Skip to content

Commit 05e6dd8

Browse files
MathiasVPMathiasVP
committed
Swift: Add taint tests for flow through interpolated strings.
1 parent 9c48ce1 commit 05e6dd8

File tree

5 files changed

+198
-0
lines changed

5 files changed

+198
-0
lines changed

‎swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
| file://:0:0:0:0 | Phi | test.swift:7:14:7:14 | $interpolation |
2+
| file://:0:0:0:0 | Phi | test.swift:9:14:9:14 | $interpolation |
3+
| file://:0:0:0:0 | Phi | test.swift:11:14:11:14 | $interpolation |
4+
| file://:0:0:0:0 | Phi | test.swift:14:14:14:14 | $interpolation |
5+
| file://:0:0:0:0 | Phi | test.swift:16:14:16:14 | $interpolation |
6+
| file://:0:0:0:0 | Phi | test.swift:18:14:18:14 | $interpolation |
7+
| file://:0:0:0:0 | Phi | test.swift:21:14:21:14 | $interpolation |
8+
| test.swift:5:7:5:7 | WriteDef | test.swift:7:16:7:16 | x |
9+
| test.swift:5:11:5:18 | call to source() | test.swift:5:7:5:7 | WriteDef |
10+
| test.swift:7:13:7:13 | WriteDef | file://:0:0:0:0 | Phi |
11+
| test.swift:7:14:7:14 | $interpolation | test.swift:7:14:7:14 | &... |
12+
| test.swift:7:14:7:14 | : &... | test.swift:7:14:7:14 | WriteDef |
13+
| test.swift:7:14:7:14 | WriteDef | test.swift:7:15:7:15 | $interpolation |
14+
| test.swift:7:15:7:15 | $interpolation | test.swift:7:15:7:15 | &... |
15+
| test.swift:7:15:7:15 | : &... | test.swift:7:15:7:15 | WriteDef |
16+
| test.swift:7:15:7:15 | WriteDef | test.swift:7:18:7:18 | $interpolation |
17+
| test.swift:7:16:7:16 | x | test.swift:9:16:9:16 | x |
18+
| test.swift:7:18:7:18 | $interpolation | test.swift:7:18:7:18 | &... |
19+
| test.swift:7:18:7:18 | : &... | test.swift:7:18:7:18 | WriteDef |
20+
| test.swift:7:18:7:18 | WriteDef | test.swift:7:13:7:13 | TapExpr |
21+
| test.swift:9:13:9:13 | WriteDef | file://:0:0:0:0 | Phi |
22+
| test.swift:9:14:9:14 | $interpolation | test.swift:9:14:9:14 | &... |
23+
| test.swift:9:14:9:14 | : &... | test.swift:9:14:9:14 | WriteDef |
24+
| test.swift:9:14:9:14 | WriteDef | test.swift:9:15:9:15 | $interpolation |
25+
| test.swift:9:15:9:15 | $interpolation | test.swift:9:15:9:15 | &... |
26+
| test.swift:9:15:9:15 | : &... | test.swift:9:15:9:15 | WriteDef |
27+
| test.swift:9:15:9:15 | WriteDef | test.swift:9:18:9:18 | $interpolation |
28+
| test.swift:9:16:9:16 | x | test.swift:9:21:9:21 | x |
29+
| test.swift:9:18:9:18 | $interpolation | test.swift:9:18:9:18 | &... |
30+
| test.swift:9:18:9:18 | : &... | test.swift:9:18:9:18 | WriteDef |
31+
| test.swift:9:18:9:18 | WriteDef | test.swift:9:20:9:20 | $interpolation |
32+
| test.swift:9:20:9:20 | $interpolation | test.swift:9:20:9:20 | &... |
33+
| test.swift:9:20:9:20 | : &... | test.swift:9:20:9:20 | WriteDef |
34+
| test.swift:9:20:9:20 | WriteDef | test.swift:9:23:9:23 | $interpolation |
35+
| test.swift:9:21:9:21 | x | test.swift:11:16:11:16 | x |
36+
| test.swift:9:23:9:23 | $interpolation | test.swift:9:23:9:23 | &... |
37+
| test.swift:9:23:9:23 | : &... | test.swift:9:23:9:23 | WriteDef |
38+
| test.swift:9:23:9:23 | WriteDef | test.swift:9:13:9:13 | TapExpr |
39+
| test.swift:11:13:11:13 | WriteDef | file://:0:0:0:0 | Phi |
40+
