|
11 | 11 | */ |
12 | 12 |
|
13 | 13 | import swift |
| 14 | +import codeql.swift.security.SensitiveExprs |
14 | 15 | import codeql.swift.dataflow.DataFlow |
| 16 | +import codeql.swift.dataflow.TaintTracking |
15 | 17 | import DataFlow::PathGraph |
16 | 18 |
|
17 | | -select "TODO" |
| 19 | +/** |
| 20 | + * An `Expr` that is transmitted over a network. |
| 21 | + */ |
| 22 | +abstract class Transmitted extends Expr { } |
| 23 | + |
| 24 | +/** |
| 25 | + * An `Expr` that is transmitted with `NWConnection.send`. |
| 26 | + */ |
| 27 | +class NWConnectionSend extends Transmitted { |
| 28 | + NWConnectionSend() { |
| 29 | + // `content` arg to `NWConnection.send` is a sink |
| 30 | + exists(ClassDecl c, AbstractFunctionDecl f, CallExpr call | |
| 31 | + c.getName() = "NWConnection" and |
| 32 | + c.getAMember() = f and |
| 33 | + f.getName() = "send(content:contentContext:isComplete:completion:)" and |
| 34 | + call.getFunction().(ApplyExpr).getStaticTarget() = f and |
| 35 | + call.getArgument(0).getExpr() = this |
| 36 | + ) |
| 37 | + } |
| 38 | +} |
| 39 | + |
| 40 | +/** |
| 41 | + * An `Expr` that is used to form a `URL`. Such expressions are very likely to |
| 42 | + * be transmitted over a network, because that's what URLs are for. |
| 43 | + */ |
| 44 | +class URL extends Transmitted { |
| 45 | + URL() { |
| 46 | + // `string` arg in `URL.init` is a sink |
| 47 | + // (we assume here that the URL goes on to be used in a network operation) |
| 48 | + exists(ClassDecl c, AbstractFunctionDecl f, CallExpr call | |
| 49 | + c.getName() = "URL" and |
| 50 | + c.getAMember() = f and |
| 51 | + f.getName() = ["init(string:)", "init(string:relativeTo:)"] and |
| 52 | + call.getFunction().(ApplyExpr).getStaticTarget() = f and |
| 53 | + call.getArgument(0).getExpr() = this |
| 54 | + ) |
| 55 | + } |
| 56 | +} |
| 57 | + |
| 58 | +/** |
| 59 | + * A taint configuration from sensitive information to expressions that are |
| 60 | + * transmitted over a network. |
| 61 | + */ |
| 62 | +class CleartextTransmissionConfig extends TaintTracking::Configuration { |
| 63 | + CleartextTransmissionConfig() { this = "CleartextTransmissionConfig" } |
| 64 | + |
| 65 | + override predicate isSource(DataFlow::Node node) { |
| 66 | + exists(SensitiveExpr e | |
| 67 | + node.asExpr() = e and |
| 68 | + not e.isProbablySafe() |
| 69 | + ) |
| 70 | + } |
| 71 | + |
| 72 | + override predicate isSink(DataFlow::Node node) { node.asExpr() instanceof Transmitted } |
| 73 | +} |
| 74 | + |
| 75 | +from CleartextTransmissionConfig config, DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode |
| 76 | +where config.hasFlowPath(sourceNode, sinkNode) |
| 77 | +select sinkNode.getNode(), sourceNode, sinkNode, |
| 78 | + "This operation transmits '" + sinkNode.getNode().toString() + |
| 79 | + "', which may contain unencrypted sensitive data from $@", sourceNode, |
| 80 | + sourceNode.getNode().toString() |
0 commit comments