Skip to content

Commit d299d92

Browse files
geoffw0geoffw0
committed
Swift: Prevent potentially misleading duplicate results.
1 parent 4995f13 commit d299d92

2 files changed

Lines changed: 5 additions & 12 deletions

File tree

‎swift/ql/lib/codeql/swift/security/WeakSensitiveDataHashingQuery.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@ module WeakHashingConfig implements DataFlow::ConfigSig {
2020

2121
predicate isBarrier(DataFlow::Node node) { node instanceof WeakSensitiveDataHashingSanitizer }
2222

23+
predicate isBarrierIn(DataFlow::Node node) {
24+
// make sources barriers so that we only report the closest instance
25+
isSource(node)
26+
}
27+
2328
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
2429
any(WeakSensitiveDataHashingAdditionalTaintStep s).step(nodeFrom, nodeTo)
2530
}

‎swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,8 @@
11
edges
2-
| testCryptoKit.swift:56:47:56:47 | passwd : | testCryptoKit.swift:63:44:63:44 | passwd |
3-
| testCryptoKit.swift:60:43:60:43 | credit_card_no : | testCryptoKit.swift:61:43:61:43 | credit_card_no |
4-
| testCryptoKit.swift:60:43:60:43 | credit_card_no : | testCryptoKit.swift:61:43:61:43 | credit_card_no : |
5-
| testCryptoKit.swift:60:43:60:43 | credit_card_no : | testCryptoKit.swift:67:44:67:44 | credit_card_no |
6-
| testCryptoKit.swift:61:43:61:43 | credit_card_no : | testCryptoKit.swift:67:44:67:44 | credit_card_no |
72
nodes
83
| testCryptoKit.swift:56:47:56:47 | passwd | semmle.label | passwd |
9-
| testCryptoKit.swift:56:47:56:47 | passwd : | semmle.label | passwd : |
104
| testCryptoKit.swift:60:43:60:43 | credit_card_no | semmle.label | credit_card_no |
11-
| testCryptoKit.swift:60:43:60:43 | credit_card_no : | semmle.label | credit_card_no : |
125
| testCryptoKit.swift:61:43:61:43 | credit_card_no | semmle.label | credit_card_no |
13-
| testCryptoKit.swift:61:43:61:43 | credit_card_no : | semmle.label | credit_card_no : |
146
| testCryptoKit.swift:63:44:63:44 | passwd | semmle.label | passwd |
157
| testCryptoKit.swift:67:44:67:44 | credit_card_no | semmle.label | credit_card_no |
168
| testCryptoKit.swift:90:23:90:23 | passwd | semmle.label | passwd |
@@ -25,12 +17,8 @@ subpaths
2517
#select
2618
| testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:56:47:56:47 | passwd | sensitive data (credential passwd) |
2719
| testCryptoKit.swift:60:43:60:43 | credit_card_no | testCryptoKit.swift:60:43:60:43 | credit_card_no | testCryptoKit.swift:60:43:60:43 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:60:43:60:43 | credit_card_no | sensitive data (private information credit_card_no) |
28-
| testCryptoKit.swift:61:43:61:43 | credit_card_no | testCryptoKit.swift:60:43:60:43 | credit_card_no : | testCryptoKit.swift:61:43:61:43 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:60:43:60:43 | credit_card_no | sensitive data (private information credit_card_no) |
2920
| testCryptoKit.swift:61:43:61:43 | credit_card_no | testCryptoKit.swift:61:43:61:43 | credit_card_no | testCryptoKit.swift:61:43:61:43 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:61:43:61:43 | credit_card_no | sensitive data (private information credit_card_no) |
30-
| testCryptoKit.swift:63:44:63:44 | passwd | testCryptoKit.swift:56:47:56:47 | passwd : | testCryptoKit.swift:63:44:63:44 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:56:47:56:47 | passwd | sensitive data (credential passwd) |
3121
| testCryptoKit.swift:63:44:63:44 | passwd | testCryptoKit.swift:63:44:63:44 | passwd | testCryptoKit.swift:63:44:63:44 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:63:44:63:44 | passwd | sensitive data (credential passwd) |
32-
| testCryptoKit.swift:67:44:67:44 | credit_card_no | testCryptoKit.swift:60:43:60:43 | credit_card_no : | testCryptoKit.swift:67:44:67:44 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:60:43:60:43 | credit_card_no | sensitive data (private information credit_card_no) |
33-
| testCryptoKit.swift:67:44:67:44 | credit_card_no | testCryptoKit.swift:61:43:61:43 | credit_card_no : | testCryptoKit.swift:67:44:67:44 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:61:43:61:43 | credit_card_no | sensitive data (private information credit_card_no) |
3422
| testCryptoKit.swift:67:44:67:44 | credit_card_no | testCryptoKit.swift:67:44:67:44 | credit_card_no | testCryptoKit.swift:67:44:67:44 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:67:44:67:44 | credit_card_no | sensitive data (private information credit_card_no) |
3523
| testCryptoKit.swift:90:23:90:23 | passwd | testCryptoKit.swift:90:23:90:23 | passwd | testCryptoKit.swift:90:23:90:23 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:90:23:90:23 | passwd | sensitive data (credential passwd) |
3624
| testCryptoKit.swift:94:23:94:23 | credit_card_no | testCryptoKit.swift:94:23:94:23 | credit_card_no | testCryptoKit.swift:94:23:94:23 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:94:23:94:23 | credit_card_no | sensitive data (private information credit_card_no) |

0 commit comments

Comments
 (0)