Skip to content

Commit 60b27a4

Browse files
geoffw0geoffw0
committed
Swift: Expand and improve models of Set and Sequence.
1 parent 04c90a6 commit 60b27a4

4 files changed

Lines changed: 69 additions & 31 deletions

File tree

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Sequence.qll‎

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,47 @@ private class SequenceSummaries extends SummaryModelCsv {
1414
override predicate row(string row) {
1515
row =
1616
[
17+
";Sequence;true;sorted();;;Argument[-1];ReturnValue;taint",
18+
";Sequence;true;sorted();;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
19+
";Sequence;true;sorted(by:);;;Argument[-1];ReturnValue;taint",
20+
";Sequence;true;sorted(by:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
1721
";Sequence;true;reversed();;;Argument[-1];ReturnValue;taint",
22+
";Sequence;true;reversed();;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
23+
";Sequence;true;shuffled();;;Argument[-1];ReturnValue;taint",
24+
";Sequence;true;shuffled();;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
25+
";Sequence;true;shuffled(using:);;;Argument[-1].CollectionElement;ReturnValue;taint",
26+
";Sequence;true;shuffled(using:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
1827
";Sequence;true;prefix(_:);;;Argument[-1];ReturnValue;taint",
28+
";Sequence;true;prefix(_:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
1929
";Sequence;true;prefix(while:);;;Argument[-1];ReturnValue;taint",
30+
";Sequence;true;prefix(while:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
2031
";Sequence;true;suffix(_:);;;Argument[-1];ReturnValue;taint",
32+
";Sequence;true;suffix(_:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
2133
";Sequence;true;dropFirst(_:);;;Argument[-1];ReturnValue;taint",
34+
";Sequence;true;dropFirst(_:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
2235
";Sequence;true;dropLast(_:);;;Argument[-1];ReturnValue;taint",
36+
";Sequence;true;dropLast(_:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
37+
";Sequence;true;drop(while:);;;Argument[-1];ReturnValue;taint",
38+
";Sequence;true;drop(while:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
2339
";Sequence;true;split(maxSplits:omittingEmptySubsequences:whereSeparator:);;;Argument[-1];ReturnValue;taint",
40+
";Sequence;true;split(maxSplits:omittingEmptySubsequences:whereSeparator:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
2441
";Sequence;true;split(separator:maxSplits:omittingEmptySubsequences:);;;Argument[-1];ReturnValue;taint",
42+
";Sequence;true;split(separator:maxSplits:omittingEmptySubsequences:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
2543
";Sequence;true;joined();;;Argument[-1];ReturnValue;taint",
26-
";Sequence;true;joined(separator:);;;Argument[-1..0];ReturnValue;taint",
27-
";Sequence;true;first(where:);;;Argument[-1];ReturnValue;taint",
44+
";Sequence;true;joined();;;Argument[-1].CollectionElement;ReturnValue;taint",
45+
";Sequence;true;joined();;;Argument[-1].CollectionElement.CollectionElement;ReturnValue.CollectionElement;value",
46+
";Sequence;true;joined(separator:);;;Argument[0..-1];ReturnValue;taint",
47+
";Sequence;true;joined(separator:);;;Argument[-1].CollectionElement;ReturnValue;taint",
48+
";Sequence;true;first(where:);;;Argument[-1].CollectionElement;ReturnValue;value",
2849
";Sequence;true;withContiguousStorageIfAvailable(_:);;;Argument[-1];Argument[0].Parameter[0].CollectionElement;taint",
2950
";Sequence;true;withContiguousStorageIfAvailable(_:);;;Argument[-1].CollectionElement;Argument[0].Parameter[0].CollectionElement;value",
3051
";Sequence;true;withContiguousStorageIfAvailable(_:);;;Argument[0].ReturnValue;ReturnValue.OptionalSome;value",
31-
";Sequence;true;makeIterator();;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value"
52+
";Sequence;true;makeIterator();;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;value",
53+
";Sequence;true;min();;;Argument[-1].CollectionElement;ReturnValue.OptionalSome;taint",
54+
";Sequence;true;min(by:);;;Argument[-1].CollectionElement;ReturnValue.OptionalSome;taint",
55+
";Sequence;true;max();;;Argument[-1].CollectionElement;ReturnValue.OptionalSome;taint",
56+
";Sequence;true;max(by:);;;Argument[-1].CollectionElement;ReturnValue.OptionalSome;taint",
57+
";Sequence;true;formatted();;;Argument[-1].CollectionElement;ReturnValue;taint",
3258
]
3359
}
3460
}

