Swift: Model NSException sinks.

Author: geoffw0

swift/ql/lib/codeql/swift/StringFormat.qll

@@ -65,10 +65,13 @@ class NsLog extends FormattingFunction, FreeFunction {
 }
 
 /**
- * The `NSException.raise` method.
+ * The `NSException.init` and `NSException.raise` methods.
  */
 class NsExceptionRaise extends FormattingFunction, Method {
-  NsExceptionRaise() { this.hasQualifiedName("NSException", "raise(_:format:arguments:)") }
+  NsExceptionRaise() {
+    this.hasQualifiedName("NSException", "init(name:reason:userInfo:)") or
+    this.hasQualifiedName("NSException", "raise(_:format:arguments:)")
+  }
 
   override int getFormatParameterIndex() { result = 1 }
 }

swift/ql/lib/codeql/swift/security/CleartextLoggingExtensions.qll

@@ -160,6 +160,8 @@ private class LoggingSinks extends SinkModelCsv {
         ";;false;os_log(_:log:_:);;;Argument[2];log-injection",
         ";;false;os_log(_:dso:log:_:_:);;;Argument[0,4];log-injection",
         ";;false;os_log(_:dso:log:type:_:);;;Argument[0,4];log-injection",
+        ";NSException;true;init(name:reason:userInfo:);;;Argument[1];log-injection",
+        ";NSException;true;raise(_:format:arguments:);;;Argument[1..2];log-injection",
       ]
   }
 }

swift/ql/test/query-tests/Security/CWE-312/cleartextLoggingTest.swift

@@ -337,11 +337,11 @@ func test5(password: String, caseNum: Int) {
 }
 
 func test6(passwordString: String) {
-    let e = NSException(name: NSExceptionName("exception"), reason: "\(passwordString) is incorrect!", userInfo: nil) // $ MISSING: hasCleartextLogging=
+    let e = NSException(name: NSExceptionName("exception"), reason: "\(passwordString) is incorrect!", userInfo: nil) // $ hasCleartextLogging=340
     e.raise()
 
-    NSException.raise(NSExceptionName("exception"), format: "\(passwordString) is incorrect!", arguments: getVaList([])) // $ MISSING: hasCleartextLogging=
-    NSException.raise(NSExceptionName("exception"), format: "%s is incorrect!", arguments: getVaList([passwordString])) // $ MISSING: hasCleartextLogging=
+    NSException.raise(NSExceptionName("exception"), format: "\(passwordString) is incorrect!", arguments: getVaList([])) // $ hasCleartextLogging=343
+    NSException.raise(NSExceptionName("exception"), format: "%s is incorrect!", arguments: getVaList([passwordString])) // $ hasCleartextLogging=344
 
     _ = dprintf(0, "\(passwordString) is incorrect!") // $ hasCleartextLogging=346
     _ = dprintf(0, "%s is incorrect!", passwordString) // $ hasCleartextLogging=347