Skip to content

Commit 2584099

Browse files
geoffw0geoffw0
committed
Swift: Use a slightly different approach to fix false positive.
1 parent 7b96cb0 commit 2584099

File tree

3 files changed

+47
-80
lines changed

3 files changed

+47
-80
lines changed

‎swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.ql

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ import DataFlow::PathGraph
2020
/**
2121
* An `Expr` that is stored in a local database.
2222
*/
23-
abstract class Stored extends Expr { }
23+
abstract class Stored extends DataFlow::Node { }
2424

2525
/**
2626
* An `Expr` that is stored with the Core Data library.
@@ -33,7 +33,7 @@ class CoreDataStore extends Stored {
3333
c.getAMember() = f and
3434
f.getName() = ["setValue(_:forKey:)", "setPrimitiveValue(_:forKey:)"] and
3535
call.getStaticTarget() = f and
36-
call.getArgument(0).getExpr() = this
36+
call.getArgument(0).getExpr() = this.asExpr()
3737
)
3838
}
3939
}
@@ -43,10 +43,13 @@ class CoreDataStore extends Stored {
4343
*/
4444
class RealmStore extends Stored {
4545
RealmStore() {
46-
// any access into a class derived from `RealmSwiftObject` is a sink
46+
// any write into a class derived from `RealmSwiftObject` is a sink. For
47+
// example in `realmObj.data = sensitive` the post-update node corresponding
48+
// with `realmObj.data` is a sink.
4749
exists(ClassDecl cd |
4850
cd.getABaseTypeDecl*().getName() = "RealmSwiftObject" and
49-
this.getFullyConverted().getType() = cd.getType()
51+
this.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr().getFullyConverted().getType() =
52+
cd.getType()
5053
)
5154
}
5255
}
@@ -60,7 +63,7 @@ class CleartextStorageConfig extends TaintTracking::Configuration {
6063

6164
override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
6265

63-
override predicate isSink(DataFlow::Node node) { node.asExpr() instanceof Stored }
66+
override predicate isSink(DataFlow::Node node) { node instanceof Stored }
6467

6568
override predicate isSanitizerIn(DataFlow::Node node) {
6669
// make sources barriers so that we only report the closest instance
@@ -72,19 +75,10 @@ class CleartextStorageConfig extends TaintTracking::Configuration {
7275
node.asExpr() instanceof EncryptedExpr
7376
}
7477

75-
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
76-
// allow flow from a post-update node at the sink to the sink. For example
77-
// in `realmObj.data = sensitive` taint flows to the post-update node
78-
// corresponding with the sink `realmObj.data`, and we want to consider it
79-
// as reaching that sink.
80-
node1.(DataFlow::PostUpdateNode).getPreUpdateNode() = node2 and
81-
isSink(node2)
82-
}
83-
8478
override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
8579
// flow out from fields of a `RealmSwiftObject` at the sink, for example in
8680
// `obj.var = tainted; sink(obj)`.
87-
(isSink(node) or isAdditionalTaintStep(node, _)) and
81+
isSink(node) and
8882
exists(ClassDecl cd |
8983
c.getAReadContent().(DataFlow::Content::FieldContent).getField() = cd.getAMember() and
9084
cd.getABaseTypeDecl*().getName() = "RealmSwiftObject"
@@ -95,9 +89,19 @@ class CleartextStorageConfig extends TaintTracking::Configuration {
9589
}
9690
}
9791

92+
/**
93+
* Gets a prettier node to use in the results.
94+
*/
95+
DataFlow::Node cleanupNode(DataFlow::Node n) {
96+
result = n.(DataFlow::PostUpdateNode).getPreUpdateNode()
97+
or
98+
not n instanceof DataFlow::PostUpdateNode and
99+
result = n
100+
}
101+
98102
from CleartextStorageConfig config, DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode
99103
where config.hasFlowPath(sourceNode, sinkNode)
100-
select sinkNode.getNode(), sourceNode, sinkNode,
104+
select cleanupNode(sinkNode.getNode()), sourceNode, sinkNode,
101105
"This operation stores '" + sinkNode.getNode().toString() +
102106
"' in a database. It may contain unencrypted sensitive data from $@", sourceNode,
103107
sourceNode.getNode().toString()

