Skip to content

Commit 68c7600

Browse files
geoffw0geoffw0
committed
Swift: Allow trivial taint-like flow.
1 parent 0251fb2 commit 68c7600

File tree

3 files changed

+41
-7
lines changed

3 files changed

+41
-7
lines changed

‎swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,12 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
8484
flowstate = "String" // `String` length flowing into `NSString`
8585
)
8686
}
87+
88+
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
89+
// allow flow through `+` and `-`.
90+
node2.asExpr().(AddExpr).getAnOperand() = node1.asExpr() or
91+
node2.asExpr().(SubExpr).getAnOperand() = node1.asExpr()
92+
}
8793
}
8894

8995
from

‎swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.expected

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,36 @@
11
edges
2+
| StringLengthConflation.swift:101:34:101:36 | .count : | StringLengthConflation.swift:101:34:101:44 | ... call to -(_:_:) ... |
3+
| StringLengthConflation.swift:102:36:102:38 | .count : | StringLengthConflation.swift:102:36:102:46 | ... call to -(_:_:) ... |
4+
| StringLengthConflation.swift:107:36:107:38 | .count : | StringLengthConflation.swift:107:36:107:46 | ... call to -(_:_:) ... |
5+
| StringLengthConflation.swift:108:38:108:40 | .count : | StringLengthConflation.swift:108:38:108:48 | ... call to -(_:_:) ... |
6+
| StringLengthConflation.swift:113:34:113:36 | .count : | StringLengthConflation.swift:113:34:113:44 | ... call to -(_:_:) ... |
7+
| StringLengthConflation.swift:114:36:114:38 | .count : | StringLengthConflation.swift:114:36:114:46 | ... call to -(_:_:) ... |
8+
| StringLengthConflation.swift:120:28:120:30 | .count : | StringLengthConflation.swift:120:28:120:38 | ... call to -(_:_:) ... |
29
nodes
310
| StringLengthConflation.swift:72:33:72:35 | .count | semmle.label | .count |
411
| StringLengthConflation.swift:78:47:78:49 | .count | semmle.label | .count |
12+
| StringLengthConflation.swift:101:34:101:36 | .count : | semmle.label | .count : |
13+
| StringLengthConflation.swift:101:34:101:44 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
14+
| StringLengthConflation.swift:102:36:102:38 | .count : | semmle.label | .count : |
15+
| StringLengthConflation.swift:102:36:102:46 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
16+
| StringLengthConflation.swift:107:36:107:38 | .count : | semmle.label | .count : |
17+
| StringLengthConflation.swift:107:36:107:46 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
18+
| StringLengthConflation.swift:108:38:108:40 | .count : | semmle.label | .count : |
19+
| StringLengthConflation.swift:108:38:108:48 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
20+
| StringLengthConflation.swift:113:34:113:36 | .count : | semmle.label | .count : |
21+
| StringLengthConflation.swift:113:34:113:44 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
22+
| StringLengthConflation.swift:114:36:114:38 | .count : | semmle.label | .count : |
23+
| StringLengthConflation.swift:114:36:114:46 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
24+
| StringLengthConflation.swift:120:28:120:30 | .count : | semmle.label | .count : |
25+
| StringLengthConflation.swift:120:28:120:38 | ... call to -(_:_:) ... | semmle.label | ... call to -(_:_:) ... |
526
subpaths
627
#select
728
| StringLengthConflation.swift:72:33:72:35 | .count | StringLengthConflation.swift:72:33:72:35 | .count | StringLengthConflation.swift:72:33:72:35 | .count | This String length is used in an NSString, but it may not be equivalent. |
829
| StringLengthConflation.swift:78:47:78:49 | .count | StringLengthConflation.swift:78:47:78:49 | .count | StringLengthConflation.swift:78:47:78:49 | .count | This String length is used in an NSString, but it may not be equivalent. |
30+
| StringLengthConflation.swift:101:34:101:44 | ... call to -(_:_:) ... | StringLengthConflation.swift:101:34:101:36 | .count : | StringLengthConflation.swift:101:34:101:44 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
31+
| StringLengthConflation.swift:102:36:102:46 | ... call to -(_:_:) ... | StringLengthConflation.swift:102:36:102:38 | .count : | StringLengthConflation.swift:102:36:102:46 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
32+
| StringLengthConflation.swift:107:36:107:46 | ... call to -(_:_:) ... | StringLengthConflation.swift:107:36:107:38 | .count : | StringLengthConflation.swift:107:36:107:46 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
33+
| StringLengthConflation.swift:108:38:108:48 | ... call to -(_:_:) ... | StringLengthConflation.swift:108:38:108:40 | .count : | StringLengthConflation.swift:108:38:108:48 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
34+
| StringLengthConflation.swift:113:34:113:44 | ... call to -(_:_:) ... | StringLengthConflation.swift:113:34:113:36 | .count : | StringLengthConflation.swift:113:34:113:44 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
35+
| StringLengthConflation.swift:114:36:114:46 | ... call to -(_:_:) ... | StringLengthConflation.swift:114:36:114:38 | .count : | StringLengthConflation.swift:114:36:114:46 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
36+
| StringLengthConflation.swift:120:28:120:38 | ... call to -(_:_:) ... | StringLengthConflation.swift:120:28:120:30 | .count : | StringLengthConflation.swift:120:28:120:38 | ... call to -(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |

‎swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.swift

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -98,26 +98,26 @@ func test(s: String) {
9898

9999
let nstr1 = ns.character(at: ns.length - 1) // GOOD
100100
let nmstr1 = nms.character(at: nms.length - 1) // GOOD
101-
let nstr2 = ns.character(at: s.count - 1) // BAD: String length used in NSString [NOT DETECTED]
102-
let nmstr2 = nms.character(at: s.count - 1) // BAD: String length used in NString [NOT DETECTED]
101+
let nstr2 = ns.character(at: s.count - 1) // BAD: String length used in NSString
102+
let nmstr2 = nms.character(at: s.count - 1) // BAD: String length used in NString
103103
print("character '\(nstr1)' '\(nmstr1)' / '\(nstr2)' '\(nmstr2)'")
104104

105105
let nstr3 = ns.substring(from: ns.length - 1) // GOOD
106106
let nmstr3 = nms.substring(from: nms.length - 1) // GOOD
107-
let nstr4 = ns.substring(from: s.count - 1) // BAD: String length used in NSString [NOT DETECTED]
108-
let nmstr4 = nms.substring(from: s.count - 1) // BAD: String length used in NString [NOT DETECTED]
107+
let nstr4 = ns.substring(from: s.count - 1) // BAD: String length used in NSString
108+
let nmstr4 = nms.substring(from: s.count - 1) // BAD: String length used in NString
109109
print("substring from '\(nstr3)' '\(nmstr3)' / '\(nstr4)' '\(nmstr4)'")
110110

111111
let nstr5 = ns.substring(to: ns.length - 1) // GOOD
112112
let nmstr5 = nms.substring(to: nms.length - 1) // GOOD
113-
let nstr6 = ns.substring(to: s.count - 1) // BAD: String length used in NSString [NOT DETECTED]
114-
let nmstr6 = nms.substring(to: s.count - 1) // BAD: String length used in NString [NOT DETECTED]
113+
let nstr6 = ns.substring(to: s.count - 1) // BAD: String length used in NSString
114+
let nmstr6 = nms.substring(to: s.count - 1) // BAD: String length used in NString
115115
print("substring to '\(nstr5)' '\(nmstr5)' / '\(nstr6)' '\(nmstr6)'")
116116

117117
let nmstr7 = NSMutableString(string: s)
118118
nmstr7.insert("*", at: nms.length - 1) // GOOD
119119
let nmstr8 = NSMutableString(string: s)
120-
nmstr8.insert("*", at: s.count - 1) // BAD: String length used in NSString [NOT DETECTED]
120+
nmstr8.insert("*", at: s.count - 1) // BAD: String length used in NSString
121121
print("insert '\(nmstr7)' / '\(nmstr8)'")
122122
}
123123

0 commit comments

Comments
 (0)