Skip to content

Commit 7ba18e6

Browse files
geoffw0geoffw0
committed
Swift: Add sinks for algorithms that are OK for sensitive data hashing but not for password hashing.
1 parent c2d49c0 commit 7ba18e6

File tree

4 files changed

+125
-30
lines changed

4 files changed

+125
-30
lines changed

‎swift/ql/lib/codeql/swift/security/WeakPasswordHashingExtensions.qll‎

Lines changed: 56 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -43,11 +43,62 @@ class WeakPasswordHashingAdditionalFlowStep extends Unit {
4343
* hashing as well.
4444
*/
4545
private class InheritedWeakPasswordHashingSink extends WeakPasswordHashingSink {
46-
InheritedWeakPasswordHashingSink() {
47-
this instanceof WeakSensitiveDataHashingSink
48-
}
46+
InheritedWeakPasswordHashingSink() { this instanceof WeakSensitiveDataHashingSink }
4947

50-
override string getAlgorithm() { result = this.(WeakSensitiveDataHashingSink).getAlgorithm() }
48+
override string getAlgorithm() { result = this.(WeakSensitiveDataHashingSink).getAlgorithm() }
49+
}
50+
51+
private class WeakSensitiveDataHashingSinks extends SinkModelCsv {
52+
override predicate row(string row) {
53+
row =
54+
[
55+
// CryptoKit
56+
// (SHA-256, SHA-384 and SHA-512 are all variants of the SHA-2 algorithm)
57+
";SHA256;true;hash(data:);;;Argument[0];weak-password-hash-input-SHA256",
58+
";SHA256;true;update(data:);;;Argument[0];weak-password-hash-input-SHA256",
59+
";SHA256;true;update(bufferPointer:);;;Argument[0];weak-password-hash-input-SHA256",
60+
";SHA384;true;hash(data:);;;Argument[0];weak-password-hash-input-SHA384",
61+
";SHA384;true;update(data:);;;Argument[0];weak-password-hash-input-SHA384",
62+
";SHA384;true;update(bufferPointer:);;;Argument[0];weak-password-hash-input-SHA384",
63+
";SHA512;true;hash(data:);;;Argument[0];weak-password-hash-input-SHA512",
64+
";SHA512;true;update(data:);;;Argument[0];weak-password-hash-input-SHA512",
65+
";SHA512;true;update(bufferPointer:);;;Argument[0];weak-password-hash-input-SHA512",
66+
// CryptoSwift
67+
";SHA2;true;calculate(for:);;;Argument[0];weak-password-hash-input-SHA2",
68+
";SHA2;true;callAsFunction(_:);;;Argument[0];weak-password-hash-input-SHA2",
69+
";SHA2;true;process64(block:currentHash:);;;Argument[0];weak-password-hash-input-SHA2",
70+
";SHA2;true;process32(block:currentHash:);;;Argument[0];weak-password-hash-input-SHA2",
71+
";SHA2;true;update(withBytes:isLast:);;;Argument[0];weak-password-hash-input-SHA2",
72+
";SHA3;true;calculate(for:);;;Argument[0];weak-password-hash-input-SHA2",
73+
";SHA3;true;callAsFunction(_:);;;Argument[0];weak-password-hash-input-SHA2",
74+
";SHA3;true;process(block:currentHash:);;;Argument[0];weak-password-hash-input-SHA2",
75+
";SHA3;true;update(withBytes:isLast:);;;Argument[0];weak-password-hash-input-SHA2",
76+
";Digest;true;sha2(_:variant:);;;Argument[0];weak-password-hash-input-SHA2",
77+
";Digest;true;sha3(_:variant:);;;Argument[0];weak-password-hash-input-SHA3",
78+
";Digest;true;sha224(_:);;;Argument[0];weak-password-hash-input-SHA224",
79+
";Digest;true;sha256(_:);;;Argument[0];weak-password-hash-input-SHA256",
80+
";Digest;true;sha384(_:);;;Argument[0];weak-password-hash-input-SHA384",
81+
";Digest;true;sha512(_:);;;Argument[0];weak-password-hash-input-SHA512",
82+
";Array;true;sha2(_:);;;Argument[-1];weak-password-hash-input-SHA2",
83+
";Array;true;sha3(_:);;;Argument[-1];weak-password-hash-input-SHA3",
84+
";Array;true;sha224();;;Argument[-1];weak-password-hash-input-SHA224",
85+
";Array;true;sha256();;;Argument[-1];weak-password-hash-input-SHA256",
86+
";Array;true;sha384();;;Argument[-1];weak-password-hash-input-SHA384",
87+
";Array;true;sha512();;;Argument[-1];weak-password-hash-input-SHA512",
88+
";Data;true;sha2(_:);;;Argument[-1];weak-password-hash-input-SHA2",
89+
";Data;true;sha3(_:);;;Argument[-1];weak-password-hash-input-SHA3",
90+
";Data;true;sha224();;;Argument[-1];weak-password-hash-input-SHA224",
91+
";Data;true;sha256();;;Argument[-1];weak-password-hash-input-SHA256",
92+
";Data;true;sha384();;;Argument[-1];weak-password-hash-input-SHA384",
93+
";Data;true;sha512();;;Argument[-1];weak-password-hash-input-SHA512",
94+
";String;true;sha2(_:);;;Argument[-1];weak-password-hash-input-SHA2",
95+
";String;true;sha3(_:);;;Argument[-1];weak-password-hash-input-SHA3",
96+
";String;true;sha224();;;Argument[-1];weak-password-hash-input-SHA224",
97+
";String;true;sha256();;;Argument[-1];weak-password-hash-input-SHA256",
98+
";String;true;sha384();;;Argument[-1];weak-password-hash-input-SHA384",
99+
";String;true;sha512();;;Argument[-1];weak-password-hash-input-SHA512",
100+
]
101+
}
51102
}
52103

