Skip to content

Commit 4854679

Browse files
geoffw0geoffw0
committed
Swift: Clean up isSink (1 - move common variables to an outer exists).
1 parent 39fb714 commit 4854679

File tree

1 file changed

+81
-82
lines changed

1 file changed

+81
-82
lines changed

‎swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql‎

Lines changed: 81 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -41,88 +41,87 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
4141
}
4242

4343
override predicate isSink(DataFlow::Node node, string flowstate) {
44-
// arguments to method calls...
45-
exists(
46-
string className, string methodName, string paramName, ClassDecl c, AbstractFunctionDecl f,
47-
CallExpr call, int arg
48-
|
49-
(
50-
// `NSRange.init`
51-
className = "NSRange" and
52-
methodName = "init(location:length:)" and
53-
paramName = ["location", "length"]
54-
or
55-
// `NSString.character`
56-
className = ["NSString", "NSMutableString"] and
57-
methodName = "character(at:)" and
58-
paramName = "at"
59-
or
60-
// `NSString.character`
61-
className = ["NSString", "NSMutableString"] and
62-
methodName = "substring(from:)" and
63-
paramName = "from"
64-
or
65-
// `NSString.character`
66-
className = ["NSString", "NSMutableString"] and
67-
methodName = "substring(to:)" and
68-
paramName = "to"
69-
or
70-
// `NSMutableString.insert`
71-
className = "NSMutableString" and
72-
methodName = "insert(_:at:)" and
73-
paramName = "at"
74-
) and
75-
c.getName() = className and
76-
c.getAMember() = f and // TODO: will this even work if its defined in a parent class?
77-
call.getFunction().(ApplyExpr).getStaticTarget() = f and
78-
f.getName() = methodName and
79-
f.getParam(pragma[only_bind_into](arg)).getName() = paramName and
80-
call.getArgument(pragma[only_bind_into](arg)).getExpr() = node.asExpr() and
81-
flowstate = "String" // `String` length flowing into `NSString`
82-
)
83-
or
84-
// arguments to function calls...
85-
exists(string funcName, string paramName, CallExpr call, int arg |
86-
// `NSMakeRange`
87-
funcName = "NSMakeRange(_:_:)" and
88-
paramName = ["loc", "len"] and
89-
call.getStaticTarget().getName() = funcName and
90-
call.getStaticTarget().getParam(pragma[only_bind_into](arg)).getName() = paramName and
91-
call.getArgument(pragma[only_bind_into](arg)).getExpr() = node.asExpr() and
92-
flowstate = "String" // `String` length flowing into `NSString`
93-
)
94-
or
95-
// arguments to function calls...
96-
exists(string funcName, string paramName, CallExpr call, int arg |
97-
(
98-
// `String.dropFirst`, `String.dropLast`, `String.removeFirst`, `String.removeLast`
99-
funcName = ["dropFirst(_:)", "dropLast(_:)", "removeFirst(_:)", "removeLast(_:)"] and
100-
paramName = "k"
101-
or
102-
// `String.prefix`, `String.suffix`
103-
funcName = ["prefix(_:)", "suffix(_:)"] and
104-
paramName = "maxLength"
105-
or
106-
// `String.Index.init`
107-
funcName = "init(encodedOffset:)" and
108-
paramName = "offset"
109-
or
110-
// `String.index`
111-
funcName = ["index(_:offsetBy:)", "index(_:offsetBy:limitBy:)"] and
112-
paramName = "n"
113-
or
114-
// `String.formIndex`
115-
funcName = ["formIndex(_:offsetBy:)", "formIndex(_:offsetBy:limitBy:)"] and
116-
paramName = "distance"
117-
) and
118-
call.getFunction().(ApplyExpr).getStaticTarget().getName() = funcName and
119-
