Swift: Qhelp and examples for both queries.

Author: geoffw0

swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.qhelp

@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+<overview>
+
+<p>Sensitive information that is stored unencrypted in a database is accessible to an attacker who gains access to that database. For example the information could be accessed by any process or user in a rooted device, or exposed through another vulnerability.</p>
+
+</overview>
+<recommendation>
+
+<p>Either encrypt the entire database, or ensure that each piece of sensitive information is encrypted before being stored. In general, decrypt sensitive information only at the point where it is necessary for it to be used in cleartext. Avoid storing sensitive information at all if you do not need to keep it.</p>
+
+</recommendation>
+<example>
+
+<p>The following example shows three cases of storing information using the Core Data library. In the 'BAD' case, the data that is stored is sensitive (a credit card number) and is not encrypted.  In the 'GOOD' cases, the data is either not sensitive or is protected with encryption.</p>
+
+<sample src="CleartextStorageDatabase.swift" />
+
+</example>
+<references>
+
+<li>
+  OWASP Top 10:2021:
+  <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">A02:2021 – Cryptographic Failures</a>
+</li>
+
+</references>
+</qhelp>

swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.swift

@@ -0,0 +1,15 @@
+
+func storeMyData(databaseObject : NSManagedObject, faveSong : String, creditCardNo : String) {
+	// ...
+
+	// GOOD: not sensitive information
+	databaseObject.setValue(faveSong, forKey: "myFaveSong")
+
+	// BAD: sensitive information saved in cleartext
+	databaseObject.setValue(creditCardNo, forKey: "myCreditCardNo")
+
+	// GOOD: encrypted sensitive information saved
+	databaseObject.setValue(encrypt(creditCardNo), forKey: "myCreditCardNo")
+
+	// ...
+}

swift/ql/src/queries/Security/CWE-311/CleartextTransmission.qhelp

@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+<overview>
+
+<p>Sensitive information that is transmitted without encryption may be accessible to an attacker.</p>
+
+</overview>
+<recommendation>
+
+<p>Ensure that sensitive information is always encrypted before being transmitted over the network. In general, decrypt sensitive information only at the point where it is necessary for it to be used in cleartext. Avoid transmitting sensitive information when it is not necessary to.</p>
+
+</recommendation>
+<example>
+
+<p>The following example shows three cases of transmitting information. In the 'BAD' case, the data transmitted is sensitive (a credit card number) and is not encrypted.  In the 'GOOD' cases, the data is either not sensitive or is protected with encryption.</p>
+
+<sample src="CleartextTransmission.swift" />
+
+</example>
+<references>
+
+<li>
+  OWASP Top 10:2021:
+  <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">A02:2021 – Cryptographic Failures</a>
+</li>
+
+</references>
+</qhelp>

swift/ql/src/queries/Security/CWE-311/CleartextTransmission.swift

@@ -0,0 +1,15 @@
+
+func transmitMyData(connection : NWConnection, faveSong : String, creditCardNo : String) {
+	// ...
+
+	// GOOD: not sensitive information
+	connection.send(content: faveSong, completion: .idempotent)
+
+	// BAD: sensitive information saved in cleartext
+	connection.send(content: creditCardNo, completion: .idempotent)
+
+	// GOOD: encrypted sensitive information saved
+	connection.send(content: encrypt(creditCardNo), completion: .idempotent
+
+	// ...
+}