From e313fdb3922bbc36c05b84ff18f0e379386fbbbc Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 12 Jun 2023 13:13:40 +0100 Subject: [PATCH 1/2] Swift: Correct a comment in ECBEncryptionQuery.qll. --- swift/ql/lib/codeql/swift/security/ECBEncryptionQuery.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/swift/ql/lib/codeql/swift/security/ECBEncryptionQuery.qll b/swift/ql/lib/codeql/swift/security/ECBEncryptionQuery.qll index 43c2e6cb610c..133e7d6c2cde 100644 --- a/swift/ql/lib/codeql/swift/security/ECBEncryptionQuery.qll +++ b/swift/ql/lib/codeql/swift/security/ECBEncryptionQuery.qll @@ -9,7 +9,7 @@ import codeql.swift.dataflow.TaintTracking import codeql.swift.security.ECBEncryptionExtensions /** - * A taint configuration from a creation of an ECB mode instance to expressions that use + * A data flow configuration from a creation of an ECB mode instance to expressions that use * it to initialize a cipher. */ module EcbEncryptionConfig implements DataFlow::ConfigSig { From 39411b078040c6f38821cfd321c09f30f4a40c8c Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Thu, 6 Jul 2023 12:56:12 +0100 Subject: [PATCH 2/2] Swift: Add some test of taint through 'as'. --- .../library-tests/dataflow/taint/core/LocalTaint.expected | 2 ++ .../test/library-tests/dataflow/taint/core/Taint.expected | 4 ++++ .../ql/test/library-tests/dataflow/taint/core/simple.swift | 7 +++++++ 3 files changed, 13 insertions(+) diff --git a/swift/ql/test/library-tests/dataflow/taint/core/LocalTaint.expected b/swift/ql/test/library-tests/dataflow/taint/core/LocalTaint.expected index 634125549c67..965e47b2d786 100644 --- a/swift/ql/test/library-tests/dataflow/taint/core/LocalTaint.expected +++ b/swift/ql/test/library-tests/dataflow/taint/core/LocalTaint.expected @@ -448,6 +448,8 @@ | simple.swift:146:7:146:7 | self | simple.swift:146:7:146:7 | SSA def(self) | | simple.swift:148:13:148:13 | [post] self | simple.swift:146:2:150:3 | self[return] | | simple.swift:148:13:148:13 | self | simple.swift:146:2:150:3 | self[return] | +| simple.swift:158:12:158:24 | OpaqueValueExpr | simple.swift:158:12:158:24 | OpenExistentialExpr | +| simple.swift:159:12:159:24 | OpaqueValueExpr | simple.swift:159:12:159:24 | OpenExistentialExpr | | stringinterpolation.swift:5:7:5:7 | SSA def(self) | stringinterpolation.swift:5:7:5:7 | self[return] | | stringinterpolation.swift:5:7:5:7 | SSA def(self) | stringinterpolation.swift:5:7:5:7 | self[return] | | stringinterpolation.swift:5:7:5:7 | self | stringinterpolation.swift:5:7:5:7 | SSA def(self) | diff --git a/swift/ql/test/library-tests/dataflow/taint/core/Taint.expected b/swift/ql/test/library-tests/dataflow/taint/core/Taint.expected index 04fcc9d67aaf..00392ecb043f 100644 --- a/swift/ql/test/library-tests/dataflow/taint/core/Taint.expected +++ b/swift/ql/test/library-tests/dataflow/taint/core/Taint.expected @@ -545,6 +545,8 @@ nodes | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... | semmle.label | ... .&>>(_:_:) ... | | simple.swift:87:13:87:21 | call to ~(_:) | semmle.label | call to ~(_:) | | simple.swift:87:14:87:21 | call to source() | semmle.label | call to source() | +| simple.swift:156:12:156:19 | call to source() | semmle.label | call to source() | +| simple.swift:157:12:157:19 | call to source() | semmle.label | call to source() | | stringinterpolation.swift:6:6:6:6 | self [Return] [first] | semmle.label | self [Return] [first] | | stringinterpolation.swift:6:6:6:6 | self [first] | semmle.label | self [first] | | stringinterpolation.swift:6:6:6:6 | value | semmle.label | value | @@ -724,6 +726,8 @@ subpaths | simple.swift:84:13:84:25 | ... .>>(_:_:) ... | simple.swift:84:13:84:20 | call to source() | simple.swift:84:13:84:25 | ... .>>(_:_:) ... | result | | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... | simple.swift:85:13:85:20 | call to source() | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... | result | | simple.swift:87:13:87:21 | call to ~(_:) | simple.swift:87:14:87:21 | call to source() | simple.swift:87:13:87:21 | call to ~(_:) | result | +| simple.swift:156:12:156:19 | call to source() | simple.swift:156:12:156:19 | call to source() | simple.swift:156:12:156:19 | call to source() | result | +| simple.swift:157:12:157:19 | call to source() | simple.swift:157:12:157:19 | call to source() | simple.swift:157:12:157:19 | call to source() | result | | stringinterpolation.swift:22:12:22:12 | "..." | stringinterpolation.swift:19:13:19:20 | call to source() | stringinterpolation.swift:22:12:22:12 | "..." | result | | stringinterpolation.swift:24:12:24:12 | "..." | stringinterpolation.swift:19:13:19:20 | call to source() | stringinterpolation.swift:24:12:24:12 | "..." | result | | stringinterpolation.swift:31:12:31:12 | "..." | stringinterpolation.swift:28:14:28:21 | call to source() | stringinterpolation.swift:31:12:31:12 | "..." | result | diff --git a/swift/ql/test/library-tests/dataflow/taint/core/simple.swift b/swift/ql/test/library-tests/dataflow/taint/core/simple.swift index 38f83ce276e3..a79a3a457a96 100644 --- a/swift/ql/test/library-tests/dataflow/taint/core/simple.swift +++ b/swift/ql/test/library-tests/dataflow/taint/core/simple.swift @@ -151,3 +151,10 @@ class MyClass2_NeverInstantiated { } // --- + +func taintThroughAs() { + sink(arg: source() as Int) // $ tainted=156 + sink(arg: source() as Any) // $ tainted=157 + sink(arg: source() as AnyObject) // $ MISSING: tainted=158 + sink(arg: source() as Sendable) // $ MISSING: tainted=159 +}