Skip to content

Commit 068ec8e

Browse files
geoffw0geoffw0
committed
Swift: More tests of taint flow through Strings.
1 parent 0141609 commit 068ec8e

File tree

4 files changed

+129
-3
lines changed

4 files changed

+129
-3
lines changed

‎swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,3 +119,58 @@
119119
| string.swift:21:18:21:18 | $interpolation | string.swift:21:18:21:18 | &... |
120120
| string.swift:21:18:21:18 | : &... | string.swift:21:18:21:18 | WriteDef |
121121
| string.swift:21:18:21:18 | WriteDef | string.swift:21:13:21:13 | TapExpr |
122+
| string.swift:27:7:27:7 | WriteDef | string.swift:30:13:30:13 | clean |
123+
| string.swift:27:15:27:15 | abcdef | string.swift:27:7:27:7 | WriteDef |
124+
| string.swift:28:7:28:7 | WriteDef | string.swift:31:13:31:13 | tainted |
125+
| string.swift:28:17:28:25 | call to source2() | string.swift:28:7:28:7 | WriteDef |
126+
| string.swift:30:13:30:13 | clean | string.swift:33:13:33:13 | clean |
127+
| string.swift:31:13:31:13 | tainted | string.swift:34:21:34:21 | tainted |
128+
| string.swift:33:13:33:13 | clean | string.swift:33:21:33:21 | clean |
129+
| string.swift:33:21:33:21 | clean | string.swift:34:13:34:13 | clean |
130+
| string.swift:34:13:34:13 | clean | string.swift:35:23:35:23 | clean |
131+
| string.swift:34:21:34:21 | tainted | string.swift:35:13:35:13 | tainted |
132+
| string.swift:35:13:35:13 | tainted | string.swift:36:13:36:13 | tainted |
133+
| string.swift:35:23:35:23 | clean | string.swift:38:19:38:19 | clean |
134+
| string.swift:36:13:36:13 | tainted | string.swift:36:23:36:23 | tainted |
135+
| string.swift:36:23:36:23 | tainted | string.swift:39:19:39:19 | tainted |
136+
| string.swift:41:7:41:7 | WriteDef | string.swift:43:13:43:13 | str |
137+
| string.swift:41:13:41:13 | abc | string.swift:41:7:41:7 | WriteDef |
138+
| string.swift:43:13:43:13 | str | string.swift:45:3:45:3 | str |
139+
| string.swift:45:3:45:3 | : &... | string.swift:45:3:45:10 | WriteDef |
140+
| string.swift:45:3:45:3 | str | string.swift:45:3:45:3 | &... |
141+
| string.swift:45:3:45:10 | WriteDef | string.swift:46:13:46:13 | str |
142+
| string.swift:46:13:46:13 | str | string.swift:48:3:48:3 | str |
143+
| string.swift:48:3:48:3 | : &... | string.swift:48:3:48:18 | WriteDef |
144+
| string.swift:48:3:48:3 | str | string.swift:48:3:48:3 | &... |
145+
| string.swift:48:3:48:18 | WriteDef | string.swift:49:13:49:13 | str |
146+
| string.swift:51:7:51:7 | WriteDef | string.swift:53:13:53:13 | str2 |
147+
| string.swift:51:14:51:14 | abc | string.swift:51:7:51:7 | WriteDef |
148+
| string.swift:53:13:53:13 | str2 | string.swift:55:3:55:3 | str2 |
149+
| string.swift:55:3:55:3 | : &... | string.swift:55:3:55:8 | WriteDef |
150+
| string.swift:55:3:55:3 | str2 | string.swift:55:3:55:3 | &... |
151+
| string.swift:55:3:55:8 | WriteDef | string.swift:56:13:56:13 | str2 |
152+
| string.swift:56:13:56:13 | str2 | string.swift:58:3:58:3 | str2 |
153+
| string.swift:58:3:58:3 | : &... | string.swift:58:3:58:8 | WriteDef |
154+
| string.swift:58:3:58:3 | str2 | string.swift:58:3:58:3 | &... |
155+
| string.swift:58:3:58:8 | WriteDef | string.swift:59:13:59:13 | str2 |
156+
| string.swift:59:13:59:13 | str2 | string.swift:69:13:69:13 | str2 |
157+
| string.swift:61:7:61:7 | WriteDef | string.swift:63:13:63:13 | str3 |
158+
| string.swift:61:14:61:14 | abc | string.swift:61:7:61:7 | WriteDef |
159+
| string.swift:63:13:63:13 | str3 | string.swift:65:3:65:3 | str3 |
160+
| string.swift:65:3:65:3 | : &... | string.swift:65:3:65:8 | WriteDef |
161+
| string.swift:65:3:65:3 | str3 | string.swift:65:3:65:3 | &... |
162+
| string.swift:65:3:65:8 | WriteDef | string.swift:66:13:66:13 | str3 |
163+
| string.swift:66:13:66:13 | str3 | string.swift:68:3:68:3 | str3 |
164+
| string.swift:68:3:68:3 | str3 | string.swift:68:3:68:3 | &... |
165+
| string.swift:73:7:73:7 | WriteDef | string.swift:77:20:77:20 | clean |
166+
| string.swift:73:15:73:15 | | string.swift:73:7:73:7 | WriteDef |
167+
| string.swift:74:7:74:7 | WriteDef | string.swift:78:20:78:20 | tainted |
168+
| string.swift:74:17:74:25 | call to source2() | string.swift:74:7:74:7 | WriteDef |
169+
| string.swift:75:7:75:7 | WriteDef | string.swift:79:20:79:20 | taintedInt |
170+
| string.swift:75:20:75:27 | call to source() | string.swift:75:7:75:7 | WriteDef |
171+
| string.swift:77:20:77:20 | clean | string.swift:81:31:81:31 | clean |
172+
| string.swift:78:20:78:20 | tainted | string.swift:82:31:82:31 | tainted |
173+
| string.swift:81:31:81:31 | clean | string.swift:84:13:84:13 | clean |
174+
| string.swift:82:31:82:31 | tainted | string.swift:85:13:85:13 | tainted |
175+
| string.swift:84:13:84:13 | clean | string.swift:87:13:87:13 | clean |
176+
| string.swift:85:13:85:13 | tainted | string.swift:88:13:88:13 | tainted |