call.getFunction()
120-
.(ApplyExpr)
121-
.getStaticTarget()
122-
.getParam(pragma[only_bind_into](arg))
123-
.getName() = paramName and
124-
call.getArgument(pragma[only_bind_into](arg)).getExpr() = node.asExpr() and
125-
flowstate = "NSString" // `NSString` length flowing into `String`
44+
exists(CallExpr call, string paramName, int arg |
45+
// arguments to method calls...
46+
exists(string className, string methodName, ClassDecl c, AbstractFunctionDecl f |
47+
(
48+
// `NSRange.init`
49+
className = "NSRange" and
50+
methodName = "init(location:length:)" and
51+
paramName = ["location", "length"]
52+
or
53+
// `NSString.character`
54+
className = ["NSString", "NSMutableString"] and
55+
methodName = "character(at:)" and
56+
paramName = "at"
57+
or
58+
// `NSString.character`
59+
className = ["NSString", "NSMutableString"] and
60+
methodName = "substring(from:)" and
61+
paramName = "from"
62+
or
63+
// `NSString.character`
64+
className = ["NSString", "NSMutableString"] and
65+
methodName = "substring(to:)" and
66+
paramName = "to"
67+
or
68+
// `NSMutableString.insert`
69+
className = "NSMutableString" and
70+
methodName = "insert(_:at:)" and
71+
paramName = "at"
72+
) and
73+
c.getName() = className and
74+
c.getAMember() = f and // TODO: will this even work if its defined in a parent class?
75+
call.getFunction().(ApplyExpr).getStaticTarget() = f and
76+
f.getName() = methodName and
77+
f.getParam(pragma[only_bind_into](arg)).getName() = paramName and
78+
call.getArgument(pragma[only_bind_into](arg)).getExpr() = node.asExpr() and
79+
flowstate = "String" // `String` length flowing into `NSString`
80+
)
81+
or
82+
// arguments to function calls...
83+
exists(string funcName |
84+
// `NSMakeRange`
85+
funcName = "NSMakeRange(_:_:)" and
86+
paramName = ["loc", "len"] and
87+
call.getStaticTarget().getName() = funcName and
88+
call.getStaticTarget().getParam(pragma[only_bind_into](arg)).getName() = paramName and
89+
call.getArgument(pragma[only_bind_into](arg)).getExpr() = node.asExpr() and
90+
flowstate = "String" // `String` length flowing into `NSString`
91+
)
92+
or
93+
// arguments to function calls...
94+
exists(string funcName |
95+
(
96+
// `String.dropFirst`, `String.dropLast`, `String.removeFirst`, `String.removeLast`
97+
funcName = ["dropFirst(_:)", "dropLast(_:)", "removeFirst(_:)", "removeLast(_:)"] and
98+
paramName = "k"
99+
or
100+
// `String.prefix`, `String.suffix`
101+
funcName = ["prefix(_:)", "suffix(_:)"] and
102+
paramName = "maxLength"
103+
or
104+
// `String.Index.init`
105+
funcName = "init(encodedOffset:)" and
106+
paramName = "offset"
107+
or
108+
// `String.index`
109+
funcName = ["index(_:offsetBy:)", "index(_:offsetBy:limitBy:)"] and
110+
paramName = "n"
111+
or
112+
// `String.formIndex`
113+
funcName = ["formIndex(_:offsetBy:)", "formIndex(_:offsetBy:limitBy:)"] and
114+
paramName = "distance"
115+
) and
116+
call.getFunction().(ApplyExpr).getStaticTarget().getName() = funcName and
117+
call.getFunction()
118+
.(ApplyExpr)
119+
.getStaticTarget()
120+
.getParam(pragma[only_bind_into](arg))
121+
.getName() = paramName and
122+
call.getArgument(pragma[only_bind_into](arg)).getExpr() = node.asExpr() and
123+
flowstate = "NSString" // `NSString` length flowing into `String`
124+
)
126125
)
127126
}
128127

0 commit comments

Comments
 (0)