Skip to content

Commit e92a5eb

Browse files
geoffw0geoffw0
authored
Merge pull request #11911 from geoffw0/rncrypt2
Swift: Add RNCryptor sinks to swift/hardcoded-key
2 parents f6fe627 + a568d0a commit e92a5eb

File tree

3 files changed

+144
-3
lines changed

3 files changed

+144
-3
lines changed

‎swift/ql/src/queries/Security/CWE-321/HardcodedEncryptionKey.ql

+11-2
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
import swift
1414
import codeql.swift.dataflow.DataFlow
15+
import codeql.swift.dataflow.TaintTracking
1516
import DataFlow::PathGraph
1617

1718
/**
@@ -46,14 +47,22 @@ class EncryptionKeySink extends Expr {
4647
fName.matches("init(key:%") and
4748
call.getArgument(0).getExpr() = this
4849
)
50+
or
51+
// RNCryptor
52+
exists(ClassOrStructDecl c, MethodDecl f, CallExpr call |
53+
c.getFullName() = ["RNCryptor", "RNEncryptor", "RNDecryptor"] and
54+
c.getAMember() = f and
55+
call.getStaticTarget() = f and
56+
call.getArgumentWithLabel(["encryptionKey", "withEncryptionKey"]).getExpr() = this
57+
)
4958
}
5059
}
5160

5261
/**
53-
* A dataflow configuration from the key source to expressions that use
62+
* A taint configuration from the key source to expressions that use
5463
* it to initialize a cipher.
5564
*/
56-
class HardcodedKeyConfig extends DataFlow::Configuration {
65+
class HardcodedKeyConfig extends TaintTracking::Configuration {
5766
HardcodedKeyConfig() { this = "HardcodedKeyConfig" }
5867

