Skip to content

Commit 87eb96e

Browse files
committed
Swift: Add more cases to test.
1 parent 22ed20d commit 87eb96e

File tree

3 files changed

+119
-29
lines changed

3 files changed

+119
-29
lines changed

swift/ql/test/query-tests/Security/CWE-328/WeakPasswordHashing.expected

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,16 @@ nodes
66
| testCryptoKit.swift:99:23:99:23 | passwd | semmle.label | passwd |
77
| testCryptoKit.swift:132:32:132:32 | passwd | semmle.label | passwd |
88
| testCryptoKit.swift:141:32:141:32 | passwd | semmle.label | passwd |
9-
| testCryptoSwift.swift:113:30:113:30 | passwdArray | semmle.label | passwdArray |
10-
| testCryptoSwift.swift:115:31:115:31 | passwdArray | semmle.label | passwdArray |
11-
| testCryptoSwift.swift:120:20:120:20 | passwdArray | semmle.label | passwdArray |
12-
| testCryptoSwift.swift:122:21:122:21 | passwdArray | semmle.label | passwdArray |
13-
| testCryptoSwift.swift:127:9:127:9 | passwdArray | semmle.label | passwdArray |
14-
| testCryptoSwift.swift:129:9:129:9 | passwdArray | semmle.label | passwdArray |
15-
| testCryptoSwift.swift:136:9:136:9 | passwdData | semmle.label | passwdData |
16-
| testCryptoSwift.swift:138:9:138:9 | passwdData | semmle.label | passwdData |
17-
| testCryptoSwift.swift:145:9:145:9 | passwd | semmle.label | passwd |
18-
| testCryptoSwift.swift:147:9:147:9 | passwd | semmle.label | passwd |
9+
| testCryptoSwift.swift:154:30:154:30 | passwdArray | semmle.label | passwdArray |
10+
| testCryptoSwift.swift:157:31:157:31 | passwdArray | semmle.label | passwdArray |
11+
| testCryptoSwift.swift:167:20:167:20 | passwdArray | semmle.label | passwdArray |
12+
| testCryptoSwift.swift:170:21:170:21 | passwdArray | semmle.label | passwdArray |
13+
| testCryptoSwift.swift:183:9:183:9 | passwdArray | semmle.label | passwdArray |
14+
| testCryptoSwift.swift:186:9:186:9 | passwdArray | semmle.label | passwdArray |
15+
| testCryptoSwift.swift:201:9:201:9 | passwdData | semmle.label | passwdData |
16+
| testCryptoSwift.swift:204:9:204:9 | passwdData | semmle.label | passwdData |
17+
| testCryptoSwift.swift:219:9:219:9 | passwd | semmle.label | passwd |
18+
| testCryptoSwift.swift:222:9:222:9 | passwd | semmle.label | passwd |
1919
subpaths
2020
#select
2121
| testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | testCryptoKit.swift:56:47:56:47 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:56:47:56:47 | passwd | password (passwd) |
@@ -24,13 +24,13 @@ subpaths
2424
| testCryptoKit.swift:99:23:99:23 | passwd | testCryptoKit.swift:99:23:99:23 | passwd | testCryptoKit.swift:99:23:99:23 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:99:23:99:23 | passwd | password (passwd) |
2525
| testCryptoKit.swift:132:32:132:32 | passwd | testCryptoKit.swift:132:32:132:32 | passwd | testCryptoKit.swift:132:32:132:32 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:132:32:132:32 | passwd | password (passwd) |
2626
| testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | testCryptoKit.swift:141:32:141:32 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:141:32:141:32 | passwd | password (passwd) |
27-
| testCryptoSwift.swift:113:30:113:30 | passwdArray | testCryptoSwift.swift:113:30:113:30 | passwdArray | testCryptoSwift.swift:113:30:113:30 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:113:30:113:30 | passwdArray | password (passwdArray) |
28-
| testCryptoSwift.swift:115:31:115:31 | passwdArray | testCryptoSwift.swift:115:31:115:31 | passwdArray | testCryptoSwift.swift:115:31:115:31 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:115:31:115:31 | passwdArray | password (passwdArray) |
29-
| testCryptoSwift.swift:120:20:120:20 | passwdArray | testCryptoSwift.swift:120:20:120:20 | passwdArray | testCryptoSwift.swift:120:20:120:20 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:120:20:120:20 | passwdArray | password (passwdArray) |
30-
| testCryptoSwift.swift:122:21:122:21 | passwdArray | testCryptoSwift.swift:122:21:122:21 | passwdArray | testCryptoSwift.swift:122:21:122:21 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:122:21:122:21 | passwdArray | password (passwdArray) |