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Set.qll‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,22 @@ private class SetSummaries extends SummaryModelCsv {
1111
override predicate row(string row) {
1212
row =
1313
[
14-
";Set;true;insert(_:);;;Argument[-1].CollectionElement;ReturnValue.TupleElement[1];value",
14+
";Set;true;init(_:);;;Argument[0];ReturnValue;taint",
15+
";Set;true;init(_:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
1516
";Set;true;insert(_:);;;Argument[0];Argument[-1].CollectionElement;value",
16-
";Set;true;insert(_:);;;Argument[0];ReturnValue.TupleElement[1];value",
17-
";Set;true;init(_:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value"
17+
";Set;true;insert(_:);;;Argument[0];ReturnValue.TupleElement[1];taint",
18+
";Set;true;update(with:);;;Argument[0];Argument[-1].CollectionElement;value",
19+
";Set;true;update(with:);;;Argument[0];ReturnValue.OptionalSome;taint",
20+
";Set;true;remove(_:);;;Argument[0];ReturnValue.OptionalSome;taint",
21+
";Set;true;removeFirst();;;Argument[-1].CollectionElement;ReturnValue;value",
22+
";Set;true;remove(at:);;;Argument[-1].CollectionElement;ReturnValue;value",
23+
";Set;true;filter(_:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
24+
";Set;true;union(_:);;;Argument[-1..0].CollectionElement;ReturnValue.CollectionElement;value",
25+
";Set;true;formUnion(_:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
26+
";Set;true;symmetricDifference(_:);;;Argument[-1..0].CollectionElement;ReturnValue.CollectionElement;taint",
27+
";Set;true;formSymmetricDifference(_:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;taint",
28+
";Set;true;intersection(_:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
29+
";Set;true;subtracting(_:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
1830
]
1931
}
2032
}

‎swift/ql/test/library-tests/dataflow/taint/libraries/set.swift‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ func testSet(ix: Int) {
2424
let taintedSet = Set([1, 2, source("t1")])
2525
sink(arg: taintedSet) // $ tainted=t1
2626
sink(arg: taintedSet.randomElement()!) // $ tainted=t1
27-
sink(arg: taintedSet.min()!) // $ MISSING: tainted=t1
28-
sink(arg: taintedSet.max()!) // $ MISSING: tainted=t1
27+
sink(arg: taintedSet.min()!) // $ tainted=t1
28+
sink(arg: taintedSet.max()!) // $ tainted=t1
2929
sink(arg: taintedSet.firstIndex(of: source("t2"))!)
3030
sink(arg: taintedSet[taintedSet.firstIndex(of: source("t3"))!]) // $ tainted=t1
3131
sink(arg: taintedSet.first!) // $ tainted=t1
@@ -53,52 +53,52 @@ func testSet(ix: Int) {
5353

5454
var set2 = Set<Int>()
5555
set2.update(with: source("t5"))
56-
sink(arg: set2.randomElement()!) // $ MISSING: tainted=t5
56+
sink(arg: set2.randomElement()!) // $ tainted=t5
5757

5858
var set3 = Set([source("t6")])
5959
sink(arg: set3.randomElement()!) // $ tainted=t6
6060
let (inserted, previous) = set3.insert(source("t7"))
6161
sink(arg: inserted)
62-
sink(arg: previous) // $ tainted=t6 tainted=t7
62+
sink(arg: previous) // $ tainted=t7
6363
let previous2 = set3.update(with: source("t8"))
64-
sink(arg: previous2!) // $ MISSING: tainted=t8
64+
sink(arg: previous2!) // $ tainted=t8
6565
let previous3 = set3.remove(source("t9"))
66-
sink(arg: previous3!) // $ MISSING: tainted=t9
66+
sink(arg: previous3!) // $ tainted=t9
6767
let previous4 = set3.removeFirst()
68-
sink(arg: previous4) // $ MISSING: tainted=t6
68+
sink(arg: previous4) // $ tainted=t6 tainted=t7 tainted=t8
6969
let previous5 = set3.remove(at: set3.firstIndex(of: source("t10"))!)
70-
sink(arg: previous5) // $ MISSING: tainted=t6
70+
sink(arg: previous5) // $ tainted=t6 tainted=t7 tainted=t8
7171