| test.swift:11:14:11:14 | $interpolation | test.swift:11:14:11:14 | &... |
41+
| test.swift:11:14:11:14 | : &... | test.swift:11:14:11:14 | WriteDef |
42+
| test.swift:11:14:11:14 | WriteDef | test.swift:11:15:11:15 | $interpolation |
43+
| test.swift:11:15:11:15 | $interpolation | test.swift:11:15:11:15 | &... |
44+
| test.swift:11:15:11:15 | : &... | test.swift:11:15:11:15 | WriteDef |
45+
| test.swift:11:15:11:15 | WriteDef | test.swift:11:18:11:18 | $interpolation |
46+
| test.swift:11:16:11:16 | x | test.swift:11:26:11:26 | x |
47+
| test.swift:11:18:11:18 | $interpolation | test.swift:11:18:11:18 | &... |
48+
| test.swift:11:18:11:18 | : &... | test.swift:11:18:11:18 | WriteDef |
49+
| test.swift:11:18:11:18 | WriteDef | test.swift:11:20:11:20 | $interpolation |
50+
| test.swift:11:20:11:20 | $interpolation | test.swift:11:20:11:20 | &... |
51+
| test.swift:11:20:11:20 | : &... | test.swift:11:20:11:20 | WriteDef |
52+
| test.swift:11:20:11:20 | WriteDef | test.swift:11:23:11:23 | $interpolation |
53+
| test.swift:11:23:11:23 | $interpolation | test.swift:11:23:11:23 | &... |
54+
| test.swift:11:23:11:23 | : &... | test.swift:11:23:11:23 | WriteDef |
55+
| test.swift:11:23:11:23 | WriteDef | test.swift:11:25:11:25 | $interpolation |
56+
| test.swift:11:25:11:25 | $interpolation | test.swift:11:25:11:25 | &... |
57+
| test.swift:11:25:11:25 | : &... | test.swift:11:25:11:25 | WriteDef |
58+
| test.swift:11:25:11:25 | WriteDef | test.swift:11:28:11:28 | $interpolation |
59+
| test.swift:11:26:11:26 | x | test.swift:16:16:16:16 | x |
60+
| test.swift:11:28:11:28 | $interpolation | test.swift:11:28:11:28 | &... |
61+
| test.swift:11:28:11:28 | : &... | test.swift:11:28:11:28 | WriteDef |
62+
| test.swift:11:28:11:28 | WriteDef | test.swift:11:13:11:13 | TapExpr |
63+
| test.swift:13:7:13:7 | WriteDef | test.swift:14:16:14:16 | y |
64+
| test.swift:13:11:13:11 | 42 | test.swift:13:7:13:7 | WriteDef |
65+
| test.swift:14:13:14:13 | WriteDef | file://:0:0:0:0 | Phi |
66+
| test.swift:14:14:14:14 | $interpolation | test.swift:14:14:14:14 | &... |
67+
| test.swift:14:14:14:14 | : &... | test.swift:14:14:14:14 | WriteDef |
68+
| test.swift:14:14:14:14 | WriteDef | test.swift:14:15:14:15 | $interpolation |
69+
| test.swift:14:15:14:15 | $interpolation | test.swift:14:15:14:15 | &... |
70+
| test.swift:14:15:14:15 | : &... | test.swift:14:15:14:15 | WriteDef |
71+
| test.swift:14:15:14:15 | WriteDef | test.swift:14:18:14:18 | $interpolation |
72+
| test.swift:14:16:14:16 | y | test.swift:16:27:16:27 | y |
73+
| test.swift:14:18:14:18 | $interpolation | test.swift:14:18:14:18 | &... |
74+
| test.swift:14:18:14:18 | : &... | test.swift:14:18:14:18 | WriteDef |
75+
| test.swift:14:18:14:18 | WriteDef | test.swift:14:13:14:13 | TapExpr |
76+
| test.swift:16:13:16:13 | WriteDef | file://:0:0:0:0 | Phi |
77+
| test.swift:16:14:16:14 | $interpolation | test.swift:16:14:16:14 | &... |
78+
| test.swift:16:14:16:14 | : &... | test.swift:16:14:16:14 | WriteDef |
79+
| test.swift:16:14:16:14 | WriteDef | test.swift:16:15:16:15 | $interpolation |
80+
| test.swift:16:15:16:15 | $interpolation | test.swift:16:15:16:15 | &... |
81+