‎swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected

Lines changed: 26 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
edges
2-
| file://:0:0:0:0 | [post] self : | file://:0:0:0:0 | self |
2+
| file://:0:0:0:0 | [post] self [data] : | file://:0:0:0:0 | [post] self |
33
| file://:0:0:0:0 | [post] self [data] : | file://:0:0:0:0 | [post] self : |
4-
| file://:0:0:0:0 | [post] self [data] : | file://:0:0:0:0 | self |
54
| file://:0:0:0:0 | value : | file://:0:0:0:0 | [post] self [data] : |
65
| testCoreData.swift:18:19:18:26 | value : | testCoreData.swift:19:12:19:12 | value |
76
| testCoreData.swift:31:3:31:3 | newValue : | testCoreData.swift:32:13:32:13 | newValue |
@@ -12,51 +11,27 @@ edges
1211
| testCoreData.swift:91:10:91:10 | passwd : | testCoreData.swift:95:15:95:15 | x |
1312
| testCoreData.swift:92:10:92:10 | passwd : | testCoreData.swift:96:15:96:15 | y |
1413
| testCoreData.swift:93:10:93:10 | passwd : | testCoreData.swift:97:15:97:15 | z |
15-
| testRealm.swift:16:6:16:6 | self : | file://:0:0:0:0 | self |
1614
| testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | value : |
17-
| testRealm.swift:34:2:34:2 | [post] a : | testRealm.swift:34:2:34:2 | a |
18-
| testRealm.swift:34:2:34:2 | [post] a : | testRealm.swift:34:2:34:2 | a : |
19-
| testRealm.swift:34:2:34:2 | [post] a [data] : | testRealm.swift:34:2:34:2 | a |
20-
| testRealm.swift:34:2:34:2 | [post] a [data] : | testRealm.swift:34:2:34:2 | a : |
21-
| testRealm.swift:34:2:34:2 | a : | testRealm.swift:16:6:16:6 | self : |
15+
| testRealm.swift:34:2:34:2 | [post] a [data] : | testRealm.swift:34:2:34:2 | [post] a |
2216
| testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:16:6:16:6 | value : |
23-
| testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:34:2:34:2 | [post] a : |
17+
| testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:34:2:34:2 | [post] a |
2418
| testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:34:2:34:2 | [post] a [data] : |
25-
| testRealm.swift:42:2:42:2 | [post] c : | testRealm.swift:42:2:42:2 | c |
26-
| testRealm.swift:42:2:42:2 | [post] c : | testRealm.swift:42:2:42:2 | c : |
27-
| testRealm.swift:42:2:42:2 | [post] c [data] : | testRealm.swift:42:2:42:2 | c |
28-
| testRealm.swift:42:2:42:2 | [post] c [data] : | testRealm.swift:42:2:42:2 | c : |
29-
| testRealm.swift:42:2:42:2 | c : | testRealm.swift:16:6:16:6 | self : |
19+
| testRealm.swift:42:2:42:2 | [post] c [data] : | testRealm.swift:42:2:42:2 | [post] c |
3020
| testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:16:6:16:6 | value : |
31-
| testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:42:2:42:2 | [post] c : |
21+
| testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:42:2:42:2 | [post] c |
3222
| testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:42:2:42:2 | [post] c [data] : |
33-
| testRealm.swift:52:2:52:3 | ...! : | testRealm.swift:16:6:16:6 | self : |
34-
| testRealm.swift:52:2:52:3 | [post] ...! : | testRealm.swift:52:2:52:3 | ...! |
35-
| testRealm.swift:52:2:52:3 | [post] ...! : | testRealm.swift:52:2:52:3 | ...! : |
36-
| testRealm.swift:52:2:52:3 | [post] ...! [data] : | testRealm.swift:52:2:52:3 | ...! |
37-
| testRealm.swift:52:2:52:3 | [post] ...! [data] : | testRealm.swift:52:2:52:3 | ...! : |
23+
| testRealm.swift:52:2:52:3 | [post] ...! [data] : | testRealm.swift:52:2:52:3 | [post] ...! |
3824
| testRealm.swift:52:12:52:12 | myPassword : | testRealm.swift:16:6:16:6 | value : |
39-
| testRealm.swift:52:12:52:12 | myPassword : | testRealm.swift:52:2:52:3 | [post] ...! : |
25+
| testRealm.swift:52:12:52:12 | myPassword : | testRealm.swift:52:2:52:3 | [post] ...! |
4026
| testRealm.swift:52:12:52:12 | myPassword : | testRealm.swift:52:2:52:3 | [post] ...! [data] : |
41-
| testRealm.swift:59:2:59:2 | [post] g : | testRealm.swift:59:2:59:2 | g |
42-
| testRealm.swift:59:2:59:2 | [post] g : | testRealm.swift:59:2:59:2 | g : |
