Commit Graph

4438 Commits

Author SHA1 Message Date
Mathias Vorreiter Pedersen
05e6dd85d4 Swift: Add taint tests for flow through interpolated strings. 2022-08-04 21:57:05 +01:00
Mathias Vorreiter Pedersen
9c48ce1bf2 Swift: Flow (1) through the internal function calls generated by the compiler during string interpolation, and (2) out of the internal 'TapExpr' and into the interpolated string result. 2022-08-04 21:57:05 +01:00
Mathias Vorreiter Pedersen
52b78b6e68 Swift: Don't assume we know the call target statically in 'TInOutUpdateNode'. 2022-08-04 21:57:04 +01:00
Mathias Vorreiter Pedersen
ff6b8c5c9c Swift: Replace 'CallExpr' with 'ApplyExpr'. This is needed because not all the calls inside the interpolated string computations are 'CallExpr's. 2022-08-04 21:57:04 +01:00
Mathias Vorreiter Pedersen
3028b80e46 Swift: Control-flow through interpolated strings. 2022-08-04 21:57:04 +01:00
Geoffrey White
997068a9cb Swift: Fix a suggestion merge conflict. 2022-08-03 18:16:31 +01:00
Geoffrey White
873c62ef78 Swift: Apply another code review suggestion. 2022-08-03 18:16:01 +01:00
Geoffrey White
e4dab17318 Apply suggestions from code review
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
2022-08-03 18:14:14 +01:00
Geoffrey White
9d49986345 Swift: Make QL-for-QL happy. 2022-08-03 17:18:57 +01:00
Geoffrey White
39f1352847 Swift: Complete the rename. 2022-08-03 14:45:20 +01:00
Geoffrey White
81bd61288c Swift: I think CWE-079 is the more accurate CWE for this query. 2022-08-03 14:45:19 +01:00
Geoffrey White
c635895644 Swift: Documentation. 2022-08-03 14:45:18 +01:00
Mathias Vorreiter Pedersen
be7ba925f9 Swift: Cache 'lastRefRedef'. 2022-08-03 11:14:55 +01:00
Geoffrey White
8d9653a999 Swift: Generated security-severity tag. 2022-08-03 09:54:54 +01:00
Geoffrey White
ea17b852b4 Swift: Explain ExternalRemoteFlowSource. 2022-08-03 09:42:51 +01:00
Geoffrey White
651b73e21e Swift: Check for tainted baseURL. 2022-08-03 09:42:48 +01:00
Geoffrey White
53ea65b045 Swift: Implement query. 2022-08-03 09:41:28 +01:00
Geoffrey White
2d76d6d51a Swift: Tests for CWE-95. 2022-08-03 09:36:22 +01:00
Geoffrey White
bada5bf7c1 Swift: Placeholder query + docs for CWE-95. 2022-08-02 10:47:06 +01:00
Mathias Vorreiter Pedersen
e29676af72 Swift: Add 'TaintTracking.qll'. 2022-08-01 16:48:02 +01:00
AlexDenisov
b5d4a2d462 Merge pull request #9926 from github/redsun82/swift-extract-module-type
Swift: extract `ModuleType`
2022-08-01 10:33:33 +02:00
Paolo Tranquilli
4ce100f9a3 Swift: append clang module names in trap keys
We have found out there can be separate declarations (`VarDecl` or
`AccessorDecl`) which are effectively the same (with equal mangled name)
but come from different clang modules. This is the case for example
for glibc constants like `L_SET` that appear in both `SwiftGlibc` and
`CDispatch`.

In this patch, we simply avoid full deduplication in that case by
appending the module name to the trap key for non-swift modules.

A more solid solution should be found in the future.
2022-07-29 16:56:51 +02:00
Paolo Tranquilli
45e14c96f2 Swift: extract ModuleType 2022-07-29 16:48:45 +02:00
Paolo Tranquilli
daf1fa3c31 Swift: lock built swiftmodule traps in main
This should cover `-merge-modules` mode.