5968
override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof KeySource }

‎swift/ql/test/query-tests/Security/CWE-321/HardcodedEncryptionKey.expected

+51-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,21 @@
11
edges
2+
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : |
3+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:65:73:65:73 | myConstKey |
4+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:66:73:66:73 | myConstKey |
5+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:67:73:67:73 | myConstKey |
6+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:68:73:68:73 | myConstKey |
7+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:70:94:70:94 | myConstKey |
8+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:71:102:71:102 | myConstKey |
9+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:72:94:72:94 | myConstKey |
10+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:73:102:73:102 | myConstKey |
11+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:75:37:75:37 | myConstKey |
12+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:76:37:76:37 | myConstKey |
13+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:78:66:78:66 | myConstKey |
14+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:79:66:79:66 | myConstKey |
15+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:80:94:80:94 | myConstKey |
16+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | rncryptor.swift:81:102:81:102 | myConstKey |
17+
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
18+
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
219
| test.swift:76:3:76:3 | this string is constant : | test.swift:92:18:92:36 | call to getConstantString() : |
320
| test.swift:90:26:90:121 | [...] : | test.swift:117:22:117:22 | key |
421
| test.swift:90:26:90:121 | [...] : | test.swift:118:22:118:22 | key |
@@ -20,6 +37,24 @@ edges
2037
| test.swift:92:18:92:36 | call to getConstantString() : | test.swift:162:24:162:24 | keyString |
2138
| test.swift:92:18:92:36 | call to getConstantString() : | test.swift:164:24:164:24 | keyString |
2239
nodes
40+
| file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | semmle.label | [summary] to write: return (return) in Data.init(_:) : |
41+
| rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | semmle.label | [summary param] 0 in Data.init(_:) : |
42+
| rncryptor.swift:60:19:60:38 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
43+
| rncryptor.swift:60:24:60:24 | abcdef123456 : | semmle.label | abcdef123456 : |
44+
| rncryptor.swift:65:73:65:73 | myConstKey | semmle.label | myConstKey |
45+
| rncryptor.swift:66:73:66:73 | myConstKey | semmle.label | myConstKey |
46+
| rncryptor.swift:67:73:67:73 | myConstKey | semmle.label | myConstKey |
47+
| rncryptor.swift:68:73:68:73 | myConstKey | semmle.label | myConstKey |
48+
| rncryptor.swift:70:94:70:94 | myConstKey | semmle.label | myConstKey |
49+
| rncryptor.swift:71:102:71:102 | myConstKey | semmle.label | myConstKey |
50+
| rncryptor.swift:72:94:72:94 | myConstKey | semmle.label | myConstKey |
51+
| rncryptor.swift:73:102:73:102 | myConstKey | semmle.label | myConstKey |
52+
| rncryptor.swift:75:37:75:37 | myConstKey | semmle.label | myConstKey |
53+
| rncryptor.swift:76:37:76:37 | myConstKey | semmle.label | myConstKey |
54+
| rncryptor.swift:78:66:78:66 | myConstKey | semmle.label | myConstKey |
55+
| rncryptor.swift:79:66:79:66 | myConstKey | semmle.label | myConstKey |
56+
| rncryptor.swift:80:94:80:94 | myConstKey | semmle.label | myConstKey |
57+
| rncryptor.swift:81:102:81:102 | myConstKey | semmle.label | myConstKey |
2358
| test.swift:76:3:76:3 | this string is constant : | semmle.label | this string is constant : |
2459
| test.swift:90:26:90:121 | [...] : | semmle.label | [...] : |
2560
| test.swift:92:18:92:36 | call to getConstantString() : | semmle.label | call to getConstantString() : |
@@ -43,7 +78,22 @@ nodes
4378
| test.swift:163:24:163:24 | key | semmle.label | key |
4479
| test.swift:164:24:164:24 | keyString | semmle.label | keyString |
4580
subpaths
81+
| rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:60:19:60:38 | call to Data.init(_:) : |
4682
#select
83+
| rncryptor.swift:65:73:65:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:65:73:65:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
84+
| rncryptor.swift:66:73:66:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:66:73:66:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
85+
| rncryptor.swift:67:73:67:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:67:73:67:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
86+
| rncryptor.swift:68:73:68:73 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:68:73:68:73 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
87+
| rncryptor.swift:70:94:70:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:70:94:70:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
88+
| rncryptor.swift:71:102:71:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:71:102:71:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
89+
| rncryptor.swift:72:94:72:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:72:94:72:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
90+
| rncryptor.swift:73:102:73:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:73:102:73:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
91+
| rncryptor.swift:75:37:75:37 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:75:37:75:37 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
92+
| rncryptor.swift:76:37:76:37 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:76:37:76:37 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
93+
| rncryptor.swift:78:66:78:66 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:78:66:78:66 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
94+
| rncryptor.swift:79:66:79:66 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:79:66:79:66 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
95+
| rncryptor.swift:80:94:80:94 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:80:94:80:94 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
96+
| rncryptor.swift:81:102:81:102 | myConstKey | rncryptor.swift:60:24:60:24 | abcdef123456 : | rncryptor.swift:81:102:81:102 | myConstKey | The key 'myConstKey' has been initialized with hard-coded values from $@. | rncryptor.swift:60:24:60:24 | abcdef123456 : | abcdef123456 |
4797
| test.swift:108:21:108:21 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:108:21:108:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
4898
| test.swift:109:21:109:21 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:109:21:109:21 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
4999
| test.swift:117:22:117:22 | key | test.swift:90:26:90:121 | [...] : | test.swift:117:22:117:22 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] |
@@ -62,4 +112,4 @@ subpaths
62112
| test.swift:161:24:161:24 | key | test.swift:90:26:90:121 | [...] : | test.swift:161:24:161:24 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] |
63113
| test.swift:162:24:162:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:162:24:162:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
64114
| test.swift:163:24:163:24 | key | test.swift:90:26:90:121 | [...] : | test.swift:163:24:163:24 | key | The key 'key' has been initialized with hard-coded values from $@. | test.swift:90:26:90:121 | [...] : | [...] |
65-
| test.swift:164:24:164:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |
115+
| test.swift:164:24:164:24 | keyString | test.swift:76:3:76:3 | this string is constant : | test.swift:164:24:164:24 | keyString | The key 'keyString' has been initialized with hard-coded values from $@. | test.swift:76:3:76:3 | this string is constant : | this string is constant |

