Add taint sources for WKScriptMessage

This is what contains externally-provided data in Webview JS-native bridges

Author: atorralba

swift/ql/lib/codeql/swift/dataflow/ExternalFlow.qll

@@ -82,6 +82,7 @@ private module Frameworks {
   private import codeql.swift.frameworks.StandardLibrary.String
   private import codeql.swift.frameworks.StandardLibrary.Url
   private import codeql.swift.frameworks.StandardLibrary.UrlSession
+  private import codeql.swift.frameworks.StandardLibrary.WebView
 }
 
 /**

swift/ql/lib/codeql/swift/frameworks/StandardLibrary/WebView.qll

@@ -0,0 +1,29 @@
+import swift
+private import codeql.swift.dataflow.DataFlow
+private import codeql.swift.dataflow.ExternalFlow
+private import codeql.swift.dataflow.FlowSources
+private import codeql.swift.dataflow.FlowSteps
+
+private class WKScriptMessageSource extends SourceModelCsv {
+  override predicate row(string row) {
+    row = ";WKScriptMessageHandler;true;userContentController(_:didReceive:);;;Parameter[1];remote"
+  }
+}
+
+/** The class `WKScriptMessage`. */
+private class WKScriptMessageDecl extends ClassDecl {
+  WKScriptMessageDecl() { this.getName() = "WKScriptMessage" }
+}
+
+/**
+ * A content implying that, if a `WKScriptMessage` is tainted, its `body` field is tainted.
+ */
+private class WKScriptMessageBodyInheritsTaint extends TaintInheritingContent,
+  DataFlow::Content::FieldContent {
+  WKScriptMessageBodyInheritsTaint() {
+    exists(FieldDecl f | this.getField() = f |
+      f.getEnclosingDecl() instanceof WKScriptMessageDecl and
+      f.getName() = "body"
+    )
+  }
+}

swift/ql/test/library-tests/dataflow/flowsources/FlowSources.expected

@@ -8,3 +8,4 @@
 | url.swift:53:15:53:19 | .resourceBytes | external |
 | url.swift:60:15:60:19 | .lines | external |
 | url.swift:67:16:67:22 | .lines | external |
+| webview.swift:11:82:11:102 | message | external |

swift/ql/test/library-tests/dataflow/flowsources/webview.swift

@@ -0,0 +1,13 @@
+
+// --- stubs ---
+class WKUserContentController {}
+class WKScriptMessage {}
+protocol WKScriptMessageHandler {
+    func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage)
+}
+
+// --- tests ---
+class TestMessageHandler: WKScriptMessageHandler {
+    func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) { // SOURCE
+    }
+}

swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected

@@ -161,3 +161,4 @@
 | url.swift:100:12:100:54 | ...! | url.swift:100:12:100:56 | .standardizedFileURL |
 | url.swift:101:15:101:57 | ...! | url.swift:101:15:101:59 | .user |
 | url.swift:102:15:102:57 | ...! | url.swift:102:15:102:59 | .password |
+| webview.swift:12:13:12:20 | call to source() | webview.swift:12:13:12:22 | .body |

swift/ql/test/library-tests/dataflow/taint/Taint.expected

@@ -119,6 +119,7 @@ edges
 | url.swift:117:28:117:28 | tainted :  | url.swift:117:16:117:35 | call to init(string:) :  |
 | url.swift:120:46:120:46 | urlTainted :  | url.swift:43:2:46:55 | [summary param] 0 in dataTask(with:completionHandler:) :  |
 | url.swift:120:61:120:61 | data :  | url.swift:121:15:121:19 | ...! |
+| webview.swift:12:13:12:20 | call to source() :  | webview.swift:12:13:12:22 | .body |
 nodes
 | file://:0:0:0:0 | [summary] to write: argument 1.parameter 0 in dataTask(with:completionHandler:) :  | semmle.label | [summary] to write: argument 1.parameter 0 in dataTask(with:completionHandler:) :  |
 | file://:0:0:0:0 | [summary] to write: return (return) in init(string:) :  | semmle.label | [summary] to write: return (return) in init(string:) :  |
@@ -231,6 +232,8 @@ nodes
 | url.swift:120:46:120:46 | urlTainted :  | semmle.label | urlTainted :  |
 | url.swift:120:61:120:61 | data :  | semmle.label | data :  |
 | url.swift:121:15:121:19 | ...! | semmle.label | ...! |
+| webview.swift:12:13:12:20 | call to source() :  | semmle.label | call to source() :  |
+| webview.swift:12:13:12:22 | .body | semmle.label | .body |
 subpaths
 | url.swift:59:31:59:31 | tainted :  | url.swift:8:2:8:25 | [summary param] 0 in init(string:) :  | file://:0:0:0:0 | [summary] to write: return (return) in init(string:) :  | url.swift:59:19:59:38 | call to init(string:) :  |
 | url.swift:83:24:83:24 | tainted :  | url.swift:9:2:9:43 | [summary param] 0 in init(string:relativeTo:) :  | file://:0:0:0:0 | [summary] to write: return (return) in init(string:relativeTo:) :  | url.swift:83:12:83:48 | call to init(string:relativeTo:) :  |
@@ -306,3 +309,4 @@ subpaths
 | url.swift:102:15:102:67 | ...! | url.swift:57:16:57:23 | call to source() :  | url.swift:102:15:102:67 | ...! | result |
 | url.swift:118:12:118:12 | ...! | url.swift:57:16:57:23 | call to source() :  | url.swift:118:12:118:12 | ...! | result |
 | url.swift:121:15:121:19 | ...! | url.swift:57:16:57:23 | call to source() :  | url.swift:121:15:121:19 | ...! | result |
+| webview.swift:12:13:12:22 | .body | webview.swift:12:13:12:20 | call to source() :  | webview.swift:12:13:12:22 | .body | result |

swift/ql/test/library-tests/dataflow/taint/webview.swift

@@ -0,0 +1,13 @@
+
+// --- stubs ---
+class WKScriptMessage {
+    open var body: Any { get { return "" } }
+}
+
+// --- tests ---
+func source() -> WKScriptMessage { return WKScriptMessage() }
+func sink(s: Any) {}
+
+func testInheritBodyTaint() {
+    sink(s: source().body) // $ tainted=12
+}