Dumping of the configuration to the target files was moved to a
separate pair of header/source files, as now it is also done in
`SwiftOutputRewrite.cpp`.
2022-07-29 16:27:55 +02:00
Paolo Tranquilli
405d0fcd54 Merge branch 'main' into redsun82/swift-precompiled-modules-are-not-extracted 2022-07-29 15:57:52 +02:00
AlexDenisov
48e93b3654 Merge pull request #9925 from github/alexdenisov/pcm-var-dedup
Swift: do not deduplicate PCM variables (as the mangler crashes there sometimes)
2022-07-29 14:30:41 +02:00
AlexDenisov
22c5b7af4f Merge pull request #9921 from github/alexdenisov/type-alias-mangling
Swift: mangle TypeAliasDecls differently
2022-07-29 14:30:28 +02:00
Alex Denisov
34edb2537f Swift: mangle TypeAliasDecls differently 2022-07-29 14:12:02 +02:00
Alex Denisov
5b1fe56d5f Swift: do not deduplicate PCM variables (as the mangler crashes there sometimes) 2022-07-29 14:06:18 +02:00
Paolo Tranquilli
099ab0e0c2 Swift: readd .trap suffix to swiftmodule trap files 2022-07-29 12:26:33 +02:00
Paolo Tranquilli
604328ea5f Swift: strip suffix from swiftmodule trap files 2022-07-29 12:25:11 +02:00
Paolo Tranquilli
652230d021 Merge branch 'main' into redsun82/swift-precompiled-modules-are-not-extracted 2022-07-29 12:21:15 +02:00
Paolo Tranquilli
065fecc57e Swift: extract precompiled swiftmodule files
Previously we were not extracting any `swiftmodule` file that was not
a system or a built-in one. This was done to avoid re-extracting
`swiftmodule` files that were built previously in the same build, but it
turned out to be too eager, as there are legitimate cases where a
non-system, non-built-in precompiled swift module can be used. An
example of that is the `PackageDescription` module used in Swift
Package Manager manifest files (`Package.swift`).

We now relax the test and trigger module extraction on all loaded
modules that do not have source files (we trigger source file extraction
for those). The catch, is that we also create empty trap files for
current output `swiftmodule` files (including possible alias locations
set up by XCode).

This means that if a following extractor run loads a previously built
`swiftmodule` file, although it will trigger module extraction, this
will however be skipped as it will find its target file already present
(this is done via the `TargetFile` semantics).
2022-07-29 11:10:03 +02:00
Alex Denisov
50e1ffda64 Swift: put all the PCM traps into the same place 2022-07-29 10:19:13 +02:00
Paolo Tranquilli
985237ab2d Swift: small dispatcher fixes
File extraction was not using named trap keys, and `emitDebugInfo` was
using `std::forward` when it should not.
2022-07-28 17:05:52 +02:00
Paolo Tranquilli
8a36a2b563 Merge pull request #9912 from github/redsun82/swift-human-readable-trap-prefixes
Swift: make trap key prefixes readable
2022-07-28 14:34:57 +02:00
Paolo Tranquilli
d547a417c9 Swift: accept new test results 2022-07-28 12:57:12 +02:00
Paolo Tranquilli
cb006900cd Merge branch 'main' into redsun82/swift-deduplicate-vardecls 2022-07-28 12:55:31 +02:00
Paolo Tranquilli
7d7966e711 Swift: make trap key prefixes readable
This replaces numeric tag-based prefixes with the actual tag name.
While this means in general slightly larger trap files, it aids
debugging them for a human.

In the future we can make this conditional on some kind of trap debug
option, but for the moment it does not seem detrimental.
2022-07-28 12:43:30 +02:00
Paolo Tranquilli
b491884996 Merge pull request #9910 from github/redsun82/swift-no-cleanup-on-integration-tests
Swift: add `--no-cleanup` to integration tests
2022-07-28 12:41:53 +02:00
Paolo Tranquilli
76ea63ffbe Swift: deduplicate VarDecl
Deduplication of `ConcreteVarDecl` is triggered only if its
`DeclContext` is not local. This avoids a mangled name conflict.

Also added more thourough tests for `ConcreteVarDecl` and `ParamDecl`.
2022-07-28 12:28:52 +02:00
Paolo Tranquilli
ab1370cc8f Swift: add --no-cleanup to integration tests 2022-07-28 11:19:45 +02:00
Geoffrey White
6cd6f74be9 Swift: Repair predicate lost in merge. 2022-07-28 10:13:04 +01:00
Geoffrey White
72fd7179f6 Merge branch 'main' into stringlengthconflation6 2022-07-28 10:01:28 +01:00
Geoffrey White
e5342867c6 Swift: Add a note to the qhelp. 2022-07-28 09:52:33 +01:00
Paolo Tranquilli
457ce3d884 Swift: fix derived IPA type properties
Also rename `IpaTypes.qll` to `Ipa.qll`
2022-07-28 10:26:11 +02:00
Paolo Tranquilli
f81abe40c4 Swift: disambuigate Cfg test order 2022-07-28 10:26:11 +02:00
Paolo Tranquilli
18b9a2fa6e Swift: accept tests 2022-07-28 10:26:11 +02:00
Paolo Tranquilli
95df751425 Swift: new toString for ExprPattern 2022-07-28 10:26:11 +02:00
Paolo Tranquilli
954047c6ab Swift: accept test changes 2022-07-28 10:26:11 +02:00