Skip to content

Commit b7b57b2

Browse files
geoffw0geoffw0
committed
unified: Add a couple more test cases.
1 parent c38ed2a commit b7b57b2

2 files changed

Lines changed: 48 additions & 42 deletions

File tree

‎unified/ql/test/query-tests/security/CWE-089/SqlInjection/SQLite.swift‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@ func test_sqlite_swift_api(db: Connection) throws {
8989
let stmt3 = try db.prepare(varQuery, remoteString) // GOOD
9090
try stmt3.run()
9191

92+
let stmt3b = try db.prepare(varQuery, remoteString, remoteString) // GOOD
93+
try stmt3b.run()
94+
9295
let stmt4 = try Statement(db, localString) // GOOD
9396
try stmt4.run()
9497

@@ -100,6 +103,9 @@ func test_sqlite_swift_api(db: Connection) throws {
100103
let stmt6 = try db.prepare(unsafeQuery1, "") // $ Alert
101104
try stmt6.run()
102105

106+
let stmt6b = try db.prepare(unsafeQuery1, "", "") // $ MISSING: Alert
107+
try stmt6b.run()
108+
103109
let stmt7 = try db.prepare(unsafeQuery1, [""]) // $ Alert
104110
try stmt7.run()
105111

‎unified/ql/test/query-tests/security/CWE-089/SqlInjection/SqlInjection.expected‎

