00
Robert Marsh
5fe942e642 Swift: flow through writeable keypaths 2023-09-07 15:56:44 +00:00
Robert Marsh
5bdd9597d2 Merge branch 'main' into rdmarsh2/swift/dictionary-flow-tuples 2023-09-06 14:50:16 +00:00
github-actions[bot]
abf2b12b1c Release preparation for version 2.14.4 2023-09-05 16:56:14 +00:00
Alex Denisov
35e949945d Swift: add queries for unresolved AST nodes 2023-09-05 13:29:11 +02:00
AlexDenisov
e2602fbbc4 Merge pull request #14119 from github/alexdenisov/sequence-expr
Swift: fix SequenceExpr extraction
2023-09-04 12:29:07 +02:00
Paolo Tranquilli
7d89028688 Merge pull request #14106 from github/alexdenisov/rename-xcode-autobuilder
Swift: rename autobuilder. NFC
2023-09-04 12:28:47 +02:00
Alex Denisov
888dd786b4 Swift: fix SequenceExpr extraction
Before we extracted all the subexpressions from the `SequenceExpr` while we should've only extracted the expressions at odd indices:
```
...
/// SequenceExpr - A list of binary operations which has not yet been
/// folded into a tree.  The operands all have even indices, while the
/// subexpressions with odd indices are all (potentially overloaded)
/// references to binary operators.
class SequenceExpr final : public Expr,
...
```

The AST for a `SequenceExpr` looks like this:

```
sequence_expr:
  unresolved_dot_expr:
    ...
  assign_expr:
    member_ref_expr:
      ...
    dot_syntax_call_expr:
      ...
  unresolved_member_chain_expr:
    ...
```

however, what's is not visible with the "final" AST is that `unresolved_dot_expr` is the unresolved version of `assign_expr.member_ref_expr` and the `unresolved_member_chain_expr` is the unresolved version of `assign_expr.dot_syntax_call_expr`.
This becomes visible when I enable typechecker debugging:

```c++
auto &typeCheckerOptions = invocation.getTypeCheckerOptions();
typeCheckerOptions.DebugConstraintSolver = true;
```

Which prints the following snippets:

```
---Initial constraints for the given expression---
(assign_expr type='()' location=foo.swift:25:54 range=[foo.swift:25:13 - line:25:57]
  (unresolved_dot_expr type='$T2' location=foo.swift:25:29 range=[foo.swift:25:13 - line:25:29] field 'preferredDatePickerStyle' function_ref=unapplied
    (unresolved_dot_expr type='$T1' location=foo.swift:25:18 range=[foo.swift:25:13 - line:25:18] field 'datePicker' function_ref=unapplied
      (declref_expr type='DatePickerCell' location=foo.swift:25:13 range=[foo.swift:25:13 - line:25:13] decl=foo.(file).DatePickerRowProtocol extension.configurePickerStyle(_:_:).cell@foo.swift:15:33 function_ref=unapplied)))
  (unresolved_member_chain_expr implicit type='$T5' location=foo.swift:25:57 range=[foo.swift:25:56 - line:25:57]
    (unresolved_member_expr type='$T4' location=foo.swift:25:57 range=[foo.swift:25:56 - line:25:57] name='wheels' function_ref=unapplied)))

// ...

---Type-checked expression---
(assign_expr type='()' location=foo.swift:25:54 range=[foo.swift:25:13 - line:25:57]
  (member_ref_expr type='@lvalue UIDatePickerStyle' location=foo.swift:25:29 range=[foo.swift:25:13 - line:25:29] decl=UIKit.(file).UIDatePicker.preferredDatePickerStyle
    (force_value_expr implicit type='UIDatePicker' location=foo.swift:25:18 range=[foo.swift:25:13 - line:25:18] implicit_iuo_unwrap
      (load_expr implicit type='UIDatePicker?' location=foo.swift:25:18 range=[foo.swift:25:13 - line:25:18]
        (member_ref_expr type='@lvalue UIDatePicker?' location=foo.swift:25:18 range=[foo.swift:25:13 - line:25:18] decl=foo.(file).DatePickerCell.datePicker@foo.swift:10:29
          (declref_expr type='DatePickerCell' location=foo.swift:25:13 range=[foo.swift:25:13 - line:25:13] decl=foo.(file).DatePickerRowProtocol extension.configurePickerStyle(_:_:).cell@foo.swift:15:33 function_ref=unapplied)))))
  (dot_syntax_call_expr type='UIDatePickerStyle' location=foo.swift:25:57 range=[foo.swift:25:56 - line:25:57]
    (declref_expr type='(UIDatePickerStyle.Type) -> UIDatePickerStyle' location=foo.swift:25:57 range=[foo.swift:25:57 - line:25:57] decl=UIKit.(file).UIDatePickerStyle.wheels function_ref=unapplied)
    (argument_list implicit
      (argument
        (type_expr implicit type='UIDatePickerStyle.Type' location=foo.swift:25:56 range=[foo.swift:25:56 - line:25:56] typerepr='UIDatePickerStyle')))))
```

