Skip to content

Commit f2fead7

Browse files
geoffw0geoffw0
authored
Merge pull request #9995 from MathiasVP/swift-cfg-for-anytry
Swift: CFG for `any!`
2 parents 7f5fe85 + 5ee11c3 commit f2fead7

File tree

4 files changed

+99
-5
lines changed

4 files changed

+99
-5
lines changed

‎swift/ql/lib/codeql/swift/controlflow/internal/ControlFlowGraphImpl.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1676,8 +1676,8 @@ module Exprs {
16761676
}
16771677
}
16781678

1679-
private class TryTree extends AstStandardPostOrderTree {
1680-
override TryExpr ast;
1679+
private class AnyTryTree extends AstStandardPostOrderTree {
1680+
override AnyTryExpr ast;
16811681

16821682
override ControlFlowElement getChildElement(int i) {
16831683
i = 0 and

‎swift/ql/test/library-tests/controlflow/graph/Cfg.expected‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,7 @@ cfg.swift:
200200
#-----| -> Did not throw.
201201

202202
# 29| call to print(_:separator:terminator:)
203+
#-----| -> mightThrow(x:)
203204

204205
# 29| default separator
205206
#-----| -> default terminator
@@ -219,6 +220,43 @@ cfg.swift:
219220
# 29| [...]
220221
#-----| -> [...]
221222

223+
# 30| try! ...
224+
#-----| -> print(_:separator:terminator:)
225+
226+
# 30| mightThrow(x:)
227+
#-----| -> 0
228+
229+
# 30| call to mightThrow(x:)
230+
#-----| -> try! ...
231+
#-----| exception -> case ...
232+
233+
# 30| 0
234+
#-----| -> call to mightThrow(x:)
235+
236+
# 31| print(_:separator:terminator:)
237+
#-----| -> Still did not throw.
238+
239+
# 31| call to print(_:separator:terminator:)
240+
#-----| -> 0
241+
242+
# 31| default separator
243+
#-----| -> default terminator
244+
245+
# 31| default terminator
246+
#-----| -> call to print(_:separator:terminator:)
247+
248+
# 31| (Any) ...
249+
#-----| -> [...]
250+
251+
# 31| Still did not throw.
252+
#-----| -> (Any) ...
253+
254+
# 31| [...]
255+
#-----| -> default separator
256+
257+
# 31| [...]
258+
#-----| -> [...]
259+
222260
# 33| case ...
223261
#-----| -> ... is ...
224262

@@ -5306,6 +5344,7 @@ cfg.swift:
53065344
#-----| -> Did not throw.
53075345

53085346
# 386| call to print(_:separator:terminator:)
5347+
#-----| -> mightThrow(x:)
53095348

53105349
# 386| default separator
53115350
#-----| -> default terminator
@@ -5325,6 +5364,49 @@ cfg.swift:
53255364
# 386| [...]
53265365
#-----| -> [...]
53275366

5367+
# 387| try! ...
5368+
#-----| -> print(_:separator:terminator:)
5369+
5370+
# 387| mightThrow(x:)
5371+
#-----| -> 0
5372+
5373+
# 387| call to mightThrow(x:)
5374+
#-----| exception -> exit doWithoutCatch(x:) (normal)
5375+
#-----| -> try! ...
5376+
5377+
# 387| 0
5378+
#-----| -> call to mightThrow(x:)
5379+
5380+
# 388| print(_:separator:terminator:)
5381+
#-----| -> Still did not throw.
5382+
5383+
# 388| call to print(_:separator:terminator:)
5384+
#-----| -> 0
5385+
5386+
# 388| default separator
5387+
#-----| -> default terminator
5388+
5389+
# 388| default terminator
5390+
#-----| -> call to print(_:separator:terminator:)
5391+
5392+
# 388| (Any) ...
5393+
#-----| -> [...]
5394+
5395+
# 388| Still did not throw.
5396+
#-----| -> (Any) ...
5397+
5398+
# 388| [...]
5399+
#-----| -> default separator
5400+
5401+
# 388| [...]
5402+
#-----| -> [...]
5403+
5404+
# 390| return ...
5405+
#-----| return -> exit doWithoutCatch(x:) (normal)
5406+
5407+
# 390| 0
5408+
#-----| -> return ...
5409+
53285410
# 394| (unnamed function decl)
53295411

53305412
# 394| enter (unnamed function decl)

