|
| 1 | +/** |
| 2 | + * @name Insufficient hash iterations |
| 3 | + * @description Using hash functions with fewer than 120,000 iterations is insufficient to protect passwords because a cracking attack will require a low level of computational effort. |
| 4 | + * @kind path-problem |
| 5 | + * @problem.severity error |
| 6 | + * @security-severity 7.8 |
| 7 | + * @precision high |
| 8 | + * @id swift/insufficient-hash-iterations |
| 9 | + * @tags security |
| 10 | + * external/cwe/cwe-916 |
| 11 | + */ |
| 12 | + |
| 13 | +import swift |
| 14 | +import codeql.swift.dataflow.DataFlow |
| 15 | +import codeql.swift.dataflow.TaintTracking |
| 16 | +import DataFlow::PathGraph |
| 17 | + |
| 18 | +/** |
| 19 | + * An `Expr` that is used to initialize a password-based encryption key. |
| 20 | + */ |
| 21 | +abstract class IterationsSource extends Expr { } |
| 22 | + |
| 23 | +/** |
| 24 | + * A literal integer that is 120,000 or less is a source of taint for iterations. |
| 25 | + */ |
| 26 | +class IntLiteralSource extends IterationsSource instanceof IntegerLiteralExpr { |
| 27 | + IntLiteralSource() { this.getStringValue().toInt() < 120000 } |
| 28 | +} |
| 29 | + |
| 30 | +/** |
| 31 | + * A class for all ways to set the iterations of hash function. |
| 32 | + */ |
| 33 | +class InsufficientHashIterationsSink extends Expr { |
| 34 | + InsufficientHashIterationsSink() { |
| 35 | + // `iterations` arg in `init` is a sink |
| 36 | + exists(ClassOrStructDecl c, AbstractFunctionDecl f, CallExpr call, int arg | |
| 37 | + c.getFullName() = ["PBKDF1", "PBKDF2"] and |
| 38 | + c.getAMember() = f and |
| 39 | + f.getName().matches("init(%iterations:%") and |
| 40 | + call.getStaticTarget() = f and |
| 41 | + f.getParam(pragma[only_bind_into](arg)).getName() = "iterations" and |
| 42 | + call.getArgument(pragma[only_bind_into](arg)).getExpr() = this |
| 43 | + ) |
| 44 | + } |
| 45 | +} |
| 46 | + |
| 47 | +/** |
| 48 | + * A dataflow configuration from the hash iterations source to expressions that use |
| 49 | + * it to initialize hash functions. |
| 50 | + */ |
| 51 | +class InsufficientHashIterationsConfig extends TaintTracking::Configuration { |
| 52 | + InsufficientHashIterationsConfig() { this = "InsufficientHashIterationsConfig" } |
| 53 | + |
| 54 | + override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof IterationsSource } |
| 55 | + |
| 56 | + override predicate isSink(DataFlow::Node node) { |
| 57 | + node.asExpr() instanceof InsufficientHashIterationsSink |
| 58 | + } |
| 59 | +} |
| 60 | + |
| 61 | +// The query itself |
| 62 | +from |
| 63 | + InsufficientHashIterationsConfig config, DataFlow::PathNode sourceNode, |
| 64 | + DataFlow::PathNode sinkNode |
| 65 | +where config.hasFlowPath(sourceNode, sinkNode) |
| 66 | +select sinkNode.getNode(), sourceNode, sinkNode, |
| 67 | + "The value '" + sourceNode.getNode().toString() + |
| 68 | + "' is an insufficient number of iterations for secure password hashing." |
0 commit comments