[geoffw0]

Adds a unified/swift/command-line-injection query for unified Swift. I got Copilot to do this step-by-step, first copying files from the original Swift implementation, then updating the structure, porting the QL itself, and finally fixing a couple of issues. The original tests are preserved and test annotations updated so we can see where we stand. Tiny bit of manual fixup afterwards.

I'll share a skill to do all this when it's sufficiently mature / proven.

The query only finds a couple of the test cases right now. I'm pretty sure we're missing some relevant summary models, and there might be other issues e.g. with data flow. But it's time to share what I have and open it up to discussion.

DCA run LGTM - no issues, no results found, hardly surprising with such limited success on tests. Lots of work needed on data flow and probably some follow-up work on summary models.

[github-actions]

QHelp previews:

unified/ql/src/queries/security/CWE-078/CommandInjection.qhelp

System command built from user-controlled sources

Constructing a system command with unsanitized user input is dangerous, since a malicious user may be able to craft input that executes arbitrary code.

Recommendation

If possible, use hard-coded string literals to specify the command to run. Instead of interpreting user input directly as command names, examine the input and then choose among hard-coded string literals.

If this is not possible, then add sanitization code to verify that the user input is safe before using it.

Example

The following example executes code from user input without sanitizing it first:

var task = Process()
task.launchPath = "/bin/bash"
task.arguments = ["-c", userControlledString] // BAD

task.launch()

If user input is used to construct a command it should be checked first. This ensures that the user cannot insert characters that have special meanings:

func validateCommand(_ command: String) -> String? {
    let allowedCommands = ["ls -l", "pwd", "echo"]
    if allowedCommands.contains(command) {
        return command
    }
    return nil
}

if let validatedString = validateCommand(userControlledString) {
    var task = Process()
    task.launchPath = "/bin/bash"
    task.arguments = ["-c", validatedString] // GOOD

    task.launch()
}

References

• OWASP: Command Injection.
• Common Weakness Enumeration: CWE-78.
• Common Weakness Enumeration: CWE-88.

[Copilot]

🟡 Changes recommended

Source selection and sink matching can produce command-injection alerts for trusted data or unrelated APIs.

2 open issues

• Constrain run sink matching to the modeled receiver type · New
• Restrict wildcard sources to local and remote kinds · New

What changed in this PR

Adds an initial command-injection query to Unified’s Swift security analysis, with ported tests documenting current detection gaps.

Changes:

• Add a taint-tracking path query using legