Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4359686

Browse files
geoffw0geoffw0
committed
Swift: Move query logic to a .qll.
1 parent 87fa159 commit 4359686

2 files changed

Lines changed: 92 additions & 85 deletions

File tree

‎swift/ql/lib/codeql/swift/security/UncontrolledFormatStringQuery.qll‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
/**
2+
* Provides a taint-tracking configuration for reasoning about uncontrolled format string
3+
* vulnerabilities.
4+
*/
5+
6+
import swift
7+
import codeql.swift.dataflow.DataFlow
8+
import codeql.swift.dataflow.TaintTracking
9+
import codeql.swift.dataflow.FlowSources
10+
11+
/**
12+
* A function that takes a `printf` style format argument.
13+
*/
14+
abstract class FormattingFunction extends AbstractFunctionDecl {
15+
/**
16+
* Gets the position of the format argument.
17+
*/
18+
abstract int getFormatParameterIndex();
19+
}
20+
21+
/**
22+
* An initializer for `String`, `NSString` or `NSMutableString` that takes a
23+
* `printf` style format argument.
24+
*/
25+
class StringInitWithFormat extends FormattingFunction, MethodDecl {
26+
StringInitWithFormat() {
27+
exists(string fName |
28+
this.hasQualifiedName(["String", "NSString", "NSMutableString"], fName) and
29+
fName.matches("init(format:%")
30+
)
31+
}
32+
33+
override int getFormatParameterIndex() { result = 0 }
34+
}
35+
36+
/**
37+
* The `localizedStringWithFormat` method of `String`, `NSString` and `NSMutableString`.
38+
*/
39+
class LocalizedStringWithFormat extends FormattingFunction, MethodDecl {
40+
LocalizedStringWithFormat() {
41+
this.hasQualifiedName(["String", "NSString", "NSMutableString"],
42+
"localizedStringWithFormat(_:_:)")
43+
}
44+
45+
override int getFormatParameterIndex() { result = 0 }
46+
}
47+
48+
/**
49+
* The functions `NSLog` and `NSLogv`.
50+
*/
51+
class NsLog extends FormattingFunction, FreeFunctionDecl {
52+
NsLog() { this.getName() = ["NSLog(_:_:)", "NSLogv(_:_:)"] }
53+
54+
override int getFormatParameterIndex() { result = 0 }
55+
}
56+
57+
/**
58+
* The `NSException.raise` method.
59+
*/
60+
class NsExceptionRaise extends FormattingFunction, MethodDecl {
61+
NsExceptionRaise() { this.hasQualifiedName("NSException", "raise(_:format:arguments:)") }
62+
63+
override int getFormatParameterIndex() { result = 1 }
64+
}
65+
66+
/**
67+
* A call to a function that takes a `printf` style format argument.
68+
*/
69+
class FormattingFunctionCall extends CallExpr {
70+
FormattingFunction target;
71+
72+
FormattingFunctionCall() { target = this.getStaticTarget() }
73+
74+
/**
75+
* Gets the format expression used in this call.
76+
*/
77+
Expr getFormat() { result = this.getArgument(target.getFormatParameterIndex()).getExpr() }
78+
}
79+
80+
/**
81+
* A taint configuration for tainted data that reaches a format string.
82+
*/
83+
class TaintedFormatConfiguration extends TaintTracking::Configuration {
84+
TaintedFormatConfiguration() { this = "TaintedFormatConfiguration" }
85+
86+
override predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
87+
88+
override predicate isSink(DataFlow::Node node) {
89+
node.asExpr() = any(FormattingFunctionCall fc).getFormat()
90+
}
91+
}

‎swift/ql/src/queries/Security/CWE-134/UncontrolledFormatString.ql‎

Lines changed: 1 addition & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -12,92 +12,8 @@
1212

1313
import swift
1414
import codeql.swift.dataflow.DataFlow
15-
import codeql.swift.dataflow.TaintTracking
16-
import codeql.swift.dataflow.FlowSources
15+
import codeql.swift.security.UncontrolledFormatStringQuery
1716
import DataFlow::PathGraph
18-
import swift
19-
20-
/**
21-
* A function that takes a `printf` style format argument.
22-
*/
23-
abstract class FormattingFunction extends AbstractFunctionDecl {
24-
/**
25-
* Gets the position of the format argument.
26-
*/
27-
abstract int getFormatParameterIndex();
28-
}
29-
30-
/**
31-
* An initializer for `String`, `NSString` or `NSMutableString` that takes a
32-
* `printf` style format argument.
33-
*/
34-
class StringInitWithFormat extends FormattingFunction, MethodDecl {
35-
StringInitWithFormat() {
36-
exists(string fName |
37-
this.hasQualifiedName(["String", "NSString", "NSMutableString"], fName) and
38-
fName.matches("init(format:%")
39-
)
40-
}
41-
42-
override int getFormatParameterIndex() { result = 0 }
43-
}
44-
45-
/**
46-
* The `localizedStringWithFormat` method of `String`, `NSString` and `NSMutableString`.
47-
*/
48-
class LocalizedStringWithFormat extends FormattingFunction, MethodDecl {
49-
LocalizedStringWithFormat() {
50-
this.hasQualifiedName(["String", "NSString", "NSMutableString"],
51-
"localizedStringWithFormat(_:_:)")
52-
}
53-
54-
override int getFormatParameterIndex() { result = 0 }
55-
}
56-
57-
/**
58-
* The functions `NSLog` and `NSLogv`.
59-
*/
60-
class NsLog extends FormattingFunction, FreeFunctionDecl {
61-
NsLog() { this.getName() = ["NSLog(_:_:)", "NSLogv(_:_:)"] }
62-
63-
override int getFormatParameterIndex() { result = 0 }
64-
}
65-
66-
/**
67-
* The `NSException.raise` method.
68-
*/
69-
class NsExceptionRaise extends FormattingFunction, MethodDecl {
70-
NsExceptionRaise() { this.hasQualifiedName("NSException", "raise(_:format:arguments:)") }
71-
72-
override int getFormatParameterIndex() { result = 1 }
73-
}
74-
75-
/**
76-
* A call to a function that takes a `printf` style format argument.
77-
*/
78-
class FormattingFunctionCall extends CallExpr {
79-
FormattingFunction target;
80-
81-
FormattingFunctionCall() { target = this.getStaticTarget() }
82-
83-
/**
84-
* Gets the format expression used in this call.
85-
*/
86-
Expr getFormat() { result = this.getArgument(target.getFormatParameterIndex()).getExpr() }
87-
}
88-
89-
/**
90-
* A taint configuration for tainted data that reaches a format string.
91-
*/
92-
class TaintedFormatConfiguration extends TaintTracking::Configuration {
93-
TaintedFormatConfiguration() { this = "TaintedFormatConfiguration" }
94-
95-
override predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
96-
97-
override predicate isSink(DataFlow::Node node) {
98-
node.asExpr() = any(FormattingFunctionCall fc).getFormat()
99-
}
100-
}
10117

10218
from TaintedFormatConfiguration config, DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode
10319
where config.hasFlowPath(sourceNode, sinkNode)

0 commit comments

Comments
 (0)