[DIFF-INFORMED] Swift: InsecureTLS

d10c · d10c · commit 649df5b75478 · 2025-07-17T10:56:31.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/swift/ql/src/queries/Security/CWE-757/InsecureTLS.ql#L18
diff --git a/swift/ql/lib/codeql/swift/security/InsecureTLSQuery.qll b/swift/ql/lib/codeql/swift/security/InsecureTLSQuery.qll
@@ -21,6 +21,10 @@ module InsecureTlsConfig implements DataFlow::ConfigSig {
   predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
     any(InsecureTlsExtensionsAdditionalFlowStep s).step(nodeFrom, nodeTo)
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // query selects some Swift nodes (e.g. "[post] self") that have location file://:0:0:0:0, which always fall outside the diff range.
+  }
 }
 
 module InsecureTlsFlow = TaintTracking::Global<InsecureTlsConfig>;

Original file line number	Diff line number	Diff line change
`@@ -21,6 +21,10 @@ module InsecureTlsConfig implements DataFlow::ConfigSig {`
`21`	`21`	`predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {`
`22`	`22`	`any(InsecureTlsExtensionsAdditionalFlowStep s).step(nodeFrom, nodeTo)`
`23`	`23`	`}`
	`24`	`+`
	`25`	`+ predicate observeDiffInformedIncrementalMode() {`
	`26`	`+ none() // query selects some Swift nodes (e.g. "[post] self") that have location file://:0:0:0:0, which always fall outside the diff range.`
	`27`	`+ }`
`24`	`28`	`}`
`25`	`29`
`26`	`30`	`module InsecureTlsFlow = TaintTracking::Global<InsecureTlsConfig>;`