Skip to content

Commit 5faa25f

Browse files
geoffw0geoffw0
committed
Swift: Make passwords their own sensitive data type.
1 parent b5a45c6 commit 5faa25f

File tree

2 files changed

+110
-90
lines changed

2 files changed

+110
-90
lines changed

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ private import codeql.swift.dataflow.DataFlow
1010
private import codeql.swift.dataflow.ExternalFlow
1111

1212
private newtype TSensitiveDataType =
13+
TPassword() or
1314
TCredential() or
1415
TPrivateInfo()
1516

@@ -26,18 +27,32 @@ abstract class SensitiveDataType extends TSensitiveDataType {
2627
}
2728

2829
/**
29-
* The type of sensitive expression for passwords and other credentials.
30+
* The type of sensitive expression for passwords.
31+
*/
32+
class SensitivePassword extends SensitiveDataType, TPassword {
33+
override string toString() { result = "password" }
34+
35+
override string getRegexp() {
36+
result = HeuristicNames::maybeSensitiveRegexp(SensitiveDataClassification::password())
37+
or
38+
result = "(?is).*pass.?phrase.*"
39+
}
40+
}
41+
42+
/**
43+
* The type of sensitive expression for credentials and secrets other than passwords.
3044
*/
3145
class SensitiveCredential extends SensitiveDataType, TCredential {
3246
override string toString() { result = "credential" }
3347

3448
override string getRegexp() {
3549
exists(SensitiveDataClassification classification |
50+
not classification = SensitiveDataClassification::password() and // covered by `SensitivePassword`
3651
not classification = SensitiveDataClassification::id() and // not accurate enough
3752
result = HeuristicNames::maybeSensitiveRegexp(classification)
3853
)
3954
or
40-
result = "(?is).*((account|accnt|licen(se|ce)).?(id|key)|one.?time.?code|pass.?phrase).*"
55+
result = "(?is).*((account|accnt|licen(se|ce)).?(id|key)|one.?time.?code).*"
4156
}
4257
}
4358

@@ -176,6 +191,11 @@ class SensitiveExpr extends Expr {
176191
not label.regexpMatch(regexpProbablySafe())
177192
or
178193
(
194+
// modeled sensitive password
195+
sourceNode(DataFlow::exprNode(this), "sensitive-password") and
196+
sensitiveType = TPassword() and
197+
label = "password"
198+
or
179199
// modeled sensitive credential
180200
sourceNode(DataFlow::exprNode(this), "sensitive-credential") and
181201
sensitiveType = TCredential() and

