Skip to content

Commit c2d49c0

Browse files
geoffw0geoffw0
committed
Swift: Address a weakness in the sensitive data regexs.
1 parent 87eb96e commit c2d49c0

File tree

3 files changed

+20
-7
lines changed

3 files changed

+20
-7
lines changed

‎swift/ql/lib/codeql/swift/security/SensitiveExprs.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,8 @@ class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
7272
// Contact information, such as home addresses
7373
"post.?code|zip.?code|home.?addr|" +
7474
// and telephone numbers
75-
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax).?(num|no|phone)|" + "emergency.?contact|" +
75+
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax|phone).?(num|no)|telephone|" +
76+
"emergency.?contact|" +
7677
// Geographic location - where the user is (or was)
7778
"l(atitude|ongitude)|nationality|" +
7879
// Financial data - such as credit card numbers, salary, bank accounts, and debts

‎swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,12 @@ nodes
1919
| testCryptoKit.swift:142:32:142:32 | cert | semmle.label | cert |
2020
| testCryptoKit.swift:144:32:144:32 | account_no | semmle.label | account_no |
2121
| testCryptoKit.swift:145:32:145:32 | credit_card_no | semmle.label | credit_card_no |
22+
| testCryptoSwift.swift:153:30:153:30 | phoneNumberArray | semmle.label | phoneNumberArray |
23+
| testCryptoSwift.swift:156:31:156:31 | phoneNumberArray | semmle.label | phoneNumberArray |
24+
| testCryptoSwift.swift:166:20:166:20 | phoneNumberArray | semmle.label | phoneNumberArray |
25+
| testCryptoSwift.swift:169:21:169:21 | phoneNumberArray | semmle.label | phoneNumberArray |
26+
| testCryptoSwift.swift:182:9:182:9 | phoneNumberArray | semmle.label | phoneNumberArray |
27+
| testCryptoSwift.swift:185:9:185:9 | phoneNumberArray | semmle.label | phoneNumberArray |
2228
| testCryptoSwift.swift:200:9:200:9 | medicalData | semmle.label | medicalData |
2329
| testCryptoSwift.swift:203:9:203:9 | medicalData | semmle.label | medicalData |
2430
| testCryptoSwift.swift:218:9:218:9 | creditCardNumber | semmle.label | creditCardNumber |
@@ -44,6 +50,12 @@ subpaths
4450
| testCryptoKit.swift:142:32:142:32 | cert | testCryptoKit.swift:142:32:142:32 | cert | testCryptoKit.swift:142:32:142:32 | cert | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:142:32:142:32 | cert | sensitive data (credential cert) |
4551
| testCryptoKit.swift:144:32:144:32 | account_no | testCryptoKit.swift:144:32:144:32 | account_no | testCryptoKit.swift:144:32:144:32 | account_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:144:32:144:32 | account_no | sensitive data (private information account_no) |
4652
| testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | testCryptoKit.swift:145:32:145:32 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:145:32:145:32 | credit_card_no | sensitive data (private information credit_card_no) |
53+
| testCryptoSwift.swift:153:30:153:30 | phoneNumberArray | testCryptoSwift.swift:153:30:153:30 | phoneNumberArray | testCryptoSwift.swift:153:30:153:30 | phoneNumberArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:153:30:153:30 | phoneNumberArray | sensitive data (private information phoneNumberArray) |
54+
| testCryptoSwift.swift:156:31:156:31 | phoneNumberArray | testCryptoSwift.swift:156:31:156:31 | phoneNumberArray | testCryptoSwift.swift:156:31:156:31 | phoneNumberArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:156:31:156:31 | phoneNumberArray | sensitive data (private information phoneNumberArray) |
55+
| testCryptoSwift.swift:166:20:166:20 | phoneNumberArray | testCryptoSwift.swift:166:20:166:20 | phoneNumberArray | testCryptoSwift.swift:166:20:166:20 | phoneNumberArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:166:20:166:20 | phoneNumberArray | sensitive data (private information phoneNumberArray) |
56+
| testCryptoSwift.swift:169:21:169:21 | phoneNumberArray | testCryptoSwift.swift:169:21:169:21 | phoneNumberArray | testCryptoSwift.swift:169:21:169:21 | phoneNumberArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:169:21:169:21 | phoneNumberArray | sensitive data (private information phoneNumberArray) |
57+
| testCryptoSwift.swift:182:9:182:9 | phoneNumberArray | testCryptoSwift.swift:182:9:182:9 | phoneNumberArray | testCryptoSwift.swift:182:9:182:9 | phoneNumberArray | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:182:9:182:9 | phoneNumberArray | sensitive data (private information phoneNumberArray) |
58+
| testCryptoSwift.swift:185:9:185:9 | phoneNumberArray | testCryptoSwift.swift:185:9:185:9 | phoneNumberArray | testCryptoSwift.swift:185:9:185:9 | phoneNumberArray | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:185:9:185:9 | phoneNumberArray | sensitive data (private information phoneNumberArray) |
4759
| testCryptoSwift.swift:200:9:200:9 | medicalData | testCryptoSwift.swift:200:9:200:9 | medicalData | testCryptoSwift.swift:200:9:200:9 | medicalData | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:200:9:200:9 | medicalData | sensitive data (private information medicalData) |
4860
| testCryptoSwift.swift:203:9:203:9 | medicalData | testCryptoSwift.swift:203:9:203:9 | medicalData | testCryptoSwift.swift:203:9:203:9 | medicalData | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoSwift.swift:203:9:203:9 | medicalData | sensitive data (private information medicalData) |
4961
| testCryptoSwift.swift:218:9:218:9 | creditCardNumber | testCryptoSwift.swift:218:9:218:9 | creditCardNumber | testCryptoSwift.swift:218:9:218:9 | creditCardNumber | Insecure hashing algorithm (MD5) depends on $@. | testCryptoSwift.swift:218:9:218:9 | creditCardNumber | sensitive data (private information creditCardNumber) |

