Skip to content

Commit f05be77

Browse files
geoffw0geoffw0
committed
Swift: Recognize more array sources.
1 parent 7648e8f commit f05be77

File tree

3 files changed

+14
-3
lines changed

3 files changed

+14
-3
lines changed

‎swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ import DataFlow::PathGraph
2121
*/
2222
class StaticInitializationVectorSource extends Expr {
2323
StaticInitializationVectorSource() {
24-
this = any(ArrayExpr arr | arr.getType().getName() = "Array<UInt8>") or
24+
this instanceof ArrayExpr or
2525
this instanceof StringLiteralExpr or
2626
this instanceof NumberLiteralExpr
2727
}

‎swift/ql/test/query-tests/Security/CWE-1204/StaticInitializationVector.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ edges
88
| rncryptor.swift:61:19:61:27 | call to Data.init(_:) : | rncryptor.swift:79:133:79:133 | myConstIV2 |
99
| rncryptor.swift:61:24:61:24 | 123 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
1010
| rncryptor.swift:61:24:61:24 | 123 : | rncryptor.swift:61:19:61:27 | call to Data.init(_:) : |
11+
| rncryptor.swift:62:19:62:35 | call to Data.init(_:) : | rncryptor.swift:72:84:72:84 | myConstIV3 |
12+
| rncryptor.swift:62:19:62:35 | call to Data.init(_:) : | rncryptor.swift:81:105:81:105 | myConstIV3 |
13+
| rncryptor.swift:62:24:62:34 | [...] : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
14+
| rncryptor.swift:62:24:62:34 | [...] : | rncryptor.swift:62:19:62:35 | call to Data.init(_:) : |
1115
| rncryptor.swift:63:19:63:28 | call to Data.init(_:) : | rncryptor.swift:74:84:74:84 | myConstIV4 |
1216
| rncryptor.swift:63:19:63:28 | call to Data.init(_:) : | rncryptor.swift:83:113:83:113 | myConstIV4 |
1317
| rncryptor.swift:63:24:63:24 | iv : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : |
@@ -42,13 +46,17 @@ nodes
4246
| rncryptor.swift:60:24:60:24 | 0 : | semmle.label | 0 : |
4347
| rncryptor.swift:61:19:61:27 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
4448
| rncryptor.swift:61:24:61:24 | 123 : | semmle.label | 123 : |
49+
| rncryptor.swift:62:19:62:35 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
50+
| rncryptor.swift:62:24:62:34 | [...] : | semmle.label | [...] : |
4551
| rncryptor.swift:63:19:63:28 | call to Data.init(_:) : | semmle.label | call to Data.init(_:) : |
4652
| rncryptor.swift:63:24:63:24 | iv : | semmle.label | iv : |
4753
| rncryptor.swift:68:104:68:104 | myConstIV1 | semmle.label | myConstIV1 |
4854
| rncryptor.swift:70:104:70:104 | myConstIV2 | semmle.label | myConstIV2 |
55+
| rncryptor.swift:72:84:72:84 | myConstIV3 | semmle.label | myConstIV3 |
4956
| rncryptor.swift:74:84:74:84 | myConstIV4 | semmle.label | myConstIV4 |
5057
| rncryptor.swift:77:125:77:125 | myConstIV1 | semmle.label | myConstIV1 |
5158
| rncryptor.swift:79:133:79:133 | myConstIV2 | semmle.label | myConstIV2 |
59+
| rncryptor.swift:81:105:81:105 | myConstIV3 | semmle.label | myConstIV3 |
5260
| rncryptor.swift:83:113:83:113 | myConstIV4 | semmle.label | myConstIV4 |
5361
| test.swift:53:19:53:34 | iv : | semmle.label | iv : |
5462
| test.swift:54:17:54:17 | iv | semmle.label | iv |
@@ -78,13 +86,16 @@ nodes
7886
subpaths
7987
| rncryptor.swift:60:24:60:24 | 0 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:60:19:60:25 | call to Data.init(_:) : |
8088
| rncryptor.swift:61:24:61:24 | 123 : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:61:19:61:27 | call to Data.init(_:) : |
89+
| rncryptor.swift:62:24:62:34 | [...] : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:62:19:62:35 | call to Data.init(_:) : |
8190
| rncryptor.swift:63:24:63:24 | iv : | rncryptor.swift:5:5:5:29 | [summary param] 0 in Data.init(_:) : | file://:0:0:0:0 | [summary] to write: return (return) in Data.init(_:) : | rncryptor.swift:63:19:63:28 | call to Data.init(_:) : |
8291
#select
8392
| rncryptor.swift:68:104:68:104 | myConstIV1 | rncryptor.swift:60:24:60:24 | 0 : | rncryptor.swift:68:104:68:104 | myConstIV1 | The static value '0' is used as an initialization vector for encryption. |
8493
| rncryptor.swift:70:104:70:104 | myConstIV2 | rncryptor.swift:61:24:61:24 | 123 : | rncryptor.swift:70:104:70:104 | myConstIV2 | The static value '123' is used as an initialization vector for encryption. |
94+
| rncryptor.swift:72:84:72:84 | myConstIV3 | rncryptor.swift:62:24:62:34 | [...] : | rncryptor.swift:72:84:72:84 | myConstIV3 | The static value '[...]' is used as an initialization vector for encryption. |
8595
| rncryptor.swift:74:84:74:84 | myConstIV4 | rncryptor.swift:63:24:63:24 | iv : | rncryptor.swift:74:84:74:84 | myConstIV4 | The static value 'iv' is used as an initialization vector for encryption. |
8696
| rncryptor.swift:77:125:77:125 | myConstIV1 | rncryptor.swift:60:24:60:24 | 0 : | rncryptor.swift:77:125:77:125 | myConstIV1 | The static value '0' is used as an initialization vector for encryption. |
8797
| rncryptor.swift:79:133:79:133 | myConstIV2 | rncryptor.swift:61:24:61:24 | 123 : | rncryptor.swift:79:133:79:133 | myConstIV2 | The static value '123' is used as an initialization vector for encryption. |
98+
| rncryptor.swift:81:105:81:105 | myConstIV3 | rncryptor.swift:62:24:62:34 | [...] : | rncryptor.swift:81:105:81:105 | myConstIV3 | The static value '[...]' is used as an initialization vector for encryption. |
8899
| rncryptor.swift:83:113:83:113 | myConstIV4 | rncryptor.swift:63:24:63:24 | iv : | rncryptor.swift:83:113:83:113 | myConstIV4 | The static value 'iv' is used as an initialization vector for encryption. |
89100
| test.swift:54:17:54:17 | iv | test.swift:99:25:99:120 | [...] : | test.swift:54:17:54:17 | iv | The static value '[...]' is used as an initialization vector for encryption. |
90101
| test.swift:112:36:112:36 | ivString | test.swift:85:3:85:3 | this string is constant : | test.swift:112:36:112:36 | ivString | The static value 'this string is constant' is used as an initialization vector for encryption. |