Lines changed: 42 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -86,21 +86,21 @@
8686
| SQLite.swift:74:17:74:28 | unsafeQuery2 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:74:17:74:28 | unsafeQuery2 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
8787
| SQLite.swift:75:17:75:28 | unsafeQuery3 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:75:17:75:28 | unsafeQuery3 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
8888
| SQLite.swift:83:29:83:40 | unsafeQuery3 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:83:29:83:40 | unsafeQuery3 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
89-
| SQLite.swift:95:32:95:43 | remoteString | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:95:32:95:43 | remoteString | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
90-
| SQLite.swift:100:29:100:40 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:100:29:100:40 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
89+
| SQLite.swift:98:32:98:43 | remoteString | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:98:32:98:43 | remoteString | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
9190
| SQLite.swift:103:29:103:40 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:103:29:103:40 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
92-
| SQLite.swift:106:29:106:40 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:106:29:106:40 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
93-
| SQLite.swift:109:13:109:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:109:13:109:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
94-
| SQLite.swift:111:13:111:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:111:13:111:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
95-
| SQLite.swift:113:13:113:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:113:13:113:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
96-
| SQLite.swift:115:16:115:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:115:16:115:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
97-
| SQLite.swift:117:16:117:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:117:16:117:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
98-
| SQLite.swift:119:16:119:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:119:16:119:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
99-
| SQLite.swift:134:20:134:31 | remoteString | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:134:20:134:31 | remoteString | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
100-
| SQLite.swift:136:13:136:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:136:13:136:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
101-
| SQLite.swift:138:13:138:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:138:13:138:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
102-
| SQLite.swift:140:16:140:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:140:16:140:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
103-
| SQLite.swift:142:16:142:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:142:16:142:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
91+
| SQLite.swift:109:29:109:40 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:109:29:109:40 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
92+
| SQLite.swift:112:29:112:40 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:112:29:112:40 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
93+
| SQLite.swift:115:13:115:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:115:13:115:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
94+
| SQLite.swift:117:13:117:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:117:13:117:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
95+
| SQLite.swift:119:13:119:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:119:13:119:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
96+
| SQLite.swift:121:16:121:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:121:16:121:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
97+
| SQLite.swift:123:16:123:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:123:16:123:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
98+
| SQLite.swift:125:16:125:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:125:16:125:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
99+
| SQLite.swift:140:20:140:31 | remoteString | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:140:20:140:31 | remoteString | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
100+
| SQLite.swift:142:13:142:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:142:13:142:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
101+
| SQLite.swift:144:13:144:24 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:144:13:144:24 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
102+
| SQLite.swift:146:16:146:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:146:16:146:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
103+
| SQLite.swift:148:16:148:27 | unsafeQuery1 | SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:148:16:148:27 | unsafeQuery1 | This query depends on a $@. | SQLite.swift:62:25:62:79 | String(...) | user-provided value |
104104
| other.swift:55:22:55:33 | remoteString | other.swift:51:25:51:79 | String(...) | other.swift:55:22:55:33 | remoteString | This query depends on a $@. | other.swift:51:25:51:79 | String(...) | user-provided value |
105105
| other.swift:57:14:57:25 | remoteString | other.swift:51:25:51:79 | String(...) | other.swift:57:14:57:25 | remoteString | This query depends on a $@. | other.swift:51:25:51:79 | String(...) | user-provided value |
106106
| other.swift:58:14:58:25 | remoteString | other.swift:51:25:51:79 | String(...) | other.swift:58:14:58:25 | remoteString | This query depends on a $@. | other.swift:51:25:51:79 | String(...) | user-provided value |
@@ -224,23 +224,23 @@ edges
224224
| SQLite.swift:62:6:62:17 | remoteString | SQLite.swift:65:21:65:32 | remoteString | provenance | |
225225
| SQLite.swift:62:6:62:17 | remoteString | SQLite.swift:66:62:66:73 | remoteString | provenance | |
226226
| SQLite.swift:62:6:62:17 | remoteString | SQLite.swift:67:60:67:71 | remoteString | provenance | |
227-
| SQLite.swift:62:6:62:17 | remoteString | SQLite.swift:95:32:95:43 | remoteString | provenance | |
228-
| SQLite.swift:62:6:62:17 | remoteString | SQLite.swift:134:20:134:31 | remoteString | provenance | |
227+
| SQLite.swift:62:6:62:17 | remoteString | SQLite.swift:98:32:98:43 | remoteString | provenance | |
228+
| SQLite.swift:62:6:62:17 | remoteString | SQLite.swift:140:20:140:31 | remoteString | provenance | |
229229
| SQLite.swift:62:25:62:79 | String(...) | SQLite.swift:62:6:62:17 | remoteString | provenance | |
230230
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:73:17:73:28 | unsafeQuery1 | provenance | |
231-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:100:29:100:40 | unsafeQuery1 | provenance | |
232231
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:103:29:103:40 | unsafeQuery1 | provenance | |
233-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:106:29:106:40 | unsafeQuery1 | provenance | |
234-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:109:13:109:24 | unsafeQuery1 | provenance | |
235-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:111:13:111:24 | unsafeQuery1 | provenance | |
236-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:113:13:113:24 | unsafeQuery1 | provenance | |
237-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:115:16:115:27 | unsafeQuery1 | provenance | |
238-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:117:16:117:27 | unsafeQuery1 | provenance | |
239-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:119:16:119:27 | unsafeQuery1 | provenance | |
240-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:136:13:136:24 | unsafeQuery1 | provenance | |
241-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:138:13:138:24 | unsafeQuery1 | provenance | |
242-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:140:16:140:27 | unsafeQuery1 | provenance | |
243-
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:142:16:142:27 | unsafeQuery1 | provenance | |
232+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:109:29:109:40 | unsafeQuery1 | provenance | |
233+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:112:29:112:40 | unsafeQuery1 | provenance | |
234+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:115:13:115:24 | unsafeQuery1 | provenance | |
235+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:117:13:117:24 | unsafeQuery1 | provenance | |
236+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:119:13:119:24 | unsafeQuery1 | provenance | |
237+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:121:16:121:27 | unsafeQuery1 | provenance | |
238+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:123:16:123:27 | unsafeQuery1 | provenance | |
239+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:125:16:125:27 | unsafeQuery1 | provenance | |
240+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:142:13:142:24 | unsafeQuery1 | provenance | |
241+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:144:13:144:24 | unsafeQuery1 | provenance | |
242+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:146:16:146:27 | unsafeQuery1 | provenance | |
243+
| SQLite.swift:65:6:65:17 | unsafeQuery1 | SQLite.swift:148:16:148:27 | unsafeQuery1 | provenance | |
244244
| SQLite.swift:65:21:65:32 | remoteString | SQLite.swift:65:6:65:17 | unsafeQuery1 | provenance | |
245245
| SQLite.swift:66:6:66:17 | unsafeQuery2 | SQLite.swift:74:17:74:28 | unsafeQuery2 | provenance | |
246246
| SQLite.swift:66:62:66:73 | remoteString | SQLite.swift:66:6:66:17 | unsafeQuery2 | provenance | |
@@ -406,21 +406,21 @@ nodes
406406
| SQLite.swift:74:17:74:28 | unsafeQuery2 | semmle.label | unsafeQuery2 |
407407
| SQLite.swift:75:17:75:28 | unsafeQuery3 | semmle.label | unsafeQuery3 |
408408
| SQLite.swift:83:29:83:40 | unsafeQuery3 | semmle.label | unsafeQuery3 |
409-
| SQLite.swift:95:32:95:43 | remoteString | semmle.label | remoteString |
410-
| SQLite.swift:100:29:100:40 | unsafeQuery1 | semmle.label | unsafeQuery1 |
409+
| SQLite.swift:98:32:98:43 | remoteString | semmle.label | remoteString |
411410
| SQLite.swift:103:29:103:40 | unsafeQuery1 | semmle.label | unsafeQuery1 |
412-
| SQLite.swift:106:29:106:40 | unsafeQuery1 | semmle.label | unsafeQuery1 |
413-
| SQLite.swift:109:13:109:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
414-
| SQLite.swift:111:13:111:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
415-
| SQLite.swift:113:13:113:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
416-
| SQLite.swift:115:16:115:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
417-
| SQLite.swift:117:16:117:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
418-
| SQLite.swift:119:16:119:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
419-
| SQLite.swift:134:20:134:31 | remoteString | semmle.label | remoteString |
420-
| SQLite.swift:136:13:136:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
421-
| SQLite.swift:138:13:138:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
422-
| SQLite.swift:140:16:140:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
423-
| SQLite.swift:142:16:142:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
411+
| SQLite.swift:109:29:109:40 | unsafeQuery1 | semmle.label | unsafeQuery1 |
412+
| SQLite.swift:112:29:112:40 | unsafeQuery1 | semmle.label | unsafeQuery1 |
413+
| SQLite.swift:115:13:115:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
414+
| SQLite.swift:117:13:117:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
415+
| SQLite.swift:119:13:119:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
416+
| SQLite.swift:121:16:121:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
417+
| SQLite.swift:123:16:123:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
418+
| SQLite.swift:125:16:125:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
419+
| SQLite.swift:140:20:140:31 | remoteString | semmle.label | remoteString |
420+
| SQLite.swift:142:13:142:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
421+
| SQLite.swift:144:13:144:24 | unsafeQuery1 | semmle.label | unsafeQuery1 |
422+
| SQLite.swift:146:16:146:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
423+
| SQLite.swift:148:16:148:27 | unsafeQuery1 | semmle.label | unsafeQuery1 |
424424
| other.swift:51:6:51:17 | remoteString | semmle.label | remoteString |
425425
| other.swift:51:25:51:79 | String(...) | semmle.label | String(...) |
426426
| other.swift:55:22:55:33 | remoteString | semmle.label | remoteString |

0 commit comments

Comments
 (0)