Skip to content

Add YAML Configurations for Security Rules Against File Access Vulnerabilities #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Add YAML Configurations for Security Rules Against File Access Vulnerabilities #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5d786f5
swift-xxe-prevention-swift
ESS-ENN Oct 28, 2024
bd548fb
swift-webview-config-allows-file-access-swift
ESS-ENN Oct 28, 2024
d2cf7d9
Merge branch 'main' into webview-and-xxe-swift
ESS-ENN Nov 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions rules/swift/security/swift-webview-config-allows-file-access-swift.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
id: swift-webview-config-allows-file-access-swift
language: swift
severity: warning
message: >-
Webviews were observed that do not disable access to application files.
If the WebView does not require loading content from the local filesystem
of the application, this setting should be disabled.
note: >-
[CWE-272]: Least Privilege Violation
[REFERENCES]
https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/
utils:
match_call_expression:
kind: call_expression
has:
stopBy: end
kind: call_suffix
has:
stopBy: end
kind: value_arguments
all:
- has:
stopBy: end
kind: value_argument
has:
stopBy: end
kind: boolean_literal
field: value
regex: "^true$"
- has:
stopBy: end
kind: value_argument
all:
- has:
stopBy: end
kind: simple_identifier
regex: "^forKey$"
- has:
stopBy: end
kind: line_string_literal
has:
stopBy: end
kind: line_str_text
regex: "^allowFileAccessFromFileURLs$"

rule:
any:
- matches: match_call_expression
114 changes: 114 additions & 0 deletions rules/swift/security/swift-xxe-prevention-swift.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,114 @@
id: swift-xxe-prevention-swift
severity: warning
language: swift
message: >-
Usage of Apple's native XML Parser was observed where the parser is
explicitly instructed to resolve external entities. This can lead to XXE
attacks if untrusted input is parsed. Consider disabling this
functionality where feasible.
note: >-
[CWE-611] Improper Restriction of XML External Entity Reference.
[REFERENCES]
- https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html
- https://mas.owasp.org/MASVS/controls/MASVS-CODE-4/
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
utils:
match_pattern_upgradeKnownHostsToHTTPS:
kind: assignment
all:
- has:
stopBy: neighbor
kind: directly_assignable_expression
all:
- has:
stopBy: end
kind: simple_identifier
pattern: $F
- has:
stopBy: end
kind: navigation_suffix
has:
stopBy: neighbor
kind: simple_identifier
regex: "^shouldResolveExternalEntities$"
- has:
stopBy: neighbor
regex: "^=$"
- has:
stopBy: neighbor
kind: boolean_literal
regex: "^true$"
- follows:
stopBy: end
kind: property_declaration
all:
- has:
stopBy: end
kind: pattern
has:
stopBy: neighbor
kind: simple_identifier
pattern: $F
- has:
stopBy: neighbor
kind: call_expression
pattern: XMLParser($$$)
- not:
follows:
stopBy: end
kind: assignment
all:
- has:
stopBy: neighbor
kind: directly_assignable_expression
all:
- has:
stopBy: end
kind: simple_identifier
pattern: $F
- has:
stopBy: end
kind: navigation_suffix
has:
stopBy: neighbor
kind: simple_identifier
regex: "^shouldResolveExternalEntities$"
- has:
stopBy: neighbor
regex: "^=$"
- has:
stopBy: neighbor
kind: boolean_literal
regex: "^true$"
- not:
precedes:
stopBy: end
kind: assignment
all:
- has:
stopBy: neighbor
kind: directly_assignable_expression
all:
- has:
stopBy: end
kind: simple_identifier
pattern: $F
- has:
stopBy: end
kind: navigation_suffix
has:
stopBy: neighbor
kind: simple_identifier
regex: "^shouldResolveExternalEntities$"
- has:
stopBy: neighbor
regex: "^=$"
- has:
stopBy: neighbor
any:
- has:
stopBy: neighbor
pattern: $$$
rule:
kind: assignment
matches: match_pattern_upgradeKnownHostsToHTTPS
122 changes: 122 additions & 0 deletions tests/__snapshots__/swift-webview-config-allows-file-access-swift-snapshot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,122 @@
id: swift-webview-config-allows-file-access-swift
snapshots:
? |
func enableFileAccessFromFileURLs() {
webView.configuration.preferences.setValue(true, forKey: "allowFileAccessFromFileURLs")
print("allowFileAccessFromFileURLs has been set to true.")
}
: labels:
- source: 'webView.configuration.preferences.setValue(true, forKey: "allowFileAccessFromFileURLs")'
style: primary
start: 38
end: 125
- source: 'true'
style: secondary
start: 81
end: 85
- source: 'true'
style: secondary
start: 81
end: 85
- source: forKey
style: secondary
start: 87
end: 93
- source: allowFileAccessFromFileURLs
style: secondary
start: 96
end: 123
- source: '"allowFileAccessFromFileURLs"'
style: secondary
start: 95
end: 124
- source: 'forKey: "allowFileAccessFromFileURLs"'
style: secondary
start: 87
end: 124
- source: '(true, forKey: "allowFileAccessFromFileURLs")'
style: secondary
start: 80
end: 125
- source: '(true, forKey: "allowFileAccessFromFileURLs")'
style: secondary
start: 80
end: 125
? |
preferences.setValue(true, forKey: "allowFileAccessFromFileURLs")
: labels:
- source: 'preferences.setValue(true, forKey: "allowFileAccessFromFileURLs")'
style: primary
start: 0
end: 65
- source: 'true'
style: secondary
start: 21
end: 25
- source: 'true'
style: secondary
start: 21
end: 25
- source: forKey
style: secondary
start: 27
end: 33
- source: allowFileAccessFromFileURLs
style: secondary
start: 36
end: 63
- source: '"allowFileAccessFromFileURLs"'
style: secondary
start: 35
end: 64
- source: 'forKey: "allowFileAccessFromFileURLs"'
style: secondary
start: 27
end: 64
- source: '(true, forKey: "allowFileAccessFromFileURLs")'
style: secondary
start: 20
end: 65
- source: '(true, forKey: "allowFileAccessFromFileURLs")'
style: secondary
start: 20
end: 65
? |
webViewConfig.webView.configuration.preferences.setValue(true, forKey: "allowFileAccessFromFileURLs")
: labels:
- source: 'webViewConfig.webView.configuration.preferences.setValue(true, forKey: "allowFileAccessFromFileURLs")'
style: primary
start: 0
end: 101
- source: 'true'
style: secondary
start: 57
end: 61
- source: 'true'
style: secondary
start: 57
end: 61
- source: forKey
style: secondary
start: 63
end: 69
- source: allowFileAccessFromFileURLs
style: secondary
start: 72
end: 99
- source: '"allowFileAccessFromFileURLs"'
style: secondary
start: 71
end: 100
- source: 'forKey: "allowFileAccessFromFileURLs"'
style: secondary
start: 63
end: 100
- source: '(true, forKey: "allowFileAccessFromFileURLs")'
style: secondary
start: 56
end: 101
- source: '(true, forKey: "allowFileAccessFromFileURLs")'
style: secondary
start: 56
end: 101
Loading