‎swift/ql/test/query-tests/Security/CWE-1204/rncryptor.swift

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func test(myPassword: String) {
6969
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myKey, HMACKey: myHMACKey, IV: myRandomIV, handler: myHandler) // GOOD
7070
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, encryptionKey: myKey, HMACKey: myHMACKey, IV: myConstIV2, handler: myHandler) // BAD
7171
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, password: myPassword, iv: myRandomIV, encryptionSalt: mySalt, hmacSalt: mySalt2, handler: myHandler) // GOOD
72-
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, password: myPassword, iv: myConstIV3, encryptionSalt: mySalt, hmacSalt: mySalt2, handler: myHandler) // BAD [NOT DETECTED]
72+
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, password: myPassword, iv: myConstIV3, encryptionSalt: mySalt, hmacSalt: mySalt2, handler: myHandler) // BAD
7373
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, password: myPassword, IV: myRandomIV, encryptionSalt: mySalt, HMACSalt: mySalt2, handler: myHandler) // GOOD
7474
let _ = RNEncryptor(settings: kRNCryptorAES256Settings, password: myPassword, IV: myConstIV4, encryptionSalt: mySalt, HMACSalt: mySalt2, handler: myHandler) // BAD
7575

@@ -78,7 +78,7 @@ func test(myPassword: String) {
7878
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myKey, HMACKey: myHMACKey, IV: myRandomIV) // GOOD
7979
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, encryptionKey: myKey, HMACKey: myHMACKey, IV: myConstIV2) // BAD
8080
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, password: myPassword, iv: myRandomIV, encryptionSalt: mySalt, hmacSalt: mySalt2) // GOOD
81-
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, password: myPassword, iv: myConstIV3, encryptionSalt: mySalt, hmacSalt: mySalt2) // BAD [NOT DETECTED]
81+
let _ = try? myEncryptor.encryptData(myData, with: kRNCryptorAES256Settings, password: myPassword, iv: myConstIV3, encryptionSalt: mySalt, hmacSalt: mySalt2) // BAD
8282
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, password: myPassword, IV: myRandomIV, encryptionSalt: mySalt, HMACSalt: mySalt2) // GOOD
8383
let _ = try? myEncryptor.encryptData(myData, withSettings: kRNCryptorAES256Settings, password: myPassword, IV: myConstIV4, encryptionSalt: mySalt, HMACSalt: mySalt2) // BAD
8484
}

0 commit comments

Comments
 (0)