Mathias Vorreiter Pedersen
f2767eb03a
Merge pull request #9972 from MathiasVP/swift-taint-through-interpolated-strings
...
Swift: Taint through interpolated strings
2022-08-05 15:55:35 +01:00
Robert Marsh
10710e27df
Merge pull request #9978 from MathiasVP/swift-fix-mad
...
Swift: Fix flow summaries for methods
2022-08-05 09:53:16 -04:00
Mathias Vorreiter Pedersen
6cfeb24d94
Swift: More comments.
2022-08-05 13:30:45 +01:00
Mathias Vorreiter Pedersen
46ec7a9b82
Swift: Add the InlineExpectationsTest framework.
2022-08-05 11:49:15 +01:00
Mathias Vorreiter Pedersen
69564d2192
Swift: Add a couple of standard Comment subclasses.
2022-08-05 11:48:29 +01:00
Mathias Vorreiter Pedersen
946b8c68a6
Swift: Accept test changes.
2022-08-05 11:19:00 +01:00
Mathias Vorreiter Pedersen
a302570349
Merge branch 'main' into swift-taint-through-interpolated-strings
2022-08-05 11:17:54 +01:00
Mathias Vorreiter Pedersen
24c9ab8015
Swift: Fix MaD for methods
2022-08-05 10:52:28 +01:00
Alex Denisov
5e69adb0a9
Swift: extract comments
2022-08-05 11:50:48 +02:00
Mathias Vorreiter Pedersen
1c8090fa04
Merge pull request #9964 from geoffw0/cwe95
...
Swift: Query for CWE-79 / CWE-95
2022-08-05 10:38:33 +01:00
Geoffrey White
1ce06accbd
Swift: Fix capitalization issue?
2022-08-05 10:20:51 +01:00
Mathias Vorreiter Pedersen
ac26371de0
Merge pull request #9909 from geoffw0/stringlengthconflation6
...
Swift: Understand String.utf8.count etc in the string length conflation CVE query
2022-08-05 10:13:25 +01:00
Anders Schack-Mulligen
3d47875b60
Dataflow: Generate shorter RA/DIL names.
2022-08-05 11:00:56 +02:00
Anders Schack-Mulligen
d3dcc3ce3a
Dataflow: Sync.
2022-08-05 11:00:56 +02:00
Mathias Vorreiter Pedersen
2f13c65ad7
Update swift/ql/lib/codeql/swift/controlflow/internal/ControlFlowGraphImpl.qll
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-08-04 22:45:45 +01:00
Mathias Vorreiter Pedersen
05e6dd85d4
Swift: Add taint tests for flow through interpolated strings.
2022-08-04 21:57:05 +01:00
Mathias Vorreiter Pedersen
9c48ce1bf2
Swift: Flow (1) through the internal function calls generated by the compiler during string interpolation, and (2) out of the internal 'TapExpr' and into the interpolated string result.
2022-08-04 21:57:05 +01:00
Mathias Vorreiter Pedersen
52b78b6e68
Swift: Don't assume we know the call target statically in 'TInOutUpdateNode'.
2022-08-04 21:57:04 +01:00
Mathias Vorreiter Pedersen
ff6b8c5c9c
Swift: Replace 'CallExpr' with 'ApplyExpr'. This is needed because not all the calls inside the interpolated string computations are 'CallExpr's.
2022-08-04 21:57:04 +01:00
Mathias Vorreiter Pedersen
3028b80e46
Swift: Control-flow through interpolated strings.
2022-08-04 21:57:04 +01:00
Geoffrey White
997068a9cb
Swift: Fix a suggestion merge conflict.
2022-08-03 18:16:31 +01:00
Geoffrey White
873c62ef78
Swift: Apply another code review suggestion.
2022-08-03 18:16:01 +01:00
Geoffrey White
e4dab17318
Apply suggestions from code review
...
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com >
2022-08-03 18:14:14 +01:00
Geoffrey White
9d49986345
Swift: Make QL-for-QL happy.
2022-08-03 17:18:57 +01:00
Geoffrey White
39f1352847
Swift: Complete the rename.
2022-08-03 14:45:20 +01:00
Geoffrey White
81bd61288c
Swift: I think CWE-079 is the more accurate CWE for this query.
2022-08-03 14:45:19 +01:00
Geoffrey White
c635895644
Swift: Documentation.
2022-08-03 14:45:18 +01:00
Mathias Vorreiter Pedersen
be7ba925f9
Swift: Cache 'lastRefRedef'.
2022-08-03 11:14:55 +01:00
Geoffrey White
8d9653a999
Swift: Generated security-severity tag.