‎swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected‎

Lines changed: 88 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -26,16 +26,16 @@
2626
| sqlite3_c_api.swift:42:69:42:69 | medicalNotes | label:medicalNotes, type:private information |
2727
| sqlite3_c_api.swift:43:49:43:49 | medicalNotes | label:medicalNotes, type:private information |
2828
| sqlite3_c_api.swift:58:36:58:36 | medicalNotes | label:medicalNotes, type:private information |
29-
| testAlamofire.swift:150:45:150:45 | password | label:password, type:credential |
30-
| testAlamofire.swift:152:51:152:51 | password | label:password, type:credential |
29+
| testAlamofire.swift:150:45:150:45 | password | label:password, type:password |
30+
| testAlamofire.swift:152:51:152:51 | password | label:password, type:password |
3131
| testAlamofire.swift:154:38:154:38 | email | label:email, type:private information |
3232
| testAlamofire.swift:159:26:159:26 | email | label:email, type:private information |
3333
| testAlamofire.swift:171:35:171:35 | email | label:email, type:private information |
3434
| testAlamofire.swift:177:35:177:35 | email | label:email, type:private information |
35-
| testAlamofire.swift:187:65:187:65 | password | label:password, type:credential |
36-
| testAlamofire.swift:195:64:195:64 | password | label:password, type:credential |
37-
| testAlamofire.swift:205:62:205:62 | password | label:password, type:credential |
38-
| testAlamofire.swift:213:65:213:65 | password | label:password, type:credential |
35+
| testAlamofire.swift:187:65:187:65 | password | label:password, type:password |
36+
| testAlamofire.swift:195:64:195:64 | password | label:password, type:password |
37+
| testAlamofire.swift:205:62:205:62 | password | label:password, type:password |
38+
| testAlamofire.swift:213:65:213:65 | password | label:password, type:password |
3939
| testCoreData2.swift:37:16:37:16 | bankAccountNo | label:bankAccountNo, type:private information |
4040
| testCoreData2.swift:38:2:38:6 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
4141
| testCoreData2.swift:39:2:39:6 | .myBankAccountNumber | label:myBankAccountNumber, type:private information |
@@ -76,99 +76,99 @@
7676
| testCoreData2.swift:91:10:91:10 | bankAccountNo | label:bankAccountNo, type:private information |
7777
| testCoreData2.swift:95:10:95:10 | bankAccountNo | label:bankAccountNo, type:private information |
7878
| testCoreData2.swift:101:10:101:10 | bankAccountNo | label:bankAccountNo, type:private information |
79-
| testCoreData.swift:48:15:48:15 | password | label:password, type:credential |
80-
| testCoreData.swift:51:24:51:24 | password | label:password, type:credential |
81-
| testCoreData.swift:58:15:58:15 | password | label:password, type:credential |
82-
| testCoreData.swift:61:25:61:25 | password | label:password, type:credential |
83-
| testCoreData.swift:64:16:64:16 | password | label:password, type:credential |
84-
| testCoreData.swift:77:24:77:24 | x | label:password, type:credential |
85-
| testCoreData.swift:80:10:80:22 | call to getPassword() | label:getPassword, type:credential |
86-
| testCoreData.swift:85:15:85:17 | .password | label:password, type:credential |
87-
| testCoreData.swift:91:10:91:10 | passwd | label:passwd, type:credential |
88-
| testCoreData.swift:92:10:92:10 | passwd | label:passwd, type:credential |
89-
| testCoreData.swift:93:10:93:10 | passwd | label:passwd, type:credential |
79+
| testCoreData.swift:48:15:48:15 | password | label:password, type:password |
80+
| testCoreData.swift:51:24:51:24 | password | label:password, type:password |
81+
| testCoreData.swift:58:15:58:15 | password | label:password, type:password |
82+
| testCoreData.swift:61:25:61:25 | password | label:password, type:password |
83+
| testCoreData.swift:64:16:64:16 | password | label:password, type:password |
84+
| testCoreData.swift:77:24:77:24 | x | label:password, type:password |
85+
| testCoreData.swift:80:10:80:22 | call to getPassword() | label:getPassword, type:password |
86+
| testCoreData.swift:85:15:85:17 | .password | label:password, type:password |
87+
| testCoreData.swift:91:10:91:10 | passwd | label:passwd, type:password |
88+
| testCoreData.swift:92:10:92:10 | passwd | label:passwd, type:password |
89+
| testCoreData.swift:93:10:93:10 | passwd | label:passwd, type:password |
9090