‎swift/ql/test/query-tests/Security/CWE-321/rncryptor.swift

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
2+
// --- stubs ---
3+
4+
class Data {
5+
init<S>(_ elements: S) {}
6+
}
7+
8+
class NSObject
9+
{
10+
}
11+
12+
struct _RNCryptorSettings {
13+
// ...
14+
}
15+
typealias RNCryptorSettings = _RNCryptorSettings
16+
17+
let kRNCryptorAES256Settings = RNCryptorSettings()
18+
19+
typealias RNCryptorHandler = () -> Void // simplified
20+
21+
class RNCryptor : NSObject
22+
{
23+
}
24+
25+
class RNEncryptor : RNCryptor
26+
{
27+
override init() {}
28+
29+
init(settings: RNCryptorSettings, encryptionKey: Data?, hmacKey HMACKey: Data?, handler: RNCryptorHandler?) {}
30+
init(settings: RNCryptorSettings, encryptionKey: Data?, HMACKey: Data?, handler: RNCryptorHandler?) {}
31+
init(settings theSettings: RNCryptorSettings, encryptionKey anEncryptionKey: Data?, hmacKey anHMACKey: Data?, iv anIV: Data?, handler aHandler: RNCryptorHandler?) {}
32+
init(settings theSettings: RNCryptorSettings, encryptionKey anEncryptionKey: Data?, HMACKey anHMACKey: Data?, IV anIV: Data?, handler aHandler: RNCryptorHandler?) {}
33+
34+
func encryptData(_ data: Data?, with settings: RNCryptorSettings, encryptionKey: Data?, hmacKey HMACKey: Data?) throws -> Data { return Data(0) }
35+
func encryptData(_ data: Data?, withSettings settings: RNCryptorSettings, encryptionKey: Data?, HMACKey: Data?) throws -> Data { return Data(0) }
36+
func encryptData(_ thePlaintext: Data?, with theSettings: RNCryptorSettings, encryptionKey anEncryptionKey: Data?, hmacKey anHMACKey: Data?, iv anIV: Data?) throws -> Data { return Data(0) }
37+
func encryptData(_ thePlaintext: Data?, withSettings theSettings: RNCryptorSettings, encryptionKey anEncryptionKey: Data?, HMACKey anHMACKey: Data?, IV anIV: Data?) throws -> Data { return Data(0) }
38+
}
39+
40+
class RNDecryptor : RNCryptor
41+
{
42+
override init() {}
43+
44+
init(encryptionKey: Data?, hmacKey HMACKey: Data?, handler: RNCryptorHandler?) {}
45+
init(encryptionKey: Data?, HMACKey: Data?, handler: RNCryptorHandler?) {}
46+
47+
func decryptData(_ data: Data?, withEncryptionKey encryptionKey: Data?, hmacKey HMACKey: Data?) throws -> Data { return Data(0) }
48+
func decryptData(_ data: Data?, withEncryptionKey encryptionKey: Data?, HMACKey: Data?) throws -> Data { return Data(0) }
49+
func decryptData(_ theCipherText: Data?, with settings: RNCryptorSettings, encryptionKey: Data?, hmacKey HMACKey: Data?) throws -> Data { return Data(0) }
50+
func decryptData(_ theCipherText: Data?, withSettings settings: RNCryptorSettings, encryptionKey: Data?, HMACKey: Data?) throws -> Data { return Data(0) }
51+
}
52+
53+
// --- tests ---
54+
55+
func test() {
56+
// RNCryptor
57+
let myEncryptor = RNEncryptor()
58+
let myDecryptor = RNDecryptor()
59+
let myData = Data(0)
60+
let myConstKey = Data("abcdef123456")
61+
let myHMACKey = Data(0)
62+
let myHandler = {}
63+
let myIV = Data(0)
64+
65+
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD
66+
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD
67+
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV, handler: myHandler) // BAD
68+
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV, handler: myHandler) // BAD
69+
70+
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD
71+
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD
72+
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey, iv: myIV) // BAD
73+
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey, IV: myIV) // BAD
74+
75+
let _ = RNDecryptor(encryptionKey: myConstKey, hmacKey: myHMACKey, handler: myHandler) // BAD
76+
let _ = RNDecryptor(encryptionKey: myConstKey, HMACKey: myHMACKey, handler: myHandler) // BAD
77+
78+
let _ = try? myDecryptor.decryptData(myData, withEncryptionKey: myConstKey, hmacKey: myHMACKey) // BAD
79+
let _ = try? myDecryptor.decryptData(myData, withEncryptionKey: myConstKey, HMACKey: myHMACKey) // BAD
80+
let _ = try? myDecryptor.decryptData(myData, with: kRNCryptorAES256Settings, encryptionKey: myConstKey, hmacKey: myHMACKey) // BAD
81+
let _ = try? myDecryptor.decryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myConstKey, HMACKey: myHMACKey) // BAD
82+
}

0 commit comments

Comments
 (0)