Swift: Fix array content sinks for swift/cleartext-logging.

Author: geoffw0

swift/ql/lib/codeql/swift/security/CleartextLoggingExtensions.qll

@@ -87,14 +87,10 @@ private class LoggingSinks extends SinkModelCsv {
   override predicate row(string row) {
     row =
       [
-        ";;false;print(_:separator:terminator:);;;Argument[0].ArrayElement;log-injection",
-        ";;false;print(_:separator:terminator:);;;Argument[1..2];log-injection",
-        ";;false;print(_:separator:terminator:toStream:);;;Argument[0].ArrayElement;log-injection",
-        ";;false;print(_:separator:terminator:toStream:);;;Argument[1..2];log-injection",
-        ";;false;NSLog(_:_:);;;Argument[0];log-injection",
-        ";;false;NSLog(_:_:);;;Argument[1].ArrayElement;log-injection",
-        ";;false;NSLogv(_:_:);;;Argument[0];log-injection",
-        ";;false;NSLogv(_:_:);;;Argument[1];log-injection",
+        ";;false;print(_:separator:terminator:);;;Argument[0..2];log-injection",
+        ";;false;print(_:separator:terminator:toStream:);;;Argument[0..2];log-injection",
+        ";;false;NSLog(_:_:);;;Argument[0..1];log-injection",
+        ";;false;NSLogv(_:_:);;;Argument[0..1];log-injection",
         ";;false;vfprintf(_:_:_:);;;Agument[1..2];log-injection",
         ";Logger;true;log(_:);;;Argument[0];log-injection",
         ";Logger;true;log(level:_:);;;Argument[1];log-injection",

swift/ql/lib/codeql/swift/security/CleartextLoggingQuery.qll

@@ -25,6 +25,12 @@ module CleartextLoggingConfig implements DataFlow::ConfigSig {
   predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
     any(CleartextLoggingAdditionalFlowStep s).step(n1, n2)
   }
+
+  predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
+    // flow out from array content at the sink.
+    isSink(node) and
+    c.getAReadContent() instanceof DataFlow::Content::ArrayContent
+  }
 }
 
 /**

swift/ql/test/query-tests/Security/CWE-312/cleartextLoggingTest.swift

@@ -84,17 +84,17 @@ struct Logger {
 // --- tests ---
 
 func test1(password: String, passwordHash : String, passphrase: String, pass_phrase: String) {
-	print(password) // $ MISSING: hasCleartextLogging=87
-	print(password, separator: "") // $ MISSING: $ hasCleartextLogging=88
+	print(password) // $ hasCleartextLogging=87
+	print(password, separator: "") // $ $ hasCleartextLogging=88
 	print("", separator: password) // $ hasCleartextLogging=89
-	print(password, separator: "", terminator: "") // $ MISSING: hasCleartextLogging=90
+	print(password, separator: "", terminator: "") // $ hasCleartextLogging=90
 	print("", separator: password, terminator: "") // $ hasCleartextLogging=91
 	print("", separator: "", terminator: password) // $ hasCleartextLogging=92
     print(passwordHash) // Safe
 
     NSLog(password) // $ hasCleartextLogging=95
-    NSLog("%@", password as! CVarArg) // $ MISSING: hasCleartextLogging=96
-    NSLog("%@ %@", "" as! CVarArg, password as! CVarArg) // $ MISSING: hasCleartextLogging=97
+    NSLog("%@", password as! CVarArg) // $ hasCleartextLogging=96
+    NSLog("%@ %@", "" as! CVarArg, password as! CVarArg) // $ hasCleartextLogging=97
     NSLog("\(password)") // $ hasCleartextLogging=98
     NSLogv("%@", getVaList([password as! CVarArg])) // $ hasCleartextLogging=99
     NSLogv("%@ %@", getVaList(["" as! CVarArg, password as! CVarArg])) // $ hasCleartextLogging=100