| testCoreData.swift:128:15:128:33 | call to generateSecretKey() | label:generateSecretKey, type:credential |
9191
| testCoreData.swift:129:15:129:30 | call to getCertificate() | label:getCertificate, type:credential |
92-
| testGRDB.swift:73:57:73:57 | password | label:password, type:credential |
93-
| testGRDB.swift:76:43:76:43 | password | label:password, type:credential |
94-
| testGRDB.swift:81:45:81:45 | password | label:password, type:credential |
95-
| testGRDB.swift:83:45:83:45 | password | label:password, type:credential |
96-
| testGRDB.swift:85:45:85:45 | password | label:password, type:credential |
97-
| testGRDB.swift:87:45:87:45 | password | label:password, type:credential |
98-
| testGRDB.swift:92:38:92:38 | password | label:password, type:credential |
99-
| testGRDB.swift:95:37:95:37 | password | label:password, type:credential |
100-
| testGRDB.swift:100:73:100:73 | password | label:password, type:credential |
101-
| testGRDB.swift:101:73:101:73 | password | label:password, type:credential |
102-
| testGRDB.swift:107:53:107:53 | password | label:password, type:credential |
103-
| testGRDB.swift:109:53:109:53 | password | label:password, type:credential |
104-
| testGRDB.swift:111:52:111:52 | password | label:password, type:credential |
105-
| testGRDB.swift:116:48:116:48 | password | label:password, type:credential |
106-
| testGRDB.swift:118:48:118:48 | password | label:password, type:credential |
107-
| testGRDB.swift:121:45:121:45 | password | label:password, type:credential |
108-
| testGRDB.swift:123:45:123:45 | password | label:password, type:credential |
109-
| testGRDB.swift:126:45:126:45 | password | label:password, type:credential |
110-
| testGRDB.swift:128:45:128:45 | password | label:password, type:credential |
111-
| testGRDB.swift:131:45:131:45 | password | label:password, type:credential |
112-
| testGRDB.swift:133:45:133:45 | password | label:password, type:credential |
113-
| testGRDB.swift:138:69:138:69 | password | label:password, type:credential |
114-
| testGRDB.swift:140:69:140:69 | password | label:password, type:credential |
115-
| testGRDB.swift:143:66:143:66 | password | label:password, type:credential |
116-
| testGRDB.swift:145:66:145:66 | password | label:password, type:credential |
117-
| testGRDB.swift:148:66:148:66 | password | label:password, type:credential |
118-
| testGRDB.swift:150:66:150:66 | password | label:password, type:credential |
119-
| testGRDB.swift:153:66:153:66 | password | label:password, type:credential |
120-
| testGRDB.swift:155:66:155:66 | password | label:password, type:credential |
121-
| testGRDB.swift:160:60:160:60 | password | label:password, type:credential |
122-
| testGRDB.swift:161:51:161:51 | password | label:password, type:credential |
123-
| testGRDB.swift:164:60:164:60 | password | label:password, type:credential |
124-
| testGRDB.swift:165:51:165:51 | password | label:password, type:credential |
125-
| testGRDB.swift:169:57:169:57 | password | label:password, type:credential |
126-
| testGRDB.swift:170:48:170:48 | password | label:password, type:credential |
127-
| testGRDB.swift:173:57:173:57 | password | label:password, type:credential |
128-
| testGRDB.swift:174:48:174:48 | password | label:password, type:credential |
129-
| testGRDB.swift:178:57:178:57 | password | label:password, type:credential |
130-
| testGRDB.swift:179:48:179:48 | password | label:password, type:credential |
131-
| testGRDB.swift:182:57:182:57 | password | label:password, type:credential |
132-
| testGRDB.swift:183:48:183:48 | password | label:password, type:credential |
133-
| testGRDB.swift:187:57:187:57 | password | label:password, type:credential |
134-
| testGRDB.swift:188:48:188:48 | password | label:password, type:credential |
135-
| testGRDB.swift:191:57:191:57 | password | label:password, type:credential |
136-
| testGRDB.swift:192:48:192:48 | password | label:password, type:credential |
137-
| testGRDB.swift:198:30:198:30 | password | label:password, type:credential |
138-
| testGRDB.swift:201:24:201:24 | password | label:password, type:credential |
139-
| testGRDB.swift:206:67:206:67 | password | label:password, type:credential |
140-
| testGRDB.swift:208:81:208:81 | password | label:password, type:credential |
141-
| testGRDB.swift:210:85:210:85 | password | label:password, type:credential |
142-