43-
| testRealm.swift:59:2:59:2 | [post] g : | testRealm.swift:60:2:60:2 | g |
44-
| testRealm.swift:59:2:59:2 | [post] g : | testRealm.swift:60:2:60:2 | g : |
45-
| testRealm.swift:59:2:59:2 | [post] g [data] : | testRealm.swift:59:2:59:2 | g |
46-
| testRealm.swift:59:2:59:2 | [post] g [data] : | testRealm.swift:59:2:59:2 | g : |
47-
| testRealm.swift:59:2:59:2 | [post] g [data] : | testRealm.swift:60:2:60:2 | g |
48-
| testRealm.swift:59:2:59:2 | [post] g [data] : | testRealm.swift:60:2:60:2 | g : |
49-
| testRealm.swift:59:2:59:2 | g : | testRealm.swift:16:6:16:6 | self : |
50-
| testRealm.swift:59:2:59:2 | g : | testRealm.swift:60:2:60:2 | g |
51-
| testRealm.swift:59:2:59:2 | g : | testRealm.swift:60:2:60:2 | g : |
27+
| testRealm.swift:59:2:59:2 | [post] g [data] : | testRealm.swift:59:2:59:2 | [post] g |
5228
| testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:16:6:16:6 | value : |
53-
| testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:59:2:59:2 | [post] g : |
29+
| testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:59:2:59:2 | [post] g |
5430
| testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:59:2:59:2 | [post] g [data] : |
55-
| testRealm.swift:60:2:60:2 | g : | testRealm.swift:16:6:16:6 | self : |
5631
nodes
32+
| file://:0:0:0:0 | [post] self | semmle.label | [post] self |
5733
| file://:0:0:0:0 | [post] self : | semmle.label | [post] self : |
5834
| file://:0:0:0:0 | [post] self [data] : | semmle.label | [post] self [data] : |
59-
| file://:0:0:0:0 | self | semmle.label | self |
6035
| file://:0:0:0:0 | value : | semmle.label | value : |
6136
| testCoreData.swift:18:19:18:26 | value : | semmle.label | value : |
6237
| testCoreData.swift:19:12:19:12 | value | semmle.label | value |
@@ -78,44 +53,33 @@ nodes
7853
| testCoreData.swift:95:15:95:15 | x | semmle.label | x |
7954
| testCoreData.swift:96:15:96:15 | y | semmle.label | y |
8055
| testCoreData.swift:97:15:97:15 | z | semmle.label | z |
81-
| testRealm.swift:16:6:16:6 | self : | semmle.label | self : |
8256
| testRealm.swift:16:6:16:6 | value : | semmle.label | value : |
83-
| testRealm.swift:34:2:34:2 | [post] a : | semmle.label | [post] a : |
57+
| testRealm.swift:34:2:34:2 | [post] a | semmle.label | [post] a |
8458
| testRealm.swift:34:2:34:2 | [post] a [data] : | semmle.label | [post] a [data] : |
85-
| testRealm.swift:34:2:34:2 | a | semmle.label | a |
86-
| testRealm.swift:34:2:34:2 | a : | semmle.label | a : |
8759
| testRealm.swift:34:11:34:11 | myPassword : | semmle.label | myPassword : |
88-
| testRealm.swift:42:2:42:2 | [post] c : | semmle.label | [post] c : |
60+
| testRealm.swift:42:2:42:2 | [post] c | semmle.label | [post] c |
8961
| testRealm.swift:42:2:42:2 | [post] c [data] : | semmle.label | [post] c [data] : |
90-
| testRealm.swift:42:2:42:2 | c | semmle.label | c |
91-
| testRealm.swift:42:2:42:2 | c : | semmle.label | c : |
9262
| testRealm.swift:42:11:42:11 | myPassword : | semmle.label | myPassword : |
93-
| testRealm.swift:52:2:52:3 | ...! | semmle.label | ...! |
94-
| testRealm.swift:52:2:52:3 | ...! : | semmle.label | ...! : |
95-
| testRealm.swift:52:2:52:3 | [post] ...! : | semmle.label | [post] ...! : |
63+
| testRealm.swift:52:2:52:3 | [post] ...! | semmle.label | [post] ...! |
9664
| testRealm.swift:52:2:52:3 | [post] ...! [data] : | semmle.label | [post] ...! [data] : |
9765
| testRealm.swift:52:12:52:12 | myPassword : | semmle.label | myPassword : |
98-
| testRealm.swift:59:2:59:2 | [post] g : | semmle.label | [post] g : |
66+
| testRealm.swift:59:2:59:2 | [post] g | semmle.label | [post] g |
9967
| testRealm.swift:59:2:59:2 | [post] g [data] : | semmle.label | [post] g [data] : |
100-
| testRealm.swift:59:2:59:2 | g | semmle.label | g |
101-
| testRealm.swift:59:2:59:2 | g : | semmle.label | g : |
10268
| testRealm.swift:59:11:59:11 | myPassword : | semmle.label | myPassword : |
103-
