11//codeql-extractor-options: -module-name Crypto
22
3+ struct SHA256 {
4+ static func hash< D> ( data: D ) -> [ UInt8 ] {
5+ return [ ]
6+ }
7+
8+ func update< D> ( data: D ) { }
9+ func update( bufferPointer: UnsafeRawBufferPointer ) { }
10+ func finalize( ) -> [ UInt8 ] { return [ ] }
11+ }
12+
13+ struct SHA384 {
14+ static func hash< D> ( data: D ) -> [ UInt8 ] {
15+ return [ ]
16+ }
17+
18+ func update< D> ( data: D ) { }
19+ func update( bufferPointer: UnsafeRawBufferPointer ) { }
20+ func finalize( ) -> [ UInt8 ] { return [ ] }
21+ }
22+
23+ struct SHA512 {
24+ static func hash< D> ( data: D ) -> [ UInt8 ] {
25+ return [ ]
26+ }
27+
28+ func update< D> ( data: D ) { }
29+ func update( bufferPointer: UnsafeRawBufferPointer ) { }
30+ func finalize( ) -> [ UInt8 ] { return [ ] }
31+ }
32+
33+
334enum Insecure {
435 struct MD5 {
536 static func hash< D> ( data: D ) -> [ UInt8 ] {
@@ -21,48 +52,119 @@ enum Insecure {
2152 }
2253}
2354
24- func test1 ( passwd : UnsafeRawBufferPointer , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
55+ func testHashMethods ( passwd : UnsafeRawBufferPointer , cert : String , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
2556 var hash = Crypto . Insecure. MD5. hash ( data: passwd) // BAD
57+ hash = Crypto . Insecure. MD5. hash ( data: cert) // BAD [NOT DETECTED]
2658 hash = Crypto . Insecure. MD5. hash ( data: encrypted_passwd) // GOOD (not sensitive)
2759 hash = Crypto . Insecure. MD5. hash ( data: account_no) // BAD [NOT DETECTED]
2860 hash = Crypto . Insecure. MD5. hash ( data: credit_card_no) // BAD
29- }
61+ hash = Crypto . Insecure . MD5 . hash ( data : credit_card_no ) // BAD
3062
31- func test2 ( passwd : String , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
32- var hash = Crypto . Insecure. SHA1. hash ( data: passwd ) // BAD
63+ hash = Crypto . Insecure . SHA1 . hash ( data : passwd ) // BAD
64+ hash = Crypto . Insecure. SHA1. hash ( data: cert ) // BAD [NOT DETECTED]
3365 hash = Crypto . Insecure. SHA1. hash ( data: encrypted_passwd) // GOOD (not sensitive)
3466 hash = Crypto . Insecure. SHA1. hash ( data: account_no) // BAD [NOT DETECTED]
3567 hash = Crypto . Insecure. SHA1. hash ( data: credit_card_no) // BAD
68+
69+ hash = Crypto . SHA256. hash ( data: passwd) // BAD [NOT DETECTED] not a computationally hard hash
70+ hash = Crypto . SHA256. hash ( data: cert) // GOOD
71+ hash = Crypto . SHA256. hash ( data: account_no) // GOOD
72+ hash = Crypto . SHA256. hash ( data: credit_card_no) // GOOD
73+ hash = Crypto . SHA256. hash ( data: credit_card_no) // GOOD
74+
75+ hash = Crypto . SHA256. hash ( data: passwd) // BAD [NOT DETECTED] not a computationally hard hash
76+ hash = Crypto . SHA384. hash ( data: cert) // GOOD
77+ hash = Crypto . SHA384. hash ( data: account_no) // GOOD
78+ hash = Crypto . SHA384. hash ( data: credit_card_no) // GOOD
79+ hash = Crypto . SHA384. hash ( data: credit_card_no) // GOOD
80+
81+ hash = Crypto . SHA256. hash ( data: passwd) // BAD [NOT DETECTED] not a computationally hard hash
82+ hash = Crypto . SHA512. hash ( data: cert) // GOOD
83+ hash = Crypto . SHA512. hash ( data: account_no) // GOOD
84+ hash = Crypto . SHA512. hash ( data: credit_card_no) // GOOD
85+ hash = Crypto . SHA512. hash ( data: credit_card_no) // GOOD
3686}
3787
38- func test3 ( passwd : String , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
88+ func testMD5UpdateWithData ( passwd : String , cert : String , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
3989 var hash = Crypto . Insecure. MD5 ( )
4090 hash. update ( data: passwd) // BAD
91+ hash. update ( data: cert) // BAD [NOT DETECTED]
4192 hash. update ( data: encrypted_passwd) // GOOD (not sensitive)
4293 hash. update ( data: account_no) // BAD [NOT DETECTED]
4394 hash. update ( data: credit_card_no) // BAD
4495}
4596
46- func test4 ( passwd : String , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
97+ func testSHA1UpdateWithData ( passwd : String , cert : String , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
4798 var hash = Crypto . Insecure. SHA1 ( )
4899 hash. update ( data: passwd) // BAD
100+ hash. update ( data: cert) // BAD [NOT DETECTED]
49101 hash. update ( data: encrypted_passwd) // GOOD (not sensitive)
50102 hash. update ( data: account_no) // BAD [NOT DETECTED]
51103 hash. update ( data: credit_card_no) // BAD
52104}
53105