‎swift/ql/test/query-tests/Security/CWE-328/testCryptoSwift.swift‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -150,10 +150,10 @@ extension String {
150150

151151
func testArrays(harmlessArray: Array<UInt8>, phoneNumberArray: Array<UInt8>, passwdArray: Array<UInt8>) {
152152
_ = MD5().calculate(for: harmlessArray) // GOOD (not sensitive)
153-
_ = MD5().calculate(for: phoneNumberArray) // BAD [NOT DETECTED]
153+
_ = MD5().calculate(for: phoneNumberArray) // BAD
154154
_ = MD5().calculate(for: passwdArray) // BAD
155155
_ = SHA1().calculate(for: harmlessArray) // GOOD (not sensitive)
156-
_ = SHA1().calculate(for: phoneNumberArray) // BAD [NOT DETECTED]
156+
_ = SHA1().calculate(for: phoneNumberArray) // BAD
157157
_ = SHA1().calculate(for: passwdArray) // BAD
158158
_ = SHA2(variant: .sha512).calculate(for: harmlessArray) // GOOD
159159
_ = SHA2(variant: .sha512).calculate(for: phoneNumberArray) // GOOD
@@ -163,10 +163,10 @@ func testArrays(harmlessArray: Array<UInt8>, phoneNumberArray: Array<UInt8>, pas
163163
_ = SHA3(variant: .sha512).calculate(for: passwdArray) // BAD [NOT DETECTED]
164164

165165
_ = Digest.md5(harmlessArray) // GOOD (not sensitive)
166-
_ = Digest.md5(phoneNumberArray) // BAD [NOT DETECTED]
166+
_ = Digest.md5(phoneNumberArray) // BAD
167167
_ = Digest.md5(passwdArray) // BAD
168168
_ = Digest.sha1(harmlessArray) // GOOD (not sensitive)
169-
_ = Digest.sha1(phoneNumberArray) // BAD [NOT DETECTED]
169+
_ = Digest.sha1(phoneNumberArray) // BAD
170170
_ = Digest.sha1(passwdArray) // BAD
171171
_ = Digest.sha512(harmlessArray) // GOOD (not sensitive)
172172
_ = Digest.sha512(phoneNumberArray) // GOOD
@@ -179,10 +179,10 @@ func testArrays(harmlessArray: Array<UInt8>, phoneNumberArray: Array<UInt8>, pas
179179
_ = Digest.sha3(passwdArray, variant: .sha512) // BAD [NOT DETECTED]
180180

181181
_ = harmlessArray.md5() // GOOD (not sensitive)
182-
_ = phoneNumberArray.md5() // BAD [NOT DETECTED]
182+
_ = phoneNumberArray.md5() // BAD
183183
_ = passwdArray.md5() // BAD
184184
_ = harmlessArray.sha1() // GOOD (not sensitive)
185-
_ = phoneNumberArray.sha1() // BAD [NOT DETECTED]
185+
_ = phoneNumberArray.sha1() // BAD
186186
_ = passwdArray.sha1() // BAD
187187
_ = harmlessArray.sha512() // GOOD
188188
_ = phoneNumberArray.sha512() // GOOD

0 commit comments

Comments
 (0)