| testRealm.swift:60:2:60:2 | g | semmle.label | g |
104-
| testRealm.swift:60:2:60:2 | g : | semmle.label | g : |
10569
subpaths
106-
| testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self : | testRealm.swift:34:2:34:2 | [post] a : |
70+
| testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self : | testRealm.swift:34:2:34:2 | [post] a |
10771
| testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self [data] : | testRealm.swift:34:2:34:2 | [post] a [data] : |
108-
| testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self : | testRealm.swift:42:2:42:2 | [post] c : |
72+
| testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self : | testRealm.swift:42:2:42:2 | [post] c |
10973
| testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self [data] : | testRealm.swift:42:2:42:2 | [post] c [data] : |
110-
| testRealm.swift:52:12:52:12 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self : | testRealm.swift:52:2:52:3 | [post] ...! : |
74+
| testRealm.swift:52:12:52:12 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self : | testRealm.swift:52:2:52:3 | [post] ...! |
11175
| testRealm.swift:52:12:52:12 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self [data] : | testRealm.swift:52:2:52:3 | [post] ...! [data] : |
112-
| testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self : | testRealm.swift:59:2:59:2 | [post] g : |
76+
| testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self : | testRealm.swift:59:2:59:2 | [post] g |
11377
| testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:16:6:16:6 | value : | file://:0:0:0:0 | [post] self [data] : | testRealm.swift:59:2:59:2 | [post] g [data] : |
11478
#select
115-
| file://:0:0:0:0 | self | testRealm.swift:34:11:34:11 | myPassword : | file://:0:0:0:0 | self | This operation stores 'self' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:34:11:34:11 | myPassword : | myPassword |
116-
| file://:0:0:0:0 | self | testRealm.swift:42:11:42:11 | myPassword : | file://:0:0:0:0 | self | This operation stores 'self' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:42:11:42:11 | myPassword : | myPassword |
117-
| file://:0:0:0:0 | self | testRealm.swift:52:12:52:12 | myPassword : | file://:0:0:0:0 | self | This operation stores 'self' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:52:12:52:12 | myPassword : | myPassword |
118-
| file://:0:0:0:0 | self | testRealm.swift:59:11:59:11 | myPassword : | file://:0:0:0:0 | self | This operation stores 'self' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:59:11:59:11 | myPassword : | myPassword |
79+
| file://:0:0:0:0 | self | testRealm.swift:34:11:34:11 | myPassword : | file://:0:0:0:0 | [post] self | This operation stores '[post] self' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:34:11:34:11 | myPassword : | myPassword |
80+
| file://:0:0:0:0 | self | testRealm.swift:42:11:42:11 | myPassword : | file://:0:0:0:0 | [post] self | This operation stores '[post] self' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:42:11:42:11 | myPassword : | myPassword |
81+
| file://:0:0:0:0 | self | testRealm.swift:52:12:52:12 | myPassword : | file://:0:0:0:0 | [post] self | This operation stores '[post] self' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:52:12:52:12 | myPassword : | myPassword |
82+
| file://:0:0:0:0 | self | testRealm.swift:59:11:59:11 | myPassword : | file://:0:0:0:0 | [post] self | This operation stores '[post] self' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:59:11:59:11 | myPassword : | myPassword |
11983
| testCoreData.swift:19:12:19:12 | value | testCoreData.swift:61:25:61:25 | password : | testCoreData.swift:19:12:19:12 | value | This operation stores 'value' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:61:25:61:25 | password : | password |
12084