‎swift/ql/test/library-tests/dataflow/taint/Taint.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,21 @@ edges
44
| string.swift:5:11:5:18 | call to source() : | string.swift:11:13:11:13 | "..." |
55
| string.swift:5:11:5:18 | call to source() : | string.swift:16:13:16:13 | "..." |
66
| string.swift:5:11:5:18 | call to source() : | string.swift:18:13:18:13 | "..." |
7+
| string.swift:28:17:28:25 | call to source2() : | string.swift:31:13:31:13 | tainted |
78
nodes
89
| string.swift:5:11:5:18 | call to source() : | semmle.label | call to source() : |
910
| string.swift:7:13:7:13 | "..." | semmle.label | "..." |
1011
| string.swift:9:13:9:13 | "..." | semmle.label | "..." |
1112
| string.swift:11:13:11:13 | "..." | semmle.label | "..." |
1213
| string.swift:16:13:16:13 | "..." | semmle.label | "..." |
1314
| string.swift:18:13:18:13 | "..." | semmle.label | "..." |
15+
| string.swift:28:17:28:25 | call to source2() : | semmle.label | call to source2() : |
16+
| string.swift:31:13:31:13 | tainted | semmle.label | tainted |
1417
subpaths
1518
#select
1619
| string.swift:7:13:7:13 | "..." | string.swift:5:11:5:18 | call to source() : | string.swift:7:13:7:13 | "..." | result |
1720
| string.swift:9:13:9:13 | "..." | string.swift:5:11:5:18 | call to source() : | string.swift:9:13:9:13 | "..." | result |
1821
| string.swift:11:13:11:13 | "..." | string.swift:5:11:5:18 | call to source() : | string.swift:11:13:11:13 | "..." | result |
1922
| string.swift:16:13:16:13 | "..." | string.swift:5:11:5:18 | call to source() : | string.swift:16:13:16:13 | "..." | result |
2023
| string.swift:18:13:18:13 | "..." | string.swift:5:11:5:18 | call to source() : | string.swift:18:13:18:13 | "..." | result |
24+
| string.swift:31:13:31:13 | tainted | string.swift:28:17:28:25 | call to source2() : | string.swift:31:13:31:13 | tainted | result |

