Skip to content

Commit 61eb5cd

Browse files
geoffw0geoffw0
committed
Swift: Put a barrier on the qualifiers as well.
1 parent 0c3e8ce commit 61eb5cd

File tree

3 files changed

+5
-8
lines changed

3 files changed

+5
-8
lines changed

‎swift/ql/lib/codeql/swift/security/ConstantSaltExtensions.qll

+4-1
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,10 @@ private class AppendConstantSaltBarrier extends ConstantSaltBarrier {
8686
exists(CallExpr ce |
8787
ce.getStaticTarget().getName() =
8888
["append(_:)", "appending(_:)", "appendLiteral(_:)", "appendInterpolation(_:)"] and
89-
this.asExpr() = ce.getAnArgument().getExpr()
89+
(
90+
this.asExpr() = ce.getAnArgument().getExpr() or
91+
this.asExpr() = ce.getQualifier()
92+
)
9093
)
9194
}
9295
}

‎swift/ql/test/query-tests/Security/CWE-760/ConstantSalt.expected

-6
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ edges
1111
| rncryptor.swift:60:24:60:30 | call to Data.init(_:) | rncryptor.swift:76:152:76:152 | myConstantSalt2 | provenance | |
1212
| rncryptor.swift:60:24:60:30 | call to Data.init(_:) | rncryptor.swift:79:160:79:160 | myConstantSalt2 | provenance | |
1313
| rncryptor.swift:60:29:60:29 | 0 | rncryptor.swift:60:24:60:30 | call to Data.init(_:) | provenance | |
14-
| rncryptor.swift:89:25:89:25 | 123 | rncryptor.swift:91:62:91:62 | myMutableString1 | provenance | |
15-
| rncryptor.swift:91:62:91:62 | myMutableString1 | rncryptor.swift:91:57:91:78 | call to Data.init(_:) | provenance | |
1614
| test.swift:29:3:29:3 | this string is constant | test.swift:33:10:33:28 | call to getConstantString() | provenance | |
1715
| test.swift:33:2:33:34 | call to Array<Element>.init(_:) [Collection element] | test.swift:44:27:44:44 | call to getConstantArray() [Collection element] | provenance | |
1816
| test.swift:33:10:33:28 | call to getConstantString() | test.swift:33:10:33:30 | .utf8 | provenance | |
@@ -40,9 +38,6 @@ nodes
4038
| rncryptor.swift:76:152:76:152 | myConstantSalt2 | semmle.label | myConstantSalt2 |
4139
| rncryptor.swift:78:135:78:135 | myConstantSalt1 | semmle.label | myConstantSalt1 |
4240
| rncryptor.swift:79:160:79:160 | myConstantSalt2 | semmle.label | myConstantSalt2 |
43-
| rncryptor.swift:89:25:89:25 | 123 | semmle.label | 123 |
44-
| rncryptor.swift:91:57:91:78 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
45-
| rncryptor.swift:91:62:91:62 | myMutableString1 | semmle.label | myMutableString1 |
4641
| test.swift:29:3:29:3 | this string is constant | semmle.label | this string is constant |
4742
| test.swift:33:2:33:34 | call to Array<Element>.init(_:) [Collection element] | semmle.label | call to Array<Element>.init(_:) [Collection element] |
4843
| test.swift:33:10:33:28 | call to getConstantString() | semmle.label | call to getConstantString() |
@@ -69,7 +64,6 @@ subpaths
6964
| rncryptor.swift:76:152:76:152 | myConstantSalt2 | rncryptor.swift:60:29:60:29 | 0 | rncryptor.swift:76:152:76:152 | myConstantSalt2 | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:60:29:60:29 | 0 | 0 |
7065
| rncryptor.swift:78:135:78:135 | myConstantSalt1 | rncryptor.swift:59:29:59:29 | abcdef123456 | rncryptor.swift:78:135:78:135 | myConstantSalt1 | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:59:29:59:29 | abcdef123456 | abcdef123456 |
7166
| rncryptor.swift:79:160:79:160 | myConstantSalt2 | rncryptor.swift:60:29:60:29 | 0 | rncryptor.swift:79:160:79:160 | myConstantSalt2 | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:60:29:60:29 | 0 | 0 |
72-
| rncryptor.swift:91:57:91:78 | call to Data.init(_:) | rncryptor.swift:89:25:89:25 | 123 | rncryptor.swift:91:57:91:78 | call to Data.init(_:) | The value '$@' is used as a constant, which is insecure for hashing passwords. | rncryptor.swift:89:25:89:25 | 123 | 123 |
7367
| test.swift:51:49:51:49 | constantSalt | test.swift:43:35:43:130 | [...] | test.swift:51:49:51:49 | constantSalt | The value '$@' is used as a constant, which is insecure for hashing passwords. | test.swift:43:35:43:130 | [...] | [...] |
7468
| test.swift:52:49:52:49 | constantStringSalt | test.swift:29:3:29:3 | this string is constant | test.swift:52:49:52:49 | constantStringSalt | The value '$@' is used as a constant, which is insecure for hashing passwords. | test.swift:29:3:29:3 | this string is constant | this string is constant |
7569
| test.swift:56:59:56:59 | constantSalt | test.swift:43:35:43:130 | [...] | test.swift:56:59:56:59 | constantSalt | The value '$@' is used as a constant, which is insecure for hashing passwords. | test.swift:43:35:43:130 | [...] | [...] |

‎swift/ql/test/query-tests/Security/CWE-760/rncryptor.swift

+1-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ func test(myPassword: String) {
8888

8989
var myMutableString1 = "123"
9090
myMutableString1.append(getARandomString())
91-
let _ = myEncryptor.key(forPassword: myPassword, salt: Data(myMutableString1), settings: myKeyDerivationSettings) // GOOD [FALSE POSITIVE]
91+
let _ = myEncryptor.key(forPassword: myPassword, salt: Data(myMutableString1), settings: myKeyDerivationSettings) // GOOD
9292

9393
var myMutableString2 = getARandomString()
9494
myMutableString2.append("abc")

0 commit comments

Comments
 (0)