Skip to content

Commit c635895

Browse files
geoffw0geoffw0
committed
Swift: Documentation.
1 parent 8d9653a commit c635895

File tree

6 files changed

+36
-10
lines changed

6 files changed

+36
-10
lines changed

‎swift/ql/src/queries/Security/CWE-095/UnsafeWebViewFetch.qhelp

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,29 +3,29 @@
33
"qhelp.dtd">
44
<qhelp>
55
<overview>
6-
<p>TODO</p>
6+
<p>Fetching data in a WebView without restricting the base URL may allow an attacker to access sensitive local data, for example using <code>file://</code>. Data can then be extracted from the software using the URL of a machine under the attackers control. More generally, an attacker may use a URL under their control as part of a cross-site scripting attack.</p>
77

88
</overview>
99
<recommendation>
1010

11-
<p>TODO</p>
11+
<p>When loading HTML into a web view, always set the <code>baseURL</code> to an appropriate URL that you control, or to <code>about:blank</code>. Do not use <code>nil</code>, as this does not restrict URLs that can be resolved. Also do not use a <code>baseURL</code> that could itself be controlled by an attacker.</p>
1212

1313
</recommendation>
1414
<example>
1515

16-
<p>TODO</p>
16+
<p>In the following example, a call to <code>UIWebView.loadHTMLString</code> has the <code>baseURL</code> set to <code>nil</code>, which does not restrict URLs that can be resolved from within the web page.</p>
1717

18-
<sample src="StringLengthConflationBad.swift" />
18+
<sample src="UnsafeWebViewFetchBad.swift" />
1919

20-
<p>TODO</p>
20+
<p>To fix the problem, we set the <code>baseURL</code> to <code>about:blank</code>. This ensures that an attacker cannot resolve URLs that point to the local file system, or to web servers under their control.</p>
2121

22-
<sample src="StringLengthConflationGood.swift" />
22+
<sample src="UnsafeWebViewFetchGood.swift" />
2323

2424
</example>
2525
<references>
2626

2727
<li>
28-
<a href="TODO">TODO</a>
28+
<a href="https://www.allysonomalley.com/2018/12/03/ios-bug-hunting-web-view-xss/">iOS Bug Hunting - Web View XSS</a>
2929
</li>
3030

3131
</references>

‎swift/ql/src/queries/Security/CWE-095/UnsafeWebViewFetch.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* @name Unsafe WebView fetch
3-
* @description TODO
3+
* @description Fetching data in a WebView without restricting the base URL may allow an attacker to access sensitive local data, or enable cross-site scripting attack.
44
* @kind path-problem
55
* @problem.severity warning
66
* @security-severity 6.1

‎swift/ql/src/queries/Security/CWE-095/UnsafeWebViewFetchBad.swift

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,6 @@
11

2-
TODO
2+
let webview = UIWebView()
3+
4+
...
5+
6+
webview.loadHTMLString(htmlData, baseURL: nil) // BAD

‎swift/ql/src/queries/Security/CWE-095/UnsafeWebViewFetchGood.swift

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,6 @@
11

2-
TODO
2+
let webview = UIWebView()
3+
4+
...
5+
6+
webview.loadHTMLString(htmlData, baseURL: URL(string: "about:blank")) // GOOD