| testGRDB.swift:212:99:212:99 | password | label:password, type:credential |
143-
| testRealm2.swift:18:11:18:11 | myPassword | label:myPassword, type:credential |
144-
| testRealm.swift:31:20:31:20 | .password | label:password, type:credential |
145-
| testRealm.swift:41:11:41:11 | myPassword | label:myPassword, type:credential |
146-
| testRealm.swift:49:11:49:11 | myPassword | label:myPassword, type:credential |
147-
| testRealm.swift:59:12:59:12 | myPassword | label:myPassword, type:credential |
148-
| testRealm.swift:66:11:66:11 | myPassword | label:myPassword, type:credential |
149-
| testRealm.swift:73:2:73:4 | .password | label:password, type:credential |
150-
| testRealm.swift:73:15:73:15 | myPassword | label:myPassword, type:credential |
151-
| testSend.swift:29:19:29:19 | passwordPlain | label:passwordPlain, type:credential |
152-
| testSend.swift:33:19:33:19 | passwordPlain | label:passwordPlain, type:credential |
153-
| testSend.swift:58:13:58:13 | password | label:password, type:credential |
154-
| testSend.swift:59:13:59:13 | password | label:password, type:credential |
155-
| testSend.swift:60:17:60:17 | password | label:password, type:credential |
156-
| testSend.swift:61:23:61:23 | password | label:password, type:credential |
157-
| testSend.swift:62:27:62:27 | password | label:password, type:credential |
158-
| testSend.swift:63:27:63:27 | password | label:password, type:credential |
92+
| testGRDB.swift:73:57:73:57 | password | label:password, type:password |
93+
| testGRDB.swift:76:43:76:43 | password | label:password, type:password |
94+
| testGRDB.swift:81:45:81:45 | password | label:password, type:password |
95+
| testGRDB.swift:83:45:83:45 | password | label:password, type:password |
96+
| testGRDB.swift:85:45:85:45 | password | label:password, type:password |
97+
| testGRDB.swift:87:45:87:45 | password | label:password, type:password |
98+
| testGRDB.swift:92:38:92:38 | password | label:password, type:password |
99+
| testGRDB.swift:95:37:95:37 | password | label:password, type:password |
100+
| testGRDB.swift:100:73:100:73 | password | label:password, type:password |
101+
| testGRDB.swift:101:73:101:73 | password | label:password, type:password |
102+
| testGRDB.swift:107:53:107:53 | password | label:password, type:password |
103+
| testGRDB.swift:109:53:109:53 | password | label:password, type:password |
104+
| testGRDB.swift:111:52:111:52 | password | label:password, type:password |
105+
| testGRDB.swift:116:48:116:48 | password | label:password, type:password |
106+
| testGRDB.swift:118:48:118:48 | password | label:password, type:password |
107+
| testGRDB.swift:121:45:121:45 | password | label:password, type:password |
108+
| testGRDB.swift:123:45:123:45 | password | label:password, type:password |
109+
| testGRDB.swift:126:45:126:45 | password | label:password, type:password |
110+
| testGRDB.swift:128:45:128:45 | password | label:password, type:password |
111+
| testGRDB.swift:131:45:131:45 | password | label:password, type:password |
112+
| testGRDB.swift:133:45:133:45 | password | label:password, type:password |
113+
| testGRDB.swift:138:69:138:69 | password | label:password, type:password |
114+
| testGRDB.swift:140:69:140:69 | password | label:password, type:password |
115+
| testGRDB.swift:143:66:143:66 | password | label:password, type:password |
116+
| testGRDB.swift:145:66:145:66 | password | label:password, type:password |
117+
| testGRDB.swift:148:66:148:66 | password | label:password, type:password |
118+
| testGRDB.swift:150:66:150:66 | password | label:password, type:password |
119+
| testGRDB.swift:153:66:153:66 | password | label:password, type:password |
120+
| testGRDB.swift:155:66:155:66 | password | label:password, type:password |
121+
| testGRDB.swift:160:60:160:60 | password | label:password, type:password |
122+
| testGRDB.swift:161:51:161:51 | password | label:password, type:password |
123+
| testGRDB.swift:164:60:164:60 | password | label:password, type:password |
124+
| testGRDB.swift:165:51:165:51 | password | label:password, type:password |
125+
| testGRDB.swift:169:57:169:57 | password | label:password, type:password |
126+
| testGRDB.swift:170:48:170:48 | password | label:password, type:password |
127+
| testGRDB.swift:173:57:173:57 | password | label:password, type:password |
128+
| testGRDB.swift:174:48:174:48 | password | label:password, type:password |