53104
/**
@@ -56,9 +107,7 @@ private class InheritedWeakPasswordHashingSink extends WeakPasswordHashingSink {
56107
private class DefaultWeakPasswordHashingSink extends WeakPasswordHashingSink {
57108
string algorithm;
58109

59-
DefaultWeakPasswordHashingSink() {
60-
sinkNode(this, "weak-password-hash-input-" + algorithm)
61-
}
110+
DefaultWeakPasswordHashingSink() { sinkNode(this, "weak-password-hash-input-" + algorithm) }
62111

63112
override string getAlgorithm() { result = algorithm }
64113
}

‎swift/ql/test/query-tests/Security/CWE-328/WeakPasswordHashing.expected‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,35 +2,81 @@ edges
22
nodes
33
| testCryptoKit.swift:56:47:56:47 | passwd | semmle.label | passwd |
44
| testCryptoKit.swift:63:44:63:44 | passwd | semmle.label | passwd |
5+
| testCryptoKit.swift:69:37:69:37 | passwd | semmle.label | passwd |
6+
| testCryptoKit.swift:75:37:75:37 | passwd | semmle.label | passwd |
7+
| testCryptoKit.swift:81:37:81:37 | passwd | semmle.label | passwd |
58
| testCryptoKit.swift:90:23:90:23 | passwd | semmle.label | passwd |
69
| testCryptoKit.swift:99:23:99:23 | passwd | semmle.label | passwd |
10+
| testCryptoKit.swift:108:23:108:23 | passwd | semmle.label | passwd |
11+
| testCryptoKit.swift:116:23:116:23 | passwd | semmle.label | passwd |
12+
| testCryptoKit.swift:124:23:124:23 | passwd | semmle.label | passwd |
713
| testCryptoKit.swift:132:32:132:32 | passwd | semmle.label | passwd |
814
| testCryptoKit.swift:141:32:141:32 | passwd | semmle.label | passwd |
15+
| testCryptoKit.swift:150:32:150:32 | passwd | semmle.label | passwd |
16+
| testCryptoKit.swift:158:32:158:32 | passwd | semmle.label | passwd |
17+
| testCryptoKit.swift:166:32:166:32 | passwd | semmle.label | passwd |
918
| testCryptoSwift.swift:154:30:154:30 | passwdArray | semmle.label | passwdArray |
1019
| testCryptoSwift.swift:157:31:157:31 | passwdArray | semmle.label | passwdArray |
20+
| testCryptoSwift.swift:160:47:160:47 | passwdArray | semmle.label | passwdArray |
21+
| testCryptoSwift.swift:163:47:163:47 | passwdArray | semmle.label | passwdArray |
1122
| testCryptoSwift.swift:167:20:167:20 | passwdArray | semmle.label | passwdArray |
1223
| testCryptoSwift.swift:170:21:170:21 | passwdArray | semmle.label | passwdArray |
24+
| testCryptoSwift.swift:173:23:173:23 | passwdArray | semmle.label | passwdArray |
25+
| testCryptoSwift.swift:176:21:176:21 | passwdArray | semmle.label | passwdArray |
26+
| testCryptoSwift.swift:179:21:179:21 | passwdArray | semmle.label | passwdArray |
1327
| testCryptoSwift.swift:183:9:183:9 | passwdArray | semmle.label | passwdArray |
1428
| testCryptoSwift.swift:186:9:186:9 | passwdArray | semmle.label | passwdArray |
29+
| testCryptoSwift.swift:189:9:189:9 | passwdArray | semmle.label | passwdArray |
30+
| testCryptoSwift.swift:192:9:192:9 | passwdArray | semmle.label | passwdArray |
31+
| testCryptoSwift.swift:195:9:195:9 | passwdArray | semmle.label | passwdArray |
1532
| testCryptoSwift.swift:201:9:201:9 | passwdData | semmle.label | passwdData |
1633
| testCryptoSwift.swift:204:9:204:9 | passwdData | semmle.label | passwdData |
34+
| testCryptoSwift.swift:207:9:207:9 | passwdData | semmle.label | passwdData |
35+
| testCryptoSwift.swift:210:9:210:9 | passwdData | semmle.label | passwdData |
36+
| testCryptoSwift.swift:213:9:213:9 | passwdData | semmle.label | passwdData |
1737
