Skip to content

Commit e357b44

Browse files
geoffw0geoffw0
committed
Swift: Add a partial model of Sequence.
1 parent 4bb0bbf commit e357b44

8 files changed

Lines changed: 79 additions & 9 deletions

File tree

‎swift/ql/lib/codeql/swift/dataflow/ExternalFlow.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ private module Frameworks {
8484
private import codeql.swift.frameworks.StandardLibrary.InputStream
8585
private import codeql.swift.frameworks.StandardLibrary.NsData
8686
private import codeql.swift.frameworks.StandardLibrary.NsUrl
87+
private import codeql.swift.frameworks.StandardLibrary.Sequence
8788
private import codeql.swift.frameworks.StandardLibrary.String
8889
private import codeql.swift.frameworks.StandardLibrary.Url
8990
private import codeql.swift.frameworks.StandardLibrary.UrlSession

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Data.qll‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,6 @@ private class DataSummaries extends SummaryModelCsv {
3737
";Data;true;replaceSubrange(_:with:count:);;;Argument[1];Argument[-1];taint",
3838
";Data;true;replacing(_:with:maxReplacements:);;;Argument[1];Argument[-1];taint",
3939
";Data;true;replacing(_:with:subrange:maxReplacements:);;;Argument[1];Argument[-1];taint",
40-
// TODO: this should be implemented by a model of BidirectionalCollection
41-
// ";Data;true;reversed();;;Argument[-1];ReturnValue;taint",
4240
";Data;true;sorted();;;Argument[-1];ReturnValue;taint",
4341
";Data;true;sorted(by:);;;Argument[-1];ReturnValue;taint",
4442
";Data;true;sorted(using:);;;Argument[-1];ReturnValue;taint",

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Sequence.qll‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/**
2+
* Provides models for the `Sequence` Swift class.
3+
*/
4+
5+
import swift
6+
private import codeql.swift.dataflow.DataFlow
7+
private import codeql.swift.dataflow.ExternalFlow
8+
private import codeql.swift.dataflow.FlowSteps
9+
10+
11+
/**
12+
* A model for `Sequence` members that permit taint flow.
13+
*/
14+
private class SequenceSummaries extends SummaryModelCsv {
15+
override predicate row(string row) {
16+
row =
17+
[
18+
";Sequence;true;reversed();;;Argument[-1];ReturnValue;taint",
19+
";Sequence;true;prefix(_:);;;Argument[-1];ReturnValue;taint",
20+
";Sequence;true;prefix(while:);;;Argument[-1];ReturnValue;taint",
21+
";Sequence;true;suffix(_:);;;Argument[-1];ReturnValue;taint",
22+
";Sequence;true;dropFirst(_:);;;Argument[-1];ReturnValue;taint",
23+
";Sequence;true;dropLast(_:);;;Argument[-1];ReturnValue;taint",
24+
";Sequence;true;split(maxSplits:omittingEmptySubsequences:whereSeparator:);;;Argument[-1];ReturnValue;taint",
25+
";Sequence;true;split(separator:maxSplits:omittingEmptySubsequences:);;;Argument[-1];ReturnValue;taint",
26+
";Sequence;true;joined();;;Argument[-1];ReturnValue;taint",
27+
";Sequence;true;joined(separator:);;;Argument[-1..0];ReturnValue;taint",
28+
]
29+
}
30+
}
31+
32+
/**
33+
* A content implying that, if a `Sequence` is tainted, certain fields are also
34+
* tainted.
35+
*/
36+
private class SequenceFieldsInheritTaint extends TaintInheritingContent,
37+
DataFlow::Content::FieldContent {
38+
SequenceFieldsInheritTaint() {
39+
exists(FieldDecl f | this.getField() = f |
40+
(
41+
f.getEnclosingDecl().(NominalTypeDecl).getName() = "Sequence" or
42+
f.getEnclosingDecl().(ExtensionDecl).getExtendedTypeDecl().getName() = "Sequence"
43+
) and
44+
f.getName() = "lazy"
45+
)
46+
}
47+
}