7272
sink(arg: goodSet.union(goodSet).randomElement()!)
73-
sink(arg: goodSet.union(taintedSet).randomElement()!) // $ MISSING: tainted=t1
74-
sink(arg: taintedSet.union(goodSet).randomElement()!) // $ MISSING: tainted=t1
75-
sink(arg: taintedSet.union(taintedSet).randomElement()!) // $ MISSING: tainted=t1
73+
sink(arg: goodSet.union(taintedSet).randomElement()!) // $ tainted=t1
74+
sink(arg: taintedSet.union(goodSet).randomElement()!) // $ tainted=t1
75+
sink(arg: taintedSet.union(taintedSet).randomElement()!) // $ tainted=t1
7676

7777
var set4 = Set<Int>()
7878
set4.formUnion(goodSet)
7979
sink(arg: set4.randomElement()!)
8080
set4.formUnion(taintedSet)
81-
sink(arg: set4.randomElement()!) // $ MISSING: tainted=t1
81+
sink(arg: set4.randomElement()!) // $ tainted=t1
8282
set4.formUnion(goodSet)
83-
sink(arg: set4.randomElement()!) // $ MISSING: tainted=t1
83+
sink(arg: set4.randomElement()!) // $ tainted=t1
8484

8585
sink(arg: goodSet.intersection(goodSet).randomElement()!)
8686
sink(arg: goodSet.intersection(taintedSet).randomElement()!)
87-
sink(arg: taintedSet.intersection(goodSet).randomElement()!)
88-
sink(arg: taintedSet.intersection(taintedSet).randomElement()!) // $ MISSING: tainted=t1
87+
sink(arg: taintedSet.intersection(goodSet).randomElement()!) // $ SPURIOUS: tainted=t1
88+
sink(arg: taintedSet.intersection(taintedSet).randomElement()!) // $ tainted=t1
8989

9090
sink(arg: goodSet.symmetricDifference(goodSet).randomElement()!)
91-
sink(arg: goodSet.symmetricDifference(taintedSet).randomElement()!) // $ MISSING: tainted=t1
92-
sink(arg: taintedSet.symmetricDifference(goodSet).randomElement()!) // $ MISSING: tainted=t1
93-
sink(arg: taintedSet.symmetricDifference(taintedSet).randomElement()!) // $ MISSING: tainted=t1
91+
sink(arg: goodSet.symmetricDifference(taintedSet).randomElement()!) // $ tainted=t1
92+
sink(arg: taintedSet.symmetricDifference(goodSet).randomElement()!) // $ tainted=t1
93+
sink(arg: taintedSet.symmetricDifference(taintedSet).randomElement()!) // $ tainted=t1
9494

9595
sink(arg: goodSet.subtracting(goodSet).randomElement()!)
9696
sink(arg: goodSet.subtracting(taintedSet).randomElement()!)
97-
sink(arg: taintedSet.subtracting(goodSet).randomElement()!) // $ MISSING: tainted=t1
98-
sink(arg: taintedSet.subtracting(taintedSet).randomElement()!) // $ MISSING: tainted=t1
97+
sink(arg: taintedSet.subtracting(goodSet).randomElement()!) // $ tainted=t1
98+
sink(arg: taintedSet.subtracting(taintedSet).randomElement()!) // $ tainted=t1
9999

100-
sink(arg: taintedSet.sorted().randomElement()!) // $ MISSING: tainted=t1
101-
sink(arg: taintedSet.shuffled().randomElement()!) // $ MISSING: tainted=t1
100+
sink(arg: taintedSet.sorted().randomElement()!) // $ tainted=t1
101+
sink(arg: taintedSet.shuffled().randomElement()!) // $ tainted=t1
102102

103103
sink(arg: taintedSet.lazy[taintedSet.firstIndex(of: source("t11"))!]) // $ tainted=t1
104104

‎swift/ql/test/library-tests/dataflow/taint/libraries/string.swift‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -267,9 +267,9 @@ func taintThroughSimpleStringOperations() {
267267
}))
268268

269269
sink(arg: [clean, clean].joined())
270-
sink(arg: [tainted, clean].joined()) // $ MISSING: tainted=217
271-
sink(arg: [clean, tainted].joined()) // $ MISSING: tainted=217
272-
sink(arg: [tainted, tainted].joined()) // $ MISSING: tainted=217
270+
sink(arg: [tainted, clean].joined()) // $ tainted=217
271+
sink(arg: [clean, tainted].joined()) // $ tainted=217
272+
sink(arg: [tainted, tainted].joined()) // $ tainted=217
273273

274274
sink(arg: clean.description)
275275
sink(arg: tainted.description) // $ tainted=217

0 commit comments

Comments
 (0)