| testCryptoSwift.swift:219:9:219:9 | passwd | semmle.label | passwd |
1838
| testCryptoSwift.swift:222:9:222:9 | passwd | semmle.label | passwd |
39+
| testCryptoSwift.swift:225:9:225:9 | passwd | semmle.label | passwd |
40+
| testCryptoSwift.swift:228:9:228:9 | passwd | semmle.label | passwd |
41+
| testCryptoSwift.swift:231:9:231:9 | passwd | semmle.label | passwd |
1942
subpaths
2043
#select
2144
| testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:56:47:56:47 | passwd | password (passwd) |
2245
| testCryptoKit.swift:63:44:63:44 | passwd | testCryptoKit.swift:63:44:63:44 | passwd | testCryptoKit.swift:63:44:63:44 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:63:44:63:44 | passwd | password (passwd) |
46+
| testCryptoKit.swift:69:37:69:37 | passwd | testCryptoKit.swift:69:37:69:37 | passwd | testCryptoKit.swift:69:37:69:37 | passwd | Insecure hashing algorithm (SHA256) depends on $@. | testCryptoKit.swift:69:37:69:37 | passwd | password (passwd) |
47+
| testCryptoKit.swift:75:37:75:37 | passwd | testCryptoKit.swift:75:37:75:37 | passwd | testCryptoKit.swift:75:37:75:37 | passwd | Insecure hashing algorithm (SHA384) depends on $@. | testCryptoKit.swift:75:37:75:37 | passwd | password (passwd) |
48+
| testCryptoKit.swift:81:37:81:37 | passwd | testCryptoKit.swift:81:37:81:37 | passwd | testCryptoKit.swift:81:37:81:37 | passwd | Insecure hashing algorithm (SHA512) depends on $@. | testCryptoKit.swift:81:37:81:37 | passwd | password (passwd) |
2349
| testCryptoKit.swift:90:23:90:23 | passwd | testCryptoKit.swift:90:23:90:23 | passwd | testCryptoKit.swift:90:23:90:23 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:90:23:90:23 | passwd | password (passwd) |
2450
| testCryptoKit.swift:99:23:99:23 | passwd | testCryptoKit.swift:99:23:99:23 | passwd | testCryptoKit.swift:99:23:99:23 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:99:23:99:23 | passwd | password (passwd) |
51+
| testCryptoKit.swift:108:23:108:23 | passwd | testCryptoKit.swift:108:23:108:23 | passwd | testCryptoKit.swift:108:23:108:23 | passwd | Insecure hashing algorithm (SHA256) depends on $@. | testCryptoKit.swift:108:23:108:23 | passwd | password (passwd) |
52+
| testCryptoKit.swift:116:23:116:23 | passwd | testCryptoKit.swift:116:23:116:23 | passwd | testCryptoKit.swift:116:23:116:23 | passwd | Insecure hashing algorithm (SHA384) depends on $@. | testCryptoKit.swift:116:23:116:23 | passwd | password (passwd) |
53+
| testCryptoKit.swift:124:23:124:23 | passwd | testCryptoKit.swift:124:23:124:23 | passwd | testCryptoKit.swift:124:23:124:23 | passwd | Insecure hashing algorithm (SHA512) depends on $@. | testCryptoKit.swift:124:23:124:23 | passwd | password (passwd) |
2554
| testCryptoKit.swift:132:32:132:32 | passwd | testCryptoKit.swift:132:32:132:32 | passwd | testCryptoKit.swift:132:32:132:32 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:132:32:132:32 | passwd | password (passwd) |
2655
| testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:141:32:141:32 | passwd | password (passwd) |
56+
| testCryptoKit.swift:150:32:150:32 | passwd | testCryptoKit.swift:150:32:150:32 | passwd | testCryptoKit.swift:150:32:150:32 | passwd | Insecure hashing algorithm (SHA256) depends on $@. | testCryptoKit.swift:150:32:150:32 | passwd | password (passwd) |
57+