31-
| testCryptoSwift.swift:127:9:127:9 | passwdArray | testCryptoSwift.swift:127:9:127:9 | passwdArray | testCryptoSwift.swift:127:9:127:9 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:127:9:127:9 | passwdArray | password (passwdArray) |
32-
| testCryptoSwift.swift:129:9:129:9 | passwdArray | testCryptoSwift.swift:129:9:129:9 | passwdArray | testCryptoSwift.swift:129:9:129:9 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:129:9:129:9 | passwdArray | password (passwdArray) |
33-
| testCryptoSwift.swift:136:9:136:9 | passwdData | testCryptoSwift.swift:136:9:136:9 | passwdData | testCryptoSwift.swift:136:9:136:9 | passwdData | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:136:9:136:9 | passwdData | password (passwdData) |
34-
| testCryptoSwift.swift:138:9:138:9 | passwdData | testCryptoSwift.swift:138:9:138:9 | passwdData | testCryptoSwift.swift:138:9:138:9 | passwdData | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:138:9:138:9 | passwdData | password (passwdData) |
35-
| testCryptoSwift.swift:145:9:145:9 | passwd | testCryptoSwift.swift:145:9:145:9 | passwd | testCryptoSwift.swift:145:9:145:9 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:145:9:145:9 | passwd | password (passwd) |
36-
| testCryptoSwift.swift:147:9:147:9 | passwd | testCryptoSwift.swift:147:9:147:9 | passwd | testCryptoSwift.swift:147:9:147:9 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:147:9:147:9 | passwd | password (passwd) |
27+
| testCryptoSwift.swift:154:30:154:30 | passwdArray | testCryptoSwift.swift:154:30:154:30 | passwdArray | testCryptoSwift.swift:154:30:154:30 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:154:30:154:30 | passwdArray | password (passwdArray) |
28+
| testCryptoSwift.swift:157:31:157:31 | passwdArray | testCryptoSwift.swift:157:31:157:31 | passwdArray | testCryptoSwift.swift:157:31:157:31 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:157:31:157:31 | passwdArray | password (passwdArray) |
29+
| testCryptoSwift.swift:167:20:167:20 | passwdArray | testCryptoSwift.swift:167:20:167:20 | passwdArray | testCryptoSwift.swift:167:20:167:20 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:167:20:167:20 | passwdArray | password (passwdArray) |
30+
| testCryptoSwift.swift:170:21:170:21 | passwdArray | testCryptoSwift.swift:170:21:170:21 | passwdArray | testCryptoSwift.swift:170:21:170:21 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:170:21:170:21 | passwdArray | password (passwdArray) |
31+
| testCryptoSwift.swift:183:9:183:9 | passwdArray | testCryptoSwift.swift:183:9:183:9 | passwdArray | testCryptoSwift.swift:183:9:183:9 | passwdArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:183:9:183:9 | passwdArray | password (passwdArray) |
32+
| testCryptoSwift.swift:186:9:186:9 | passwdArray | testCryptoSwift.swift:186:9:186:9 | passwdArray | testCryptoSwift.swift:186:9:186:9 | passwdArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:186:9:186:9 | passwdArray | password (passwdArray) |
33+
| testCryptoSwift.swift:201:9:201:9 | passwdData | testCryptoSwift.swift:201:9:201:9 | passwdData | testCryptoSwift.swift:201:9:201:9 | passwdData | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:201:9:201:9 | passwdData | password (passwdData) |
34+
| testCryptoSwift.swift:204:9:204:9 | passwdData | testCryptoSwift.swift:204:9:204:9 | passwdData | testCryptoSwift.swift:204:9:204:9 | passwdData | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:204:9:204:9 | passwdData | password (passwdData) |
35+
| testCryptoSwift.swift:219:9:219:9 | passwd | testCryptoSwift.swift:219:9:219:9 | passwd | testCryptoSwift.swift:219:9:219:9 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:219:9:219:9 | passwd | password (passwd) |
36+
| testCryptoSwift.swift:222:9:222:9 | passwd | testCryptoSwift.swift:222:9:222:9 | passwd | testCryptoSwift.swift:222:9:222:9 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:222:9:222:9 | passwd | password (passwd) |

swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ nodes
1919
| testCryptoKit.swift:142:32:142:32 | cert | semmle.label | cert |
2020
| testCryptoKit.swift:144:32:144:32 | account_no | semmle.label | account_no |
2121
| testCryptoKit.swift:145:32:145:32 | credit_card_no | semmle.label | credit_card_no |
22+
| testCryptoSwift.swift:200:9:200:9 | medicalData | semmle.label | medicalData |
23+
| testCryptoSwift.swift:203:9:203:9 | medicalData | semmle.label | medicalData |
24+
| testCryptoSwift.swift:218:9:218:9 | creditCardNumber | semmle.label | creditCardNumber |
25+
| testCryptoSwift.swift:221:9:221:9 | creditCardNumber | semmle.label | creditCardNumber |
2226
subpaths
2327
#select
2428
| testCryptoKit.swift:57:43:57:43 | cert | testCryptoKit.swift:57:43:57:43 | cert | testCryptoKit.swift:57:43:57:43 | cert | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:57:43:57:43 | cert | sensitive data (credential cert) |
@@ -40,3 +44,7 @@ subpaths
4044
| testCryptoKit.swift:142:32:142:32 | cert | testCryptoKit.swift:142:32:142:32 | cert | testCryptoKit.swift:142:32:142:32 | cert | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:142:32:142:32 | cert | sensitive data (credential cert) |
4145
| testCryptoKit.swift:144:32:144:32 | account_no | testCryptoKit.swift:144:32:144:32 | account_no | testCryptoKit.swift:144:32:144:32 | account_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:144:32:144:32 | account_no | sensitive data (private information account_no) |
4246
| testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:145:32:145:32 | credit_card_no | sensitive data (private information credit_card_no) |
47+
| testCryptoSwift.swift:200:9:200:9 | medicalData | testCryptoSwift.swift:200:9:200:9 | medicalData | testCryptoSwift.swift:200:9:200:9 | medicalData | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:200:9:200:9 | medicalData | sensitive data (private information medicalData) |
48+
| testCryptoSwift.swift:203:9:203:9 | medicalData | testCryptoSwift.swift:203:9:203:9 | medicalData | testCryptoSwift.swift:203:9:203:9 | medicalData | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:203:9:203:9 | medicalData | sensitive data (private information medicalData) |
49+
| testCryptoSwift.swift:218:9:218:9 | creditCardNumber | testCryptoSwift.swift:218:9:218:9 | creditCardNumber | testCryptoSwift.swift:218:9:218:9 | creditCardNumber | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:218:9:218:9 | creditCardNumber | sensitive data (private information creditCardNumber) |
50+
| testCryptoSwift.swift:221:9:221:9 | creditCardNumber | testCryptoSwift.swift:221:9:221:9 | creditCardNumber | testCryptoSwift.swift:221:9:221:9 | creditCardNumber | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:221:9:221:9 | creditCardNumber | sensitive data (private information creditCardNumber) |

swift/ql/test/query-tests/Security/CWE-328/testCryptoSwift.swift

Lines changed: 91 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,18 @@ class SHA2 : DigestType {
3434
}
3535
}
3636

37+
class SHA3 : DigestType {
38+
public enum Variant {
39+
case sha512
40+
}
41+
42+
public init(variant: SHA3.Variant) {}
43+
44+
public func calculate(for bytes: Array<UInt8>) -> Array<UInt8> {
45+
return Array<UInt8>()
46+
}
47+
}
48+
3749
struct Digest {
3850
static func md5(_ bytes: Array<UInt8>) -> Array<UInt8> {
3951
return MD5().calculate(for: bytes)
@@ -50,6 +62,10 @@ struct Digest {
5062
static func sha2(_ bytes: Array<UInt8>, variant: SHA2.Variant) -> Array<UInt8> {
5163
return SHA2(variant: variant).calculate(for: bytes)
5264
}
65+
66+
static func sha3(_ bytes: Array<UInt8>, variant: SHA3.Variant) -> Array<UInt8> {
67+
return SHA3(variant: variant).calculate(for: bytes)
68+
}
5369
}
5470