‎swift/ql/test/query-tests/Security/CWE-079/UnsafeWebViewFetch.expected‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ edges
55
| UnsafeWebViewFetch.swift:94:10:94:37 | try ... : | UnsafeWebViewFetch.swift:167:25:167:39 | call to getRemoteData() |
66
| UnsafeWebViewFetch.swift:94:10:94:37 | try ... : | UnsafeWebViewFetch.swift:206:17:206:31 | call to getRemoteData() : |
77
| UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:94:10:94:37 | try ... : |
8+
| UnsafeWebViewFetch.swift:103:30:103:84 | call to ... : | UnsafeWebViewFetch.swift:103:25:103:84 | try! ... |
9+
| UnsafeWebViewFetch.swift:105:18:105:72 | call to ... : | UnsafeWebViewFetch.swift:106:25:106:25 | data |
10+
| UnsafeWebViewFetch.swift:109:30:109:53 | call to ... : | UnsafeWebViewFetch.swift:109:25:109:53 | try! ... |
811
| UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() : | UnsafeWebViewFetch.swift:121:25:121:25 | remoteString |
912
| UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() : | UnsafeWebViewFetch.swift:124:25:124:51 | ... call to +(_:_:) ... |
1013
| UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() : | UnsafeWebViewFetch.swift:127:25:127:25 | "..." |
@@ -36,6 +39,12 @@ edges
3639
nodes
3740
| UnsafeWebViewFetch.swift:94:10:94:37 | try ... : | semmle.label | try ... : |
3841
| UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | semmle.label | call to ... : |
42+
| UnsafeWebViewFetch.swift:103:25:103:84 | try! ... | semmle.label | try! ... |
43+
| UnsafeWebViewFetch.swift:103:30:103:84 | call to ... : | semmle.label | call to ... : |
44+
| UnsafeWebViewFetch.swift:105:18:105:72 | call to ... : | semmle.label | call to ... : |
45+
| UnsafeWebViewFetch.swift:106:25:106:25 | data | semmle.label | data |
46+
| UnsafeWebViewFetch.swift:109:25:109:53 | try! ... | semmle.label | try! ... |
47+
| UnsafeWebViewFetch.swift:109:30:109:53 | call to ... : | semmle.label | call to ... : |
3948
| UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() : | semmle.label | call to getRemoteData() : |
4049
| UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | semmle.label | call to getRemoteData() |
4150
| UnsafeWebViewFetch.swift:121:25:121:25 | remoteString | semmle.label | remoteString |
@@ -71,6 +80,9 @@ nodes
7180
| UnsafeWebViewFetch.swift:211:25:211:25 | htmlData | semmle.label | htmlData |
7281
subpaths
7382
#select
83+
| UnsafeWebViewFetch.swift:103:25:103:84 | try! ... | UnsafeWebViewFetch.swift:103:30:103:84 | call to ... : | UnsafeWebViewFetch.swift:103:25:103:84 | try! ... | Tainted data is used in a WebView fetch without restricting the base URL. |
84+
| UnsafeWebViewFetch.swift:106:25:106:25 | data | UnsafeWebViewFetch.swift:105:18:105:72 | call to ... : | UnsafeWebViewFetch.swift:106:25:106:25 | data | Tainted data is used in a WebView fetch without restricting the base URL. |
85+
| UnsafeWebViewFetch.swift:109:25:109:53 | try! ... | UnsafeWebViewFetch.swift:109:30:109:53 | call to ... : | UnsafeWebViewFetch.swift:109:25:109:53 | try! ... | Tainted data is used in a WebView fetch without restricting the base URL. |
7486
| UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | Tainted data is used in a WebView fetch without restricting the base URL. |
7587
| UnsafeWebViewFetch.swift:121:25:121:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:121:25:121:25 | remoteString | Tainted data is used in a WebView fetch without restricting the base URL. |
7688
| UnsafeWebViewFetch.swift:124:25:124:51 | ... call to +(_:_:) ... | UnsafeWebViewFetch.swift:94:14:94:37 | call to ... : | UnsafeWebViewFetch.swift:124:25:124:51 | ... call to +(_:_:) ... | Tainted data is used in a WebView fetch without restricting the base URL. |

‎swift/ql/test/query-tests/Security/CWE-079/UnsafeWebViewFetch.swift‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -100,13 +100,13 @@ func getRemoteData() -> String {
100100
func testSimpleFlows() {
101101
let webview = UIWebView()
102102

103-
webview.loadHTMLString(try! String(contentsOf: URL(string: "http://example.com/")!), baseURL: nil) // BAD [NOT DETECTED]
103+
webview.loadHTMLString(try! String(contentsOf: URL(string: "http://example.com/")!), baseURL: nil) // BAD
104104

105105
let data = try! String(contentsOf: URL(string: "http://example.com/")!)
106-
webview.loadHTMLString(data, baseURL: nil) // BAD [NOT DETECTED]
106+
webview.loadHTMLString(data, baseURL: nil) // BAD
107107

108108
let url = URL(string: "http://example.com/")
109-
webview.loadHTMLString(try! String(contentsOf: url!), baseURL: nil) // BAD [NOT DETECTED]
109+
webview.loadHTMLString(try! String(contentsOf: url!), baseURL: nil) // BAD
110110
}
111111

112112
func testUIWebView() {

0 commit comments

Comments
 (0)