Skip to content

Commit bff93c4

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into no-dtt-in-tainted-arithmetic
2 parents 1623bba + 0342b3e commit bff93c4

7 files changed

Lines changed: 44 additions & 36 deletions

File tree

‎csharp/autobuilder/Semmle.Autobuild.Shared/MsBuildRule.cs‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,12 @@ BuildScript GetNugetRestoreScript() =>
8282
Argument("/t:restore").
8383
QuoteArgument(projectOrSolution.FullPath);
8484

85-
if (nugetDownloaded)
85+
if (builder.Actions.IsRunningOnAppleSilicon())
86+
{
87+
// On Apple Silicon, only try package restore with `dotnet msbuild /t:restore`
88+
ret &= BuildScript.Try(msbuildRestoreCommand.Script);
89+
}
90+
else if (nugetDownloaded)
8691
{
8792
ret &= BuildScript.Try(nugetRestore | msbuildRestoreCommand.Script);
8893
}

‎docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ The following properties are supported by all query files:
4949
| | | ``warning`` | |
5050
| | | ``recommendation`` | |
5151
+-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
52-
| ``@security-severity``| ``<score>`` | Defines the level of severity, between 0.0 and 10.0, for queries with ``@tags security``. For more information about calculating ``@security-severity``, see the `GitHub changelog <https://github.blog/changelog/2021-07-19-codeql-code-scanning-new-severity-levels-for-security-alerts/>`__. |
52+
| ``@security-severity``| ``<score>`` | Defines the level of severity, between 0.0 and 10.0, for queries with ``@tags security``. For more information about calculating ``@security-severity``, see the `GitHub changelog <https://gh.io/2021-07-19-codeql-security-severity>`__. |
5353
+-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
5454

5555
Example

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/String.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ private class StringSummaries extends SummaryModelCsv {
4747
";StringProtocol;true;capitalized(with:);;;Argument[-1];ReturnValue;taint",
4848
";StringProtocol;true;completePath(into:caseSensitive:matchesInto:filterTypes:);;;Argument[-1];Argument[0].CollectionElement;taint",
4949
";StringProtocol;true;completePath(into:caseSensitive:matchesInto:filterTypes:);;;Argument[-1];Argument[2].CollectionElement.CollectionElement;taint",
50-
";StringProtocol;true;components(separatedBy:);;;Argument[-1];ReturnValue;taint",
50+
";StringProtocol;true;components(separatedBy:);;;Argument[-1];ReturnValue.CollectionElement;taint",
5151
";StringProtocol;true;data(using:allowLossyConversion:);;;Argument[-1];ReturnValue;taint",
5252
";StringProtocol;true;folding(options:locale:);;;Argument[-1];ReturnValue;taint",
5353
";StringProtocol;true;getBytes(_:maxLength:usedLength:encoding:options:range:remaining:);;;Argument[-1];Argument[0].CollectionElement;taint",

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Url.qll‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,18 @@ private class UrlFieldsInheritTaint extends TaintInheritingContent, DataFlow::Co
2222
}
2323

2424
/**
25-
* A content implying that, if a `URLRequest` is tainted, then its fields `url`, `httpBody`,
26-
* `httpBodyStream`, `mainDocument` and `allHTTPHeaderFields` are tainted.
25+
* A content implying that, if a `URLRequest` is tainted, then certain fields tainted.
2726
*/
2827
private class UrlRequestFieldsInheritTaint extends TaintInheritingContent,
2928
DataFlow::Content::FieldContent
3029
{
3130
UrlRequestFieldsInheritTaint() {
3231
this.getField().getEnclosingDecl().asNominalTypeDecl().getName() = "URLRequest" and
3332
this.getField().getName() =
34-
["url", "httpBody", "httpBodyStream", "mainDocument", "allHTTPHeaderFields"]
33+
[
34+
"url", "httpBody", "httpBodyStream", "mainDocument", "mainDocumentURL",
35+
"allHTTPHeaderFields"
36+
]
3537
}
3638
}
3739

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/WebView.qll‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ private class WKScriptMessageBodyInheritsTaint extends TaintInheritingContent,
3939
}
4040

4141
/**
42-
* A type or extension delcaration that adopts the protocol `WKNavigationDelegate`.
42+
* A type or extension declaration that adopts the protocol `WKNavigationDelegate`.
4343
*/
4444
private class AdoptsWkNavigationDelegate extends Decl {
4545
AdoptsWkNavigationDelegate() {
@@ -74,19 +74,15 @@ private class WKNavigationDelegateSource extends RemoteFlowSource {
7474
}
7575