| testCryptoKit.swift:158:32:158:32 | passwd | testCryptoKit.swift:158:32:158:32 | passwd | testCryptoKit.swift:158:32:158:32 | passwd | Insecure hashing algorithm (SHA384) depends on $@. | testCryptoKit.swift:158:32:158:32 | passwd | password (passwd) |
58+
| testCryptoKit.swift:166:32:166:32 | passwd | testCryptoKit.swift:166:32:166:32 | passwd | testCryptoKit.swift:166:32:166:32 | passwd | Insecure hashing algorithm (SHA512) depends on $@. | testCryptoKit.swift:166:32:166:32 | passwd | password (passwd) |
2759
| testCryptoSwift.swift:154:30:154:30 | passwdArray | testCryptoSwift.swift:154:30:154:30 | passwdArray | testCryptoSwift.swift:154:30:154:30 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:154:30:154:30 | passwdArray | password (passwdArray) |
2860
| testCryptoSwift.swift:157:31:157:31 | passwdArray | testCryptoSwift.swift:157:31:157:31 | passwdArray | testCryptoSwift.swift:157:31:157:31 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:157:31:157:31 | passwdArray | password (passwdArray) |
61+
| testCryptoSwift.swift:160:47:160:47 | passwdArray | testCryptoSwift.swift:160:47:160:47 | passwdArray | testCryptoSwift.swift:160:47:160:47 | passwdArray | Insecure hashing algorithm (SHA2) depends on $@. | testCryptoSwift.swift:160:47:160:47 | passwdArray | password (passwdArray) |
62+
| testCryptoSwift.swift:163:47:163:47 | passwdArray | testCryptoSwift.swift:163:47:163:47 | passwdArray | testCryptoSwift.swift:163:47:163:47 | passwdArray | Insecure hashing algorithm (SHA2) depends on $@. | testCryptoSwift.swift:163:47:163:47 | passwdArray | password (passwdArray) |
2963
| testCryptoSwift.swift:167:20:167:20 | passwdArray | testCryptoSwift.swift:167:20:167:20 | passwdArray | testCryptoSwift.swift:167:20:167:20 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:167:20:167:20 | passwdArray | password (passwdArray) |
3064
| testCryptoSwift.swift:170:21:170:21 | passwdArray | testCryptoSwift.swift:170:21:170:21 | passwdArray | testCryptoSwift.swift:170:21:170:21 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:170:21:170:21 | passwdArray | password (passwdArray) |
65+
| testCryptoSwift.swift:173:23:173:23 | passwdArray | testCryptoSwift.swift:173:23:173:23 | passwdArray | testCryptoSwift.swift:173:23:173:23 | passwdArray | Insecure hashing algorithm (SHA512) depends on $@. | testCryptoSwift.swift:173:23:173:23 | passwdArray | password (passwdArray) |
66+
| testCryptoSwift.swift:176:21:176:21 | passwdArray | testCryptoSwift.swift:176:21:176:21 | passwdArray | testCryptoSwift.swift:176:21:176:21 | passwdArray | Insecure hashing algorithm (SHA2) depends on $@. | testCryptoSwift.swift:176:21:176:21 | passwdArray | password (passwdArray) |
67+
| testCryptoSwift.swift:179:21:179:21 | passwdArray | testCryptoSwift.swift:179:21:179:21 | passwdArray | testCryptoSwift.swift:179:21:179:21 | passwdArray | Insecure hashing algorithm (SHA3) depends on $@. | testCryptoSwift.swift:179:21:179:21 | passwdArray | password (passwdArray) |
3168
| testCryptoSwift.swift:183:9:183:9 | passwdArray | testCryptoSwift.swift:183:9:183:9 | passwdArray | testCryptoSwift.swift:183:9:183:9 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:183:9:183:9 | passwdArray | password (passwdArray) |
3269
| testCryptoSwift.swift:186:9:186:9 | passwdArray | testCryptoSwift.swift:186:9:186:9 | passwdArray | testCryptoSwift.swift:186:9:186:9 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:186:9:186:9 | passwdArray | password (passwdArray) |
70+