‎swift/ql/test/library-tests/dataflow/taint/Taint.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@ class TestConfiguration extends TaintTracking::Configuration {
1111
TestConfiguration() { this = "TestConfiguration" }
1212

1313
override predicate isSource(Node src) {
14-
src.asExpr().(CallExpr).getStaticTarget().getName() = "source()"
14+
src.asExpr().(CallExpr).getStaticTarget().getName().matches("source%")
1515
}
1616

1717
override predicate isSink(Node sink) {
1818
exists(CallExpr sinkCall |
19-
sinkCall.getStaticTarget().getName() = "sink(arg:)" and
19+
sinkCall.getStaticTarget().getName().matches("sink%") and
2020
sinkCall.getAnArgument().getExpr() = sink.asExpr()
2121
)
2222
}

‎swift/ql/test/library-tests/dataflow/taint/string.swift

Lines changed: 68 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,71 @@ func taintThroughInterpolatedStrings() {
1919

2020
x = 0
2121
sink(arg: "\(x)") // clean
22-
}
22+
}
23+
24+
func source2() -> String { return ""; }
25+
26+
func taintThroughStringConcatenation() {
27+
var clean = "abcdef"
28+
var tainted = source2()
29+
30+
sink(arg: clean)
31+
sink(arg: tainted) // tainted
32+
33+
sink(arg: clean + clean)
34+
sink(arg: clean + tainted) // tainted [NOT DETECTED]
35+
sink(arg: tainted + clean) // tainted [NOT DETECTED]
36+
sink(arg: tainted + tainted) // tainted [NOT DETECTED]
37+
38+
sink(arg: ">" + clean + "<")
39+
sink(arg: ">" + tainted + "<") // tainted [NOT DETECTED]
40+
41+
var str = "abc"
42+
43+
sink(arg: str)
44+
45+
str += "def"
46+
sink(arg: str)
47+
48+
str += source2()
49+
sink(arg: str) // tainted [NOT DETECTED]
50+
51+
var str2 = "abc"
52+
53+
sink(arg: str2)
54+
55+
str2.append("def")
56+
sink(arg: str2)
57+
58+
str2.append(source2())
59+
sink(arg: str2) // tainted [NOT DETECTED]
60+
61+
var str3 = "abc"
62+
63+
sink(arg: str3)
64+
65+
str3.append(contentsOf: "def")
66+
sink(arg: str3)
67+
68+
str3.append(contentsOf: source2())
69+
sink(arg: str2) // tainted [NOT DETECTED]
70+
}
71+
72+
func taintThroughStringOperations() {
73+
var clean = ""
74+
var tainted = source2()
75+
var taintedInt = source()
76+
77+
sink(arg: String(clean))
78+
sink(arg: String(tainted)) // tainted [NOT DETECTED]
79+
sink(arg: String(taintedInt)) // tainted [NOT DETECTED]
80+
81+
sink(arg: String(repeating: clean, count: 2))
82+
sink(arg: String(repeating: tainted, count: 2)) // tainted [NOT DETECTED]
83+
84+
sink(arg: clean.description)
85+
sink(arg: tainted.description) // tainted [NOT DETECTED]
86+
87+
sink(arg: clean.debugDescription)
88+
sink(arg: tainted.debugDescription) // tainted [NOT DETECTED]
89+
}

0 commit comments

Comments
 (0)