Skip to content

Commit d42848b

Browse files
geoffw0geoffw0
committed
Swift: Upgrade the query from dataflow to taint tracking, so as to support more flows.
1 parent 28a707a commit d42848b

File tree

3 files changed

+60
-15
lines changed

3 files changed

+60
-15
lines changed

‎swift/ql/src/queries/Security/CWE-321/HardcodedEncryptionKey.ql

+3-2
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
import swift
1414
import codeql.swift.dataflow.DataFlow
15+
import codeql.swift.dataflow.TaintTracking
1516
import DataFlow::PathGraph
1617

1718
/**
@@ -58,10 +59,10 @@ class EncryptionKeySink extends Expr {
5859
}
5960

6061
/**
61-
* A dataflow configuration from the key source to expressions that use
62+
* A taint configuration from the key source to expressions that use
6263
* it to initialize a cipher.
6364
*/
64-
class HardcodedKeyConfig extends DataFlow::Configuration {
65+
class HardcodedKeyConfig extends TaintTracking::Configuration {
6566
HardcodedKeyConfig() { this = "HardcodedKeyConfig" }
6667

6768
override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof KeySource }

‎swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected

+45-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,19 @@
11
edges
2+
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : |
3+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:65:73:65:73 | myConstKey |
4+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:66:73:66:73 | myConstKey |
5+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:67:73:67:73 | myConstKey |
6+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:68:73:68:73 | myConstKey |
7+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:70:94:70:94 | myConstKey |
8+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:71:102:71:102 | myConstKey |
9+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:72:94:72:94 | myConstKey |
10+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:73:102:73:102 | myConstKey |
11+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:75:37:75:37 | myConstKey |
12+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:76:37:76:37 | myConstKey |
13+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:80:94:80:94 | myConstKey |
14+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:81:102:81:102 | myConstKey |
15+
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
16+
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
217
| test.swift:76:3:76:3 | this string is constant : | test.swift:92:18:92:36 | call to getConstantString() : |
318
| test.swift:90:26:90:121 | [...] : | test.swift:117:22:117:22 | key |
419
| test.swift:90:26:90:121 | [...] : | test.swift:118:22:118:22 | key |
@@ -20,6 +35,22 @@ edges
2035
| test.swift:92:18:92:36 | call to getConstantString() : | test.swift:162:24:162:24 | keyString |
2136
| test.swift:92:18:92:36 | call to getConstantString() : | test.swift:164:24:164:24 | keyString |
2237
nodes
38+
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : |
39+
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | semmle.label | [summary param] 0 in Data.init(_:) : |
40+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
41+
| rncryptor.swift:60:24:60:24 | abcdef123456 : | semmle.label | abcdef123456 : |
42+
| rncryptor.swift:65:73:65:73 | myConstKey | semmle.label | myConstKey |
43+
| rncryptor.swift:66:73:66:73 | myConstKey | semmle.label | myConstKey |
44+
| rncryptor.swift:67:73:67:73 | myConstKey | semmle.label | myConstKey |
45+
| rncryptor.swift:68:73:68:73 | myConstKey | semmle.label | myConstKey |
46+
| rncryptor.swift:70:94:70:94 | myConstKey | semmle.label | myConstKey |
47+
| rncryptor.swift:71:102:71:102 | myConstKey | semmle.label | myConstKey |
48+
| rncryptor.swift:72:94:72:94 | myConstKey | semmle.label | myConstKey |
49+
| rncryptor.swift:73:102:73:102 | myConstKey | semmle.label | myConstKey |
50+
| rncryptor.swift:75:37:75:37 | myConstKey | semmle.label | myConstKey |
51+
| rncryptor.swift:76:37:76:37 | myConstKey | semmle.label | myConstKey |
52+
| rncryptor.swift:80:94:80:94 | myConstKey | semmle.label | myConstKey |
53+
| rncryptor.swift:81:102:81:102 | myConstKey | semmle.label | myConstKey |
2354
| test.swift:76:3:76:3 | this string is constant : | semmle.label | this string is constant : |
2455
| test.swift:90:26:90:121 | [...] : | semmle.label | [...] : |
2556
| test.swift:92:18:92:36 | call to getConstantString() : | semmle.label | call to getConstantString() : |
@@ -43,7 +74,20 @@ nodes
4374
| test.swift:163:24:163:24 | key | semmle.label | key |
4475
| test.swift:164:24:164:24 | keyString | semmle.label | keyString |
4576
subpaths
77+
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
4678
#select
79+
| rncryptor.swift:65:73:65:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:65:73:65:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
80+
| rncryptor.swift:66:73:66:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:66:73:66:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
81+
| rncryptor.swift:67:73:67:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:67:73:67:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
82+
| rncryptor.swift:68:73:68:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:68:73:68:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
83+
| rncryptor.swift:70:94:70:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:70:94:70:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
84+
| rncryptor.swift:71:102:71:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:71:102:71:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
85+
| rncryptor.swift:72:94:72:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:72:94:72:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
86+
| rncryptor.swift:73:102:73:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:73:102:73:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
87+
| rncryptor.swift:75:37:75:37 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:75:37:75:37 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
88+
| rncryptor.swift:76:37:76:37 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:76:37:76:37 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
89+
| rncryptor.swift:80:94:80:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:80:94:80:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
90+
| rncryptor.swift:81:102:81:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:81:102:81:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
4791
| test.swift:108:21:108:21 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:108:21:108:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
4892
| test.swift:109:21:109:21 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:109:21:109:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
4993
| test.swift:117:22:117:22 | key | test.swift:90:26:90:121 | [...] : | test.swift:117:22:117:22 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] |
@@ -62,4 +106,4 @@ subpaths
62106
| test.swift:161:24:161:24 | key | test.swift:90:26:90:121 | [...] : | test.swift:161:24:161:24 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] |
63107
| test.swift:162:24:162:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:162:24:162:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
64108
| test.swift:163:24:163:24 | key | test.swift:90:26:90:121 | [...] : | test.swift:163:24:163:24 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] |
65-
| test.swift:164:24:164:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
109+
| test.swift:164:24:164:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |

‎swift/ql/test/query-tests/Security/CWE-321/rncryptor.swift

+12-12
Original file line numberDiff line numberDiff line change
@@ -62,21 +62,21 @@ func test(cond: Bool) {
6262
let myHandler = {}
6363
let myIV = Data(0)
6464

65-
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED]
66-
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED]
67-
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV, handler: myHandler) // BAD [NOT DETECTED]
68-
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV, handler: myHandler) // BAD [NOT DETECTED]
65+
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD
66+
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD
67+
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV, handler: myHandler) // BAD
68+
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV, handler: myHandler) // BAD
6969

70-
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD [NOT DETECTED]
71-
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD [NOT DETECTED]
72-
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV) // BAD [NOT DETECTED]
73-
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV) // BAD [NOT DETECTED]
70+
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD
71+
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD
72+
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV) // BAD
73+
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV) // BAD
7474

75-
let _ = RNDecryptor(encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED]
76-
let _ = RNDecryptor(encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD [NOT DETECTED]
75+
let _ = RNDecryptor(encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD
76+
let _ = RNDecryptor(encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD
7777

7878
let _ = try? myDecryptor.decryptData(myData, withEncryptionKey: myConstKey, hmacKey: myHMACKey) // BAD [NOT DETECTED]
7979
let _ = try? myDecryptor.decryptData(myData, withEncryptionKey: myConstKey, HMACKey: myHMACKey) // BAD [NOT DETECTED]
80-
let _ = try? myDecryptor.decryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD [NOT DETECTED]
81-
let _ = try? myDecryptor.decryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD [NOT DETECTED]
80+
let _ = try? myDecryptor.decryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD
81+
let _ = try? myDecryptor.decryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD
8282
}

0 commit comments

Comments
 (0)