7676
/**
77-
* A taint step implying that, if a `WKNavigationAction` is tainted, its `request` field is also tainted.
77+
* A content implying that, if a `WKNavigationAction` is tainted, its
78+
* `request` field is also tainted.
7879
*/
79-
private class WKNavigationActionTaintStep extends AdditionalTaintStep {
80-
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
81-
exists(MemberRefExpr e, Expr self, VarDecl member |
82-
self.getType().getName() = "WKNavigationAction" and
83-
member.getName() = "request"
84-
|
85-
e.getBase() = self and
86-
e.getMember() = member and
87-
n1.asExpr() = self and
88-
n2.asExpr() = e
89-
)
80+
private class UrlRequestFieldsInheritTaint extends TaintInheritingContent,
81+
DataFlow::Content::FieldContent
82+
{
83+
UrlRequestFieldsInheritTaint() {
84+
this.getField().getEnclosingDecl().asNominalTypeDecl().getName() = "WKNavigationAction" and
85+
this.getField().getName() = "request"
9086
}
9187
}
9288

‎swift/ql/test/library-tests/dataflow/taint/libraries/url.swift‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -159,11 +159,12 @@ struct URLRequest : CustomStringConvertible, CustomDebugStringConvertible {
159159
enum NetworkServiceType { case none }
160160
enum Attribution { case none }
161161
var cachePolicy: CachePolicy = .none
162-
var httpMethod: String = ""
163-
var url: URL = URL(string: "")!
164-
var httpBody: Data = Data("")
162+
var httpMethod: String? = ""
163+
var url: URL? = URL(string: "")
164+
var httpBody: Data? = Data("")
165165
var httpBodyStream: InputStream? = nil
166166
var mainDocument: URL = URL(string: "")!
167+
var mainDocumentURL: URL? = URL(string: "")
167168
var allHTTPHeaderFields: [String : String]? = nil
168169
var timeoutInterval: TimeInterval = TimeInterval()
169170
var httpShouldHandleCookies: Bool = false
@@ -204,7 +205,6 @@ func sink(data: Data) {}
204205
func sink(string: String) {}
205206
func sink(int: Int) {}
206207
func sink(any: Any) {}
207-
208208
func taintThroughURL() {
209209
let clean = "http://example.com/"
210210
let tainted = source() as! String
@@ -436,14 +436,16 @@ func taintThroughUrlRequest() {
436436
sink(any: tainted.cachePolicy)
437437
sink(any: clean.httpMethod)
438438
sink(any: tainted.httpMethod)
439-
sink(any: clean.url)
440-
sink(any: tainted.url) // $ tainted=431
441-
sink(any: clean.httpBody)
442-
sink(any: tainted.httpBody) // $ tainted=431
439+
sink(any: clean.url!)
440+
sink(any: tainted.url!) // $ tainted=431
441+
sink(any: clean.httpBody!)
442+
sink(any: tainted.httpBody!) // $ tainted=431
443443
sink(any: clean.httpBodyStream!)
444444
sink(any: tainted.httpBodyStream!) // $ tainted=431
445445
sink(any: clean.mainDocument)
446446
sink(any: tainted.mainDocument) // $ tainted=431
447+
sink(any: clean.mainDocumentURL!)
448+
sink(any: tainted.mainDocumentURL!) // $ tainted=431
447449
sink(any: clean.allHTTPHeaderFields!)
448450
sink(any: tainted.allHTTPHeaderFields!) // $ tainted=431
449451
sink(any: clean.timeoutInterval)
@@ -481,19 +483,19 @@ func taintThroughUrlResource() {
481483
let tainted = source() as! URLResource
482484

483485
sink(string: clean.name)
484-
sink(string: tainted.name) // $ tainted=481
486+
sink(string: tainted.name) // $ tainted=483
485487
sink(string: clean.subdirectory!)
486-
sink(string: tainted.subdirectory!) // $ tainted=481
488+
sink(string: tainted.subdirectory!) // $ tainted=483
487489
}
488490

489491
func taintUrlAsync() async throws {
490492
let tainted = source() as! String
491493
let urlTainted = URL(string: tainted)!
492494

493-
sink(any: urlTainted.lines) // $ tainted=490
495+
sink(any: urlTainted.lines) // $ tainted=492
494496

495497
for try await line in urlTainted.lines {
496-
sink(string: line) // $ MISSING: tainted=490
498+
sink(string: line) // $ MISSING: tainted=492
497499
}
498500
}
499501

@@ -510,5 +512,5 @@ func closureReturnValue() {
510512
ptr in
511513
return source() as! String
512514
})
513-
sink(string: r2) // $ tainted=511
515+
sink(string: r2) // $ tainted=513
514516
}

‎swift/ql/test/library-tests/dataflow/taint/libraries/webview.swift‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ struct URLRequest {}
7676

7777
// --- tests ---
7878

79-
func source() -> Any { return "" }
79+
func source(_ label: String? = "") -> Any { return "" }
8080
func sink(_: Any) {}
8181

8282
func testInheritBodyTaint() {
@@ -146,6 +146,9 @@ func testWKUserScript() {
146146
}
147147

148148
func testWKNavigationAction() {
149-
let src = source() as! WKNavigationAction
150-
sink(src.request) // $ tainted=149
151-
}
149+
let src = source("WKNavigationAction") as! WKNavigationAction
150+
sink(src.request) // $ tainted=WKNavigationAction
151+
152+
let keypath = \WKNavigationAction.request
153+
sink(src[keyPath: keypath]) // $ tainted=WKNavigationAction
154+
}

0 commit comments

Comments
 (0)