| testCoreData.swift:32:13:32:13 | newValue | testCoreData.swift:64:16:64:16 | password : | testCoreData.swift:32:13:32:13 | newValue | This operation stores 'newValue' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:64:16:64:16 | password : | password |
12185
| testCoreData.swift:48:15:48:15 | password | testCoreData.swift:48:15:48:15 | password | testCoreData.swift:48:15:48:15 | password | This operation stores 'password' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:48:15:48:15 | password | password |
@@ -127,8 +91,7 @@ subpaths
12791
| testCoreData.swift:95:15:95:15 | x | testCoreData.swift:91:10:91:10 | passwd : | testCoreData.swift:95:15:95:15 | x | This operation stores 'x' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:91:10:91:10 | passwd : | passwd |
12892
| testCoreData.swift:96:15:96:15 | y | testCoreData.swift:92:10:92:10 | passwd : | testCoreData.swift:96:15:96:15 | y | This operation stores 'y' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:92:10:92:10 | passwd : | passwd |
12993
| testCoreData.swift:97:15:97:15 | z | testCoreData.swift:93:10:93:10 | passwd : | testCoreData.swift:97:15:97:15 | z | This operation stores 'z' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:93:10:93:10 | passwd : | passwd |
130-
| testRealm.swift:34:2:34:2 | a | testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:34:2:34:2 | a | This operation stores 'a' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:34:11:34:11 | myPassword : | myPassword |
131-
| testRealm.swift:42:2:42:2 | c | testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:42:2:42:2 | c | This operation stores 'c' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:42:11:42:11 | myPassword : | myPassword |
132-
| testRealm.swift:52:2:52:3 | ...! | testRealm.swift:52:12:52:12 | myPassword : | testRealm.swift:52:2:52:3 | ...! | This operation stores '...!' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:52:12:52:12 | myPassword : | myPassword |
133-
| testRealm.swift:59:2:59:2 | g | testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:59:2:59:2 | g | This operation stores 'g' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:59:11:59:11 | myPassword : | myPassword |
134-
| testRealm.swift:60:2:60:2 | g | testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:60:2:60:2 | g | This operation stores 'g' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:59:11:59:11 | myPassword : | myPassword |
94+
| testRealm.swift:34:2:34:2 | a | testRealm.swift:34:11:34:11 | myPassword : | testRealm.swift:34:2:34:2 | [post] a | This operation stores '[post] a' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:34:11:34:11 | myPassword : | myPassword |
95+
| testRealm.swift:42:2:42:2 | c | testRealm.swift:42:11:42:11 | myPassword : | testRealm.swift:42:2:42:2 | [post] c | This operation stores '[post] c' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:42:11:42:11 | myPassword : | myPassword |
96+
| testRealm.swift:52:2:52:3 | ...! | testRealm.swift:52:12:52:12 | myPassword : | testRealm.swift:52:2:52:3 | [post] ...! | This operation stores '[post] ...!' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:52:12:52:12 | myPassword : | myPassword |
97+
| testRealm.swift:59:2:59:2 | g | testRealm.swift:59:11:59:11 | myPassword : | testRealm.swift:59:2:59:2 | [post] g | This operation stores '[post] g' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:59:11:59:11 | myPassword : | myPassword |

‎swift/ql/test/query-tests/Security/CWE-311/testRealm.swift

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ func test1(realm : Realm, myPassword : String, myHashedPassword : String) {
5757
let g = MyRealmSwiftObject()
5858
g.data = "" // GOOD (not sensitive)
5959
g.data = myPassword // BAD
60-
g.data = "" // GOOD (not sensitive) // [FALSE POSITIVE]
60+
g.data = "" // GOOD (not sensitive)
6161
}
6262

6363
// limitation: its possible to configure a Realm DB to be stored encrypted, if this is done correctly

0 commit comments

Comments
 (0)