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/String.qll‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,6 @@ private class StringSummaries extends SummaryModelCsv {
5757
";StringProtocol;true;replacingOccurrences(of:with:options:range);;;Argument[-1];ReturnValue;taint",
5858
";StringProtocol;true;replacingOccurrences(of:with:options:range);;;Argument[1];ReturnValue;taint",
5959
";StringProtocol;true;replacingPercentEscapes(using:);;;Argument[-1];ReturnValue;taint",
60-
";StringProtocol;true;split(separator:maxSplits:omittingEmptySubsequences:);;;Argument[-1];ReturnValue;taint",
6160
";StringProtocol;true;substring(from:);;;Argument[-1];ReturnValue;taint",
6261
";StringProtocol;true;substring(with:);;;Argument[-1];ReturnValue;taint",
6362
";StringProtocol;true;trimmingCharacters(in:);;;Argument[-1];ReturnValue;taint",
@@ -120,7 +119,6 @@ private class StringSummaries extends SummaryModelCsv {
120119
";String;true;randomElement();;;Argument[-1];ReturnValue;taint",
121120
";String;true;randomElement(using:);;;Argument[-1];ReturnValue;taint",
122121
";String;true;enumerated();;;Argument[-1];ReturnValue;taint",
123-
";String;true;reversed();;;Argument[-1];ReturnValue;taint",
124122
";String;true;encode(to:);;;Argument[-1];Argument[0];taint"
125123
]
126124
}

‎swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,7 @@
297297
| data.swift:228:45:228:52 | call to source() | data.swift:228:10:228:10 | [post] dataTainted33 |
298298
| data.swift:232:6:232:6 | SSA def(dataTainted34) | data.swift:233:12:233:12 | dataTainted34 |
299299
| data.swift:232:22:232:29 | call to source() | data.swift:232:6:232:6 | SSA def(dataTainted34) |
300+
| data.swift:233:12:233:12 | dataTainted34 | data.swift:233:12:233:35 | call to reversed() |
300301
| data.swift:236:6:236:6 | SSA def(dataTainted35) | data.swift:237:12:237:12 | dataTainted35 |
301302
| data.swift:236:22:236:29 | call to source() | data.swift:236:6:236:6 | SSA def(dataTainted35) |
302303
| data.swift:237:12:237:12 | dataTainted35 | data.swift:237:12:237:33 | call to sorted() |
@@ -1212,6 +1213,7 @@
12121213
| string.swift:238:13:238:13 | tainted | string.swift:238:13:238:42 | call to capitalized(with:) |
12131214
| string.swift:238:13:238:13 | tainted | string.swift:239:13:239:13 | tainted |
12141215
| string.swift:239:13:239:13 | [post] tainted | string.swift:241:13:241:13 | tainted |
1216+
| string.swift:239:13:239:13 | tainted | string.swift:239:13:239:30 | call to reversed() |
12151217
| string.swift:239:13:239:13 | tainted | string.swift:241:13:241:13 | tainted |
12161218
| string.swift:241:13:241:13 | [post] tainted | string.swift:242:13:242:13 | tainted |
12171219
| string.swift:241:13:241:13 | tainted | string.swift:242:13:242:13 | tainted |
@@ -1301,8 +1303,10 @@
13011303
| string.swift:280:13:280:13 | tainted | string.swift:280:13:280:21 | .utf8CString |
13021304
| string.swift:280:13:280:13 | tainted | string.swift:282:13:282:13 | tainted |
13031305
| string.swift:281:13:281:13 | [post] clean | string.swift:283:13:283:13 | clean |
1306+
| string.swift:281:13:281:13 | clean | string.swift:281:13:281:19 | .lazy |
13041307
| string.swift:281:13:281:13 | clean | string.swift:283:13:283:13 | clean |
13051308
| string.swift:282:13:282:13 | [post] tainted | string.swift:284:13:284:13 | tainted |
1309+
| string.swift:282:13:282:13 | tainted | string.swift:282:13:282:21 | .lazy |
13061310
| string.swift:282:13:282:13 | tainted | string.swift:284:13:284:13 | tainted |
13071311
| string.swift:283:13:283:13 | [post] clean | string.swift:285:13:285:13 | clean |
13081312
| string.swift:283:13:283:13 | clean | string.swift:283:13:283:19 | .capitalized |

0 commit comments

Comments
 (0)