The proposed solution is to only extract subexpressions at indices from `SequenceExpr` thus ignoring all the unresolved leftovers.

Note: I'm not entirely sure about the case when there is only child (`elements.size() == 1`) so I'm always extracting it.

This patch fixes the last source of unresolved expressions.
2023-09-04 11:42:12 +02:00
Geoffrey White
0cb00c9091 Swift: Change note. 2023-08-31 15:50:54 +01:00
Geoffrey White
93c39c5fdd Swift: Add data flow through OpenExistentialExpr. 2023-08-31 15:50:32 +01:00
Geoffrey White
b8d29e8fc1 Swift: Add a more realistic test case as well. 2023-08-31 15:46:47 +01:00
Geoffrey White
aeeafd75bf Swift: Add a test for flow through OpenExistentialExpr. 2023-08-31 15:27:18 +01:00
Alex Denisov
c1da2dfa73 Swift: fix autobuild.sh 2023-08-31 09:40:13 +02:00
Alex Denisov
803adae9c6 Swift: rename autobuilder. NFC 2023-08-31 08:12:52 +02:00
Tom Hvitved
9af706c2a5 Swift: Use data flow consistency checks from shared pack 2023-08-30 15:29:41 +02:00
Mathias Vorreiter Pedersen
6a21fa04cd Merge pull request #14034 from geoffw0/hostname
Swift: New query: Incomplete regular expression for hostnames
2023-08-30 11:33:36 +01:00
Geoffrey White
39b45fa24f Merge pull request #13943 from geoffw0/weakhashexample
Swift: Update the weak sensitive data hashing examples and qhelp
2023-08-30 10:36:23 +01:00
Geoffrey White
125629a7e2 Swift: Delete 'usually'. 2023-08-29 23:25:22 +01:00
Geoffrey White
210a5bfff2 Update swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.qhelp
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
2023-08-29 23:24:12 +01:00
Geoffrey White
7006cfd8f8 Swif: Fix paragraph breaks. 2023-08-29 23:00:17 +01:00
Dave Bartolomeo
3343b78015 Merge pull request #14074 from github/post-release-prep/codeql-cli-2.14.3
Post-release preparation for codeql-cli-2.14.3
2023-08-28 13:34:10 -04:00
github-actions[bot]
3eba77421a Post-release preparation for codeql-cli-2.14.3 2023-08-28 15:53:49 +00:00
AlexDenisov
0fe7740dda Merge pull request #14052 from github/sashabu/swift-logging-compiler
Swift: Route compiler diagnostics through our log.
2023-08-25 14:47:24 +02:00
Mathias Vorreiter Pedersen
2fd627b460 Merge pull request #13827 from geoffw0/closuremodels
Swift: Model withUnsafeBytes and similar closure methods
2023-08-25 10:01:52 +01:00
Geoffrey White
415d9e0674 Swift: Address review comments. 2023-08-24 18:41:48 +01:00
Alexandre Boulgakov
7e05551f16 Swift: Check whether a SourceLoc is valid before using it. 2023-08-24 18:14:34 +01:00
Geoffrey White
242a49e6f1 Apply suggestions from code review
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
2023-08-24 17:19:01 +01:00