54- func test5( passwd : UnsafeRawBufferPointer , encrypted_passwd : UnsafeRawBufferPointer , account_no : UnsafeRawBufferPointer , credit_card_no : UnsafeRawBufferPointer ) {
106+ func testSHA256UpdateWithData( passwd : String , cert: String , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
107+ var hash = Crypto . SHA256 ( )
108+ hash. update ( data: passwd) // BAD [NOT DETECTED] not a computationally hard hash
109+ hash. update ( data: cert) // GOOD
110+ hash. update ( data: account_no) // GOOD
111+ hash. update ( data: credit_card_no) // GOOD
112+ }
113+
114+ func testSHA384UpdateWithData( passwd : String , cert: String , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
115+ var hash = Crypto . SHA384 ( )
116+ hash. update ( data: passwd) // BAD [NOT DETECTED] not a computationally hard hash
117+ hash. update ( data: cert) // GOOD
118+ hash. update ( data: account_no) // GOOD
119+ hash. update ( data: credit_card_no) // GOOD
120+ }
121+
122+ func testSHA512UpdateWithData( passwd : String , cert: String , encrypted_passwd : String , account_no : String , credit_card_no : String ) {
123+ var hash = Crypto . SHA512 ( )
124+ hash. update ( data: passwd) // BAD [NOT DETECTED] not a computationally hard hash
125+ hash. update ( data: cert) // GOOD
126+ hash. update ( data: account_no) // GOOD
127+ hash. update ( data: credit_card_no) // GOOD
128+ }
129+
130+ func testMD5UpdateWithUnsafeRawBufferPointer( passwd : UnsafeRawBufferPointer , cert: UnsafeRawBufferPointer , encrypted_passwd : UnsafeRawBufferPointer , account_no : UnsafeRawBufferPointer , credit_card_no : UnsafeRawBufferPointer ) {
55131 var hash = Crypto . Insecure. MD5 ( )
56132 hash. update ( bufferPointer: passwd) // BAD
133+ hash. update ( bufferPointer: cert) // BAD [NOT DETECTED]
57134 hash. update ( bufferPointer: encrypted_passwd) // GOOD (not sensitive)
58135 hash. update ( bufferPointer: account_no) // BAD [NOT DETECTED]
59136 hash. update ( bufferPointer: credit_card_no) // BAD
60137}
61138
62- func test6 ( passwd : UnsafeRawBufferPointer , encrypted_passwd : UnsafeRawBufferPointer , account_no : UnsafeRawBufferPointer , credit_card_no : UnsafeRawBufferPointer ) {
139+ func testSHA1UpdateWithUnsafeRawBufferPointer ( passwd : UnsafeRawBufferPointer , cert : UnsafeRawBufferPointer , encrypted_passwd : UnsafeRawBufferPointer , account_no : UnsafeRawBufferPointer , credit_card_no : UnsafeRawBufferPointer ) {
63140 var hash = Crypto . Insecure. SHA1 ( )
64141 hash. update ( bufferPointer: passwd) // BAD
142+ hash. update ( bufferPointer: cert) // BAD [NOT DETECTED]
65143 hash. update ( bufferPointer: encrypted_passwd) // GOOD (not sensitive)
66144 hash. update ( bufferPointer: account_no) // BAD [NOT DETECTED]
67145 hash. update ( bufferPointer: credit_card_no) // BAD
68146}
147+
148+ func testSHA256UpdateWithUnsafeRawBufferPointer( passwd : UnsafeRawBufferPointer , cert: UnsafeRawBufferPointer , encrypted_passwd : UnsafeRawBufferPointer , account_no : UnsafeRawBufferPointer , credit_card_no : UnsafeRawBufferPointer ) {
149+ var hash = Crypto . SHA256 ( )
150+ hash. update ( bufferPointer: passwd) // BAD [NOT DETECTED] not a computationally hard hash
151+ hash. update ( bufferPointer: cert) // GOOD
152+ hash. update ( bufferPointer: account_no) // GOOD
153+ hash. update ( bufferPointer: credit_card_no) // GOOD
154+ }
155+
156+ func testSHA384UpdateWithUnsafeRawBufferPointer( passwd : UnsafeRawBufferPointer , cert: UnsafeRawBufferPointer , encrypted_passwd : UnsafeRawBufferPointer , account_no : UnsafeRawBufferPointer , credit_card_no : UnsafeRawBufferPointer ) {
157+ var hash = Crypto . SHA384 ( )
158+ hash. update ( bufferPointer: passwd) // BAD [NOT DETECTED] not a computationally hard hash
159+ hash. update ( bufferPointer: cert) // GOOD
160+ hash. update ( bufferPointer: account_no) // GOOD
161+ hash. update ( bufferPointer: credit_card_no) // GOOD
162+ }
163+
164+ func testSHA512UpdateWithUnsafeRawBufferPointer( passwd : UnsafeRawBufferPointer , cert: UnsafeRawBufferPointer , encrypted_passwd : UnsafeRawBufferPointer , account_no : UnsafeRawBufferPointer , credit_card_no : UnsafeRawBufferPointer ) {
165+ var hash = Crypto . SHA512 ( )
166+ hash. update ( bufferPointer: passwd) // BAD [NOT DETECTED] not a computationally hard hash
167+ hash. update ( bufferPointer: cert) // GOOD
168+ hash. update ( bufferPointer: account_no) // GOOD
169+ hash. update ( bufferPointer: credit_card_no) // GOOD
170+ }
0 commit comments