| test.swift:16:15:16:15 | : &... | test.swift:16:15:16:15 | WriteDef |
82+
| test.swift:16:15:16:15 | WriteDef | test.swift:16:18:16:18 | $interpolation |
83+
| test.swift:16:16:16:16 | x | test.swift:18:27:18:27 | x |
84+
| test.swift:16:18:16:18 | $interpolation | test.swift:16:18:16:18 | &... |
85+
| test.swift:16:18:16:18 | : &... | test.swift:16:18:16:18 | WriteDef |
86+
| test.swift:16:18:16:18 | WriteDef | test.swift:16:26:16:26 | $interpolation |
87+
| test.swift:16:26:16:26 | $interpolation | test.swift:16:26:16:26 | &... |
88+
| test.swift:16:26:16:26 | : &... | test.swift:16:26:16:26 | WriteDef |
89+
| test.swift:16:26:16:26 | WriteDef | test.swift:16:29:16:29 | $interpolation |
90+
| test.swift:16:27:16:27 | y | test.swift:18:16:18:16 | y |
91+
| test.swift:16:29:16:29 | $interpolation | test.swift:16:29:16:29 | &... |
92+
| test.swift:16:29:16:29 | : &... | test.swift:16:29:16:29 | WriteDef |
93+
| test.swift:16:29:16:29 | WriteDef | test.swift:16:13:16:13 | TapExpr |
94+
| test.swift:18:13:18:13 | WriteDef | file://:0:0:0:0 | Phi |
95+
| test.swift:18:14:18:14 | $interpolation | test.swift:18:14:18:14 | &... |
96+
| test.swift:18:14:18:14 | : &... | test.swift:18:14:18:14 | WriteDef |
97+
| test.swift:18:14:18:14 | WriteDef | test.swift:18:15:18:15 | $interpolation |
98+
| test.swift:18:15:18:15 | $interpolation | test.swift:18:15:18:15 | &... |
99+
| test.swift:18:15:18:15 | : &... | test.swift:18:15:18:15 | WriteDef |
100+
| test.swift:18:15:18:15 | WriteDef | test.swift:18:18:18:18 | $interpolation |
101+
| test.swift:18:18:18:18 | $interpolation | test.swift:18:18:18:18 | &... |
102+
| test.swift:18:18:18:18 | : &... | test.swift:18:18:18:18 | WriteDef |
103+
| test.swift:18:18:18:18 | WriteDef | test.swift:18:26:18:26 | $interpolation |
104+
| test.swift:18:26:18:26 | $interpolation | test.swift:18:26:18:26 | &... |
105+
| test.swift:18:26:18:26 | : &... | test.swift:18:26:18:26 | WriteDef |
106+
| test.swift:18:26:18:26 | WriteDef | test.swift:18:29:18:29 | $interpolation |
107+
| test.swift:18:29:18:29 | $interpolation | test.swift:18:29:18:29 | &... |
108+
| test.swift:18:29:18:29 | : &... | test.swift:18:29:18:29 | WriteDef |
109+
| test.swift:18:29:18:29 | WriteDef | test.swift:18:13:18:13 | TapExpr |
110+
| test.swift:20:3:20:7 | WriteDef | test.swift:21:16:21:16 | x |
111+
| test.swift:20:7:20:7 | 0 | test.swift:20:3:20:7 | WriteDef |
112+
| test.swift:21:13:21:13 | WriteDef | file://:0:0:0:0 | Phi |
113+
| test.swift:21:14:21:14 | $interpolation | test.swift:21:14:21:14 | &... |
114+
| test.swift:21:14:21:14 | : &... | test.swift:21:14:21:14 | WriteDef |
115+
| test.swift:21:14:21:14 | WriteDef | test.swift:21:15:21:15 | $interpolation |
116+
| test.swift:21:15:21:15 | $interpolation | test.swift:21:15:21:15 | &... |
117+
| test.swift:21:15:21:15 | : &... | test.swift:21:15:21:15 | WriteDef |
118+
| test.swift:21:15:21:15 | WriteDef | test.swift:21:18:21:18 | $interpolation |
119+
| test.swift:21:18:21:18 | $interpolation | test.swift:21:18:21:18 | &... |
120+
| test.swift:21:18:21:18 | : &... | test.swift:21:18:21:18 | WriteDef |
121+
| test.swift:21:18:21:18 | WriteDef | test.swift:21:13:21:13 | TapExpr |