‎swift/ql/test/query-tests/Security/CWE-095/UnsafeWebViewFetch.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ edges
33
| UnsafeWebViewFetch.swift:94:10:94:37 | try ... : | UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() |
44
| UnsafeWebViewFetch.swift:94:10:94:37 | try ... : | UnsafeWebViewFetch.swift:164:21:164:35 | call to getRemoteData() : |
55
| UnsafeWebViewFetch.swift:94:10:94:37 | try ... : | UnsafeWebViewFetch.swift:167:25:167:39 | call to getRemoteData() |
6+
| UnsafeWebViewFetch.swift:94:10:94:37 | try ... : | UnsafeWebViewFetch.swift:206:17:206:31 | call to getRemoteData() : |
67
| UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:94:10:94:37 | try ... : |
78
| UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() : | UnsafeWebViewFetch.swift:121:25:121:25 | remoteString |
89
| UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() : | UnsafeWebViewFetch.swift:124:25:124:51 | ... call to +(_:_:) ... |
@@ -28,6 +29,8 @@ edges
2829
| UnsafeWebViewFetch.swift:164:21:164:35 | call to getRemoteData() : | UnsafeWebViewFetch.swift:188:48:188:58 | ...! |
2930
| UnsafeWebViewFetch.swift:164:21:164:35 | call to getRemoteData() : | UnsafeWebViewFetch.swift:200:90:200:99 | ...! |
3031
| UnsafeWebViewFetch.swift:164:21:164:35 | call to getRemoteData() : | UnsafeWebViewFetch.swift:201:91:201:100 | ...! |
32+
| UnsafeWebViewFetch.swift:206:17:206:31 | call to getRemoteData() : | UnsafeWebViewFetch.swift:210:25:210:25 | htmlData |
33+
| UnsafeWebViewFetch.swift:206:17:206:31 | call to getRemoteData() : | UnsafeWebViewFetch.swift:211:25:211:25 | htmlData |
3134
nodes
3235
| UnsafeWebViewFetch.swift:94:10:94:37 | try ... : | semmle.label | try ... : |
3336
| UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | semmle.label | call to ... : |
@@ -59,6 +62,9 @@ nodes
5962
| UnsafeWebViewFetch.swift:188:48:188:58 | ...! | semmle.label | ...! |
6063
| UnsafeWebViewFetch.swift:200:90:200:99 | ...! | semmle.label | ...! |
6164
| UnsafeWebViewFetch.swift:201:91:201:100 | ...! | semmle.label | ...! |
65+
| UnsafeWebViewFetch.swift:206:17:206:31 | call to getRemoteData() : | semmle.label | call to getRemoteData() : |
66+
| UnsafeWebViewFetch.swift:210:25:210:25 | htmlData | semmle.label | htmlData |
67+
| UnsafeWebViewFetch.swift:211:25:211:25 | htmlData | semmle.label | htmlData |
6268
subpaths
6369
#select
6470
| UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | Tainted data is used in a WebView fetch without restricting the base URL. |
@@ -71,3 +77,4 @@ subpaths
7177
| UnsafeWebViewFetch.swift:171:25:171:51 | ... call to +(_:_:) ... | UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:171:25:171:51 | ... call to +(_:_:) ... | Tainted data is used in a WebView fetch without restricting the base URL. |
7278
| UnsafeWebViewFetch.swift:186:25:186:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:186:25:186:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
7379
| UnsafeWebViewFetch.swift:188:25:188:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:188:25:188:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
80+
| UnsafeWebViewFetch.swift:210:25:210:25 | htmlData | UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:210:25:210:25 | htmlData | Tainted data is used in a WebView fetch without restricting the base URL. |

‎swift/ql/test/query-tests/Security/CWE-095/UnsafeWebViewFetch.swift

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,17 @@ func testWKWebView() {
201201
webview.load(remoteData, mimeType: "text/html", characterEncodingName: "utf-8", baseURL: remoteURL!) // BAD [NOT DETECTED]
202202
}
203203

204+
func testQHelpExamples() {
205+
let webview = UIWebView()
206+
let htmlData = getRemoteData()
207+
208+
// ...
209+
210+
webview.loadHTMLString(htmlData, baseURL: nil) // BAD
211+
webview.loadHTMLString(htmlData, baseURL: URL(string: "about:blank")) // GOOD
212+
}
213+
204214
testSimpleFlows()
205215
testUIWebView()
206216
testWKWebView()
217+
testQHelpExamples()

0 commit comments

Comments
 (0)