| testCryptoSwift.swift:189:9:189:9 | passwdArray | testCryptoSwift.swift:189:9:189:9 | passwdArray | testCryptoSwift.swift:189:9:189:9 | passwdArray | Insecure hashing algorithm (SHA512) depends on $@. | testCryptoSwift.swift:189:9:189:9 | passwdArray | password (passwdArray) |
71+
| testCryptoSwift.swift:192:9:192:9 | passwdArray | testCryptoSwift.swift:192:9:192:9 | passwdArray | testCryptoSwift.swift:192:9:192:9 | passwdArray | Insecure hashing algorithm (SHA2) depends on $@. | testCryptoSwift.swift:192:9:192:9 | passwdArray | password (passwdArray) |
72+
| testCryptoSwift.swift:195:9:195:9 | passwdArray | testCryptoSwift.swift:195:9:195:9 | passwdArray | testCryptoSwift.swift:195:9:195:9 | passwdArray | Insecure hashing algorithm (SHA3) depends on $@. | testCryptoSwift.swift:195:9:195:9 | passwdArray | password (passwdArray) |
3373
| testCryptoSwift.swift:201:9:201:9 | passwdData | testCryptoSwift.swift:201:9:201:9 | passwdData | testCryptoSwift.swift:201:9:201:9 | passwdData | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:201:9:201:9 | passwdData | password (passwdData) |
3474
| testCryptoSwift.swift:204:9:204:9 | passwdData | testCryptoSwift.swift:204:9:204:9 | passwdData | testCryptoSwift.swift:204:9:204:9 | passwdData | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:204:9:204:9 | passwdData | password (passwdData) |
75+
| testCryptoSwift.swift:207:9:207:9 | passwdData | testCryptoSwift.swift:207:9:207:9 | passwdData | testCryptoSwift.swift:207:9:207:9 | passwdData | Insecure hashing algorithm (SHA512) depends on $@. | testCryptoSwift.swift:207:9:207:9 | passwdData | password (passwdData) |
76+
| testCryptoSwift.swift:210:9:210:9 | passwdData | testCryptoSwift.swift:210:9:210:9 | passwdData | testCryptoSwift.swift:210:9:210:9 | passwdData | Insecure hashing algorithm (SHA2) depends on $@. | testCryptoSwift.swift:210:9:210:9 | passwdData | password (passwdData) |
77+
| testCryptoSwift.swift:213:9:213:9 | passwdData | testCryptoSwift.swift:213:9:213:9 | passwdData | testCryptoSwift.swift:213:9:213:9 | passwdData | Insecure hashing algorithm (SHA3) depends on $@. | testCryptoSwift.swift:213:9:213:9 | passwdData | password (passwdData) |
3578
| testCryptoSwift.swift:219:9:219:9 | passwd | testCryptoSwift.swift:219:9:219:9 | passwd | testCryptoSwift.swift:219:9:219:9 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:219:9:219:9 | passwd | password (passwd) |
3679
| testCryptoSwift.swift:222:9:222:9 | passwd | testCryptoSwift.swift:222:9:222:9 | passwd | testCryptoSwift.swift:222:9:222:9 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:222:9:222:9 | passwd | password (passwd) |
80+
| testCryptoSwift.swift:225:9:225:9 | passwd | testCryptoSwift.swift:225:9:225:9 | passwd | testCryptoSwift.swift:225:9:225:9 | passwd | Insecure hashing algorithm (SHA512) depends on $@. | testCryptoSwift.swift:225:9:225:9 | passwd | password (passwd) |
81+
| testCryptoSwift.swift:228:9:228:9 | passwd | testCryptoSwift.swift:228:9:228:9 | passwd | testCryptoSwift.swift:228:9:228:9 | passwd | Insecure hashing algorithm (SHA2) depends on $@. | testCryptoSwift.swift:228:9:228:9 | passwd | password (passwd) |
82+
| testCryptoSwift.swift:231:9:231:9 | passwd | testCryptoSwift.swift:231:9:231:9 | passwd | testCryptoSwift.swift:231:9:231:9 | passwd | Insecure hashing algorithm (SHA3) depends on $@. | testCryptoSwift.swift:231:9:231:9 | passwd | password (passwd) |

0 commit comments

Comments
 (0)