‎swift/ql/test/library-tests/dataflow/taint/LocalTaint.ql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import swift
2+
import codeql.swift.dataflow.DataFlow
3+
4+
from DataFlow::Node pred, DataFlow::Node succ
5+
where DataFlow::localFlowStep(pred, succ)
6+
select pred, succ

‎swift/ql/test/library-tests/dataflow/taint/Taint.expected

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
edges
2+
| test.swift:5:11:5:18 | call to source() : | test.swift:7:13:7:13 | "..." |
3+
| test.swift:5:11:5:18 | call to source() : | test.swift:9:13:9:13 | "..." |
4+
| test.swift:5:11:5:18 | call to source() : | test.swift:11:13:11:13 | "..." |
5+
| test.swift:5:11:5:18 | call to source() : | test.swift:16:13:16:13 | "..." |
6+
| test.swift:5:11:5:18 | call to source() : | test.swift:18:13:18:13 | "..." |
7+
nodes
8+
| test.swift:5:11:5:18 | call to source() : | semmle.label | call to source() : |
9+
| test.swift:7:13:7:13 | "..." | semmle.label | "..." |
10+
| test.swift:9:13:9:13 | "..." | semmle.label | "..." |
11+
| test.swift:11:13:11:13 | "..." | semmle.label | "..." |
12+
| test.swift:16:13:16:13 | "..." | semmle.label | "..." |
13+
| test.swift:18:13:18:13 | "..." | semmle.label | "..." |
14+
subpaths
15+
#select
16+
| test.swift:7:13:7:13 | "..." | test.swift:5:11:5:18 | call to source() : | test.swift:7:13:7:13 | "..." | result |
17+
| test.swift:9:13:9:13 | "..." | test.swift:5:11:5:18 | call to source() : | test.swift:9:13:9:13 | "..." | result |
18+
| test.swift:11:13:11:13 | "..." | test.swift:5:11:5:18 | call to source() : | test.swift:11:13:11:13 | "..." | result |
19+
| test.swift:16:13:16:13 | "..." | test.swift:5:11:5:18 | call to source() : | test.swift:16:13:16:13 | "..." | result |
20+
| test.swift:18:13:18:13 | "..." | test.swift:5:11:5:18 | call to source() : | test.swift:18:13:18:13 | "..." | result |

‎swift/ql/test/library-tests/dataflow/taint/Taint.ql

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* @kind path-problem
3+
*/
4+
5+
import swift
6+
import codeql.swift.dataflow.TaintTracking
7+
import codeql.swift.dataflow.DataFlow::DataFlow
8+
import PathGraph
9+
10+
class TestConfiguration extends TaintTracking::Configuration {
11+
TestConfiguration() { this = "TestConfiguration" }
12+
13+
override predicate isSource(Node src) {
14+
src.asExpr().(CallExpr).getStaticTarget().getName() = "source()"
15+
}
16+
17+
override predicate isSink(Node sink) {
18+
exists(CallExpr sinkCall |
19+
sinkCall.getStaticTarget().getName() = "sink(arg:)" and
20+
sinkCall.getAnArgument().getExpr() = sink.asExpr()
21+
)
22+
}
23+
24+
override int explorationLimit() { result = 100 }
25+
}
26+
27+
from PathNode src, PathNode sink, TestConfiguration test
28+
where test.hasFlowPath(src, sink)
29+
select sink, src, sink, "result"

‎swift/ql/test/library-tests/dataflow/taint/test.swift

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
func source() -> Int { return 0; }
2+
func sink(arg: String) {}
3+
4+
func taintThroughInterpolatedStrings() {
5+
var x = source()
6+
7+
sink(arg: "\(x)") // tainted
8+
9+
sink(arg: "\(x) \(x)") // tainted
10+
11+
sink(arg: "\(x) \(0) \(x)") // tainted
12+
13+
var y = 42
14+
sink(arg: "\(y)") // clean
15+
16+
sink(arg: "\(x) hello \(y)") // tainted
17+
18+
sink(arg: "\(y) world \(x)") // tainted
19+
20+
x = 0
21+
sink(arg: "\(x)") // clean
22+
}

0 commit comments

Comments
 (0)