129+
| testGRDB.swift:178:57:178:57 | password | label:password, type:password |
130+
| testGRDB.swift:179:48:179:48 | password | label:password, type:password |
131+
| testGRDB.swift:182:57:182:57 | password | label:password, type:password |
132+
| testGRDB.swift:183:48:183:48 | password | label:password, type:password |
133+
| testGRDB.swift:187:57:187:57 | password | label:password, type:password |
134+
| testGRDB.swift:188:48:188:48 | password | label:password, type:password |
135+
| testGRDB.swift:191:57:191:57 | password | label:password, type:password |
136+
| testGRDB.swift:192:48:192:48 | password | label:password, type:password |
137+
| testGRDB.swift:198:30:198:30 | password | label:password, type:password |
138+
| testGRDB.swift:201:24:201:24 | password | label:password, type:password |
139+
| testGRDB.swift:206:67:206:67 | password | label:password, type:password |
140+
| testGRDB.swift:208:81:208:81 | password | label:password, type:password |
141+
| testGRDB.swift:210:85:210:85 | password | label:password, type:password |
142+
| testGRDB.swift:212:99:212:99 | password | label:password, type:password |
143+
| testRealm2.swift:18:11:18:11 | myPassword | label:myPassword, type:password |
144+
| testRealm.swift:31:20:31:20 | .password | label:password, type:password |
145+
| testRealm.swift:41:11:41:11 | myPassword | label:myPassword, type:password |
146+
| testRealm.swift:49:11:49:11 | myPassword | label:myPassword, type:password |
147+
| testRealm.swift:59:12:59:12 | myPassword | label:myPassword, type:password |
148+
| testRealm.swift:66:11:66:11 | myPassword | label:myPassword, type:password |
149+
| testRealm.swift:73:2:73:4 | .password | label:password, type:password |
150+
| testRealm.swift:73:15:73:15 | myPassword | label:myPassword, type:password |
151+
| testSend.swift:29:19:29:19 | passwordPlain | label:passwordPlain, type:password |
152+
| testSend.swift:33:19:33:19 | passwordPlain | label:passwordPlain, type:password |
153+
| testSend.swift:58:13:58:13 | password | label:password, type:password |
154+
| testSend.swift:59:13:59:13 | password | label:password, type:password |
155+
| testSend.swift:60:17:60:17 | password | label:password, type:password |
156+
| testSend.swift:61:23:61:23 | password | label:password, type:password |
157+
| testSend.swift:62:27:62:27 | password | label:password, type:password |
158+
| testSend.swift:63:27:63:27 | password | label:password, type:password |
159159
| testSend.swift:71:27:71:27 | license_key | label:license_key, type:credential |
160160
| testSend.swift:72:27:72:30 | .mobileNumber | label:mobileNumber, type:private information |
161-
| testSend.swift:75:27:75:30 | .passwordFeatureEnabled | label:passwordFeatureEnabled, type:credential |
161+
| testSend.swift:75:27:75:30 | .passwordFeatureEnabled | label:passwordFeatureEnabled, type:password |
162162
| testSend.swift:76:27:76:30 | .Telephone | label:Telephone, type:private information |
163163
| testSend.swift:77:27:77:30 | .birth_day | label:birth_day, type:private information |
164164
| testSend.swift:78:27:78:30 | .CarePlanID | label:CarePlanID, type:private information |
165165
| testSend.swift:79:27:79:30 | .BankCardNo | label:BankCardNo, type:private information |
166166
| testSend.swift:80:27:80:30 | .MyCreditRating | label:MyCreditRating, type:private information |
167-
| testSend.swift:94:27:94:30 | .password | label:password, type:credential |
168-
| testURL.swift:39:50:39:50 | passwd | label:passwd, type:credential |
167+
| testSend.swift:94:27:94:30 | .password | label:password, type:password |
168+
| testURL.swift:39:50:39:50 | passwd | label:passwd, type:password |
169169
| testURL.swift:41:51:41:51 | account_no | label:account_no, type:private information |
170170
| testURL.swift:42:51:42:51 | credit_card_no | label:credit_card_no, type:private information |
171-
| testURL.swift:46:22:46:22 | passwd | label:passwd, type:credential |
171+
| testURL.swift:46:22:46:22 | passwd | label:passwd, type:password |
172172
| testURL.swift:50:51:50:51 | e_mail | label:e_mail, type:private information |
173173
| testURL.swift:52:53:52:53 | a_homeaddr_z | label:a_homeaddr_z, type:private information |
174174
| testURL.swift:54:51:54:51 | resident_ID | label:resident_ID, type:private information |

0 commit comments

Comments
 (0)