2022-08-03 09:54:54 +01:00
Geoffrey White
ea17b852b4
Swift: Explain ExternalRemoteFlowSource.
2022-08-03 09:42:51 +01:00
Geoffrey White
651b73e21e
Swift: Check for tainted baseURL.
2022-08-03 09:42:48 +01:00
Geoffrey White
53ea65b045
Swift: Implement query.
2022-08-03 09:41:28 +01:00
Geoffrey White
2d76d6d51a
Swift: Tests for CWE-95.
2022-08-03 09:36:22 +01:00
Geoffrey White
bada5bf7c1
Swift: Placeholder query + docs for CWE-95.
2022-08-02 10:47:06 +01:00
Mathias Vorreiter Pedersen
e29676af72
Swift: Add 'TaintTracking.qll'.
2022-08-01 16:48:02 +01:00
AlexDenisov
b5d4a2d462
Merge pull request #9926 from github/redsun82/swift-extract-module-type
...
Swift: extract `ModuleType`
2022-08-01 10:33:33 +02:00
Paolo Tranquilli
4ce100f9a3
Swift: append clang module names in trap keys
...
We have found out there can be separate declarations (`VarDecl` or
`AccessorDecl`) which are effectively the same (with equal mangled name)
but come from different clang modules. This is the case for example
for glibc constants like `L_SET` that appear in both `SwiftGlibc` and
`CDispatch`.
In this patch, we simply avoid full deduplication in that case by
appending the module name to the trap key for non-swift modules.
A more solid solution should be found in the future.
2022-07-29 16:56:51 +02:00
Paolo Tranquilli
45e14c96f2
Swift: extract ModuleType
2022-07-29 16:48:45 +02:00
Paolo Tranquilli
daf1fa3c31
Swift: lock built swiftmodule traps in main
...
This should cover `-merge-modules` mode.
Dumping of the configuration to the target files was moved to a
separate pair of header/source files, as now it is also done in
`SwiftOutputRewrite.cpp`.
2022-07-29 16:27:55 +02:00
Paolo Tranquilli
405d0fcd54
Merge branch 'main' into redsun82/swift-precompiled-modules-are-not-extracted
2022-07-29 15:57:52 +02:00
AlexDenisov
48e93b3654
Merge pull request #9925 from github/alexdenisov/pcm-var-dedup
...
Swift: do not deduplicate PCM variables (as the mangler crashes there sometimes)
2022-07-29 14:30:41 +02:00
AlexDenisov
22c5b7af4f
Merge pull request #9921 from github/alexdenisov/type-alias-mangling
...
Swift: mangle TypeAliasDecls differently
2022-07-29 14:30:28 +02:00
Alex Denisov
34edb2537f
Swift: mangle TypeAliasDecls differently
2022-07-29 14:12:02 +02:00
Alex Denisov
5b1fe56d5f
Swift: do not deduplicate PCM variables (as the mangler crashes there sometimes)
2022-07-29 14:06:18 +02:00
Paolo Tranquilli
099ab0e0c2
Swift: readd .trap suffix to swiftmodule trap files
2022-07-29 12:26:33 +02:00
Paolo Tranquilli
604328ea5f
Swift: strip suffix from swiftmodule trap files
2022-07-29 12:25:11 +02:00
Paolo Tranquilli
652230d021
Merge branch 'main' into redsun82/swift-precompiled-modules-are-not-extracted
2022-07-29 12:21:15 +02:00
Paolo Tranquilli
065fecc57e
Swift: extract precompiled swiftmodule files
...
Previously we were not extracting any `swiftmodule` file that was not
a system or a built-in one. This was done to avoid re-extracting
`swiftmodule` files that were built previously in the same build, but it
turned out to be too eager, as there are legitimate cases where a
non-system, non-built-in precompiled swift module can be used. An
example of that is the `PackageDescription` module used in Swift
Package Manager manifest files (`Package.swift`).
We now relax the test and trigger module extraction on all loaded
modules that do not have source files (we trigger source file extraction
for those). The catch, is that we also create empty trap files for
current output `swiftmodule` files (including possible alias locations
set up by XCode).
This means that if a following extractor run loads a previously built
`swiftmodule` file, although it will trigger module extraction, this
will however be skipped as it will find its target file already present
(this is done via the `TargetFile` semantics).
2022-07-29 11:10:03 +02:00
Alex Denisov
50e1ffda64
Swift: put all the PCM traps into the same place
2022-07-29 10:19:13 +02:00
Paolo Tranquilli
985237ab2d
Swift: small dispatcher fixes
...
File extraction was not using named trap keys, and `emitDebugInfo` was
using `std::forward` when it should not.
2022-07-28 17:05:52 +02:00