5571
extension Array where Element == UInt8 {
@@ -68,6 +84,14 @@ extension Array where Element == UInt8 {
6884
func sha512() -> [Element] {
6985
return Digest.sha512(self)
7086
}
87+
88+
func sha2(_ variant: SHA2.Variant) -> [Element] {
89+
return Digest.sha2(self, variant: variant)
90+
}
91+
92+
func sha3(_ variant: SHA3.Variant) -> [Element] {
93+
return Digest.sha3(self, variant: variant)
94+
}
7195
}
7296

7397
extension Data {
@@ -86,6 +110,14 @@ extension Data {
86110
func sha512() -> Data {
87111
return Data(Digest.sha512(bytes))
88112
}
113+
114+
func sha2(_ variant: SHA2.Variant) -> Data {
115+
return Data(Digest.sha2(bytes, variant: variant))
116+
}
117+
118+
func sha3(_ variant: SHA3.Variant) -> Data {
119+
return Data(Digest.sha3(bytes, variant: variant))
120+
}
89121
}
90122

91123
extension String {
@@ -104,47 +136,97 @@ extension String {
104136
func sha512() -> String {
105137
return self.bytes.sha512().toHexString()
106138
}
139+
140+
func sha2(_ variant: SHA2.Variant) -> String {
141+
return self.bytes.sha2(variant).toHexString()
142+
}
143+
144+
func sha3(_ variant: SHA3.Variant) -> String {
145+
return self.bytes.sha3(variant).toHexString()
146+
}
107147
}
108148

109149
// --- tests ---
110150

111-
func testArrays(harmlessArray: Array<UInt8>, passwdArray: Array<UInt8>) {
151+
func testArrays(harmlessArray: Array<UInt8>, phoneNumberArray: Array<UInt8>, passwdArray: Array<UInt8>) {
112152
_ = MD5().calculate(for: harmlessArray) // GOOD (not sensitive)
153+
_ = MD5().calculate(for: phoneNumberArray) // BAD [NOT DETECTED]
113154
_ = MD5().calculate(for: passwdArray) // BAD
114155
_ = SHA1().calculate(for: harmlessArray) // GOOD (not sensitive)
156+
_ = SHA1().calculate(for: phoneNumberArray) // BAD [NOT DETECTED]
115157
_ = SHA1().calculate(for: passwdArray) // BAD
116158
_ = SHA2(variant: .sha512).calculate(for: harmlessArray) // GOOD
117-
_ = SHA2(variant: .sha512).calculate(for: passwdArray) // GOOD
159+
_ = SHA2(variant: .sha512).calculate(for: phoneNumberArray) // GOOD
160+
_ = SHA2(variant: .sha512).calculate(for: passwdArray) // BAD [NOT DETECTED]
161+
_ = SHA3(variant: .sha512).calculate(for: harmlessArray) // GOOD
162+
_ = SHA3(variant: .sha512).calculate(for: phoneNumberArray) // GOOD
163+
_ = SHA3(variant: .sha512).calculate(for: passwdArray) // BAD [NOT DETECTED]
118164

119165
_ = Digest.md5(harmlessArray) // GOOD (not sensitive)
166+
_ = Digest.md5(phoneNumberArray) // BAD [NOT DETECTED]
120167
_ = Digest.md5(passwdArray) // BAD
121168
_ = Digest.sha1(harmlessArray) // GOOD (not sensitive)
169+
_ = Digest.sha1(phoneNumberArray) // BAD [NOT DETECTED]
122170
_ = Digest.sha1(passwdArray) // BAD
123-
_ = Digest.sha512(harmlessArray) // GOOD
124-
_ = Digest.sha512(passwdArray) // GOOD
171+
_ = Digest.sha512(harmlessArray) // GOOD (not sensitive)
172+
_ = Digest.sha512(phoneNumberArray) // GOOD
173+
_ = Digest.sha512(passwdArray) // BAD [NOT DETECTED]
174+
_ = Digest.sha2(harmlessArray, variant: .sha512) // GOOD (not sensitive)
175+
_ = Digest.sha2(phoneNumberArray, variant: .sha512) // GOOD
176+
_ = Digest.sha2(passwdArray, variant: .sha512) // BAD [NOT DETECTED]
177+
_ = Digest.sha3(harmlessArray, variant: .sha512) // GOOD (not sensitive)
178+
_ = Digest.sha3(phoneNumberArray, variant: .sha512) // GOOD
179+
_ = Digest.sha3(passwdArray, variant: .sha512) // BAD [NOT DETECTED]
125180

126181
_ = harmlessArray.md5() // GOOD (not sensitive)
182+
_ = phoneNumberArray.md5() // BAD [NOT DETECTED]
127183
_ = passwdArray.md5() // BAD
128184
_ = harmlessArray.sha1() // GOOD (not sensitive)
185+
_ = phoneNumberArray.sha1() // BAD [NOT DETECTED]
129186
_ = passwdArray.sha1() // BAD
130187
_ = harmlessArray.sha512() // GOOD
131-
_ = passwdArray.sha512() // GOOD
188+
_ = phoneNumberArray.sha512() // GOOD
189+
_ = passwdArray.sha512() // BAD [NOT DETECTED]
190+
_ = harmlessArray.sha2(.sha512) // GOOD
191+
_ = phoneNumberArray.sha2(.sha512) // GOOD
192+
_ = passwdArray.sha2(.sha512) // BAD [NOT DETECTED]
193+
_ = harmlessArray.sha3(.sha512) // GOOD
194+
_ = phoneNumberArray.sha3(.sha512) // GOOD
195+
_ = passwdArray.sha3(.sha512) // BAD [NOT DETECTED]
132196
}
133197

134-
func testData(harmlessData: Data, passwdData: Data) {
198+
func testData(harmlessData: Data, medicalData: Data, passwdData: Data) {
135199
_ = harmlessData.md5() // GOOD (not sensitive)
200+
_ = medicalData.md5() // BAD
136201
_ = passwdData.md5() // BAD
137202
_ = harmlessData.sha1() // GOOD (not sensitive)
203+
_ = medicalData.sha1() // BAD
138204
_ = passwdData.sha1() // BAD
139205
_ = harmlessData.sha512() // GOOD
140-
_ = passwdData.sha512() // GOOD
206+
_ = medicalData.sha512() // GOOD
207+
_ = passwdData.sha512() // BAD [NOT DETECTED]
208+
_ = harmlessData.sha2(.sha512) // GOOD
209+
_ = medicalData.sha2(.sha512) // GOOD
210+
_ = passwdData.sha2(.sha512) // BAD [NOT DETECTED]
211+
_ = harmlessData.sha3(.sha512) // GOOD
212+
_ = medicalData.sha3(.sha512) // GOOD
213+
_ = passwdData.sha3(.sha512) // BAD [NOT DETECTED]
141214
}
142215

143-
func testStrings(passwd: String) {
216+
func testStrings(creditCardNumber: String, passwd: String) {
144217
_ = "harmless".md5() // GOOD (not sensitive)
218+
_ = creditCardNumber.md5() // BAD
145219
_ = passwd.md5() // BAD
146220
_ = "harmless".sha1() // GOOD (not sensitive)
221+
_ = creditCardNumber.sha1() // BAD
147222
_ = passwd.sha1() // BAD
148223
_ = "harmless".sha512() // GOOD
149-
_ = passwd.sha512() // GOOD
224+
_ = creditCardNumber.sha512() // GOOD
225+
_ = passwd.sha512() // BAD [NOT DETECTED]
226+
_ = "harmless".sha2(.sha512) // GOOD
227+
_ = creditCardNumber.sha2(.sha512) // GOOD
228+
_ = passwd.sha2(.sha512) // BAD [NOT DETECTED]
229+
_ = "harmless".sha3(.sha512) // GOOD
230+
_ = creditCardNumber.sha3(.sha512) // GOOD
231+
_ = passwd.sha3(.sha512) // BAD [NOT DETECTED]
150232
}

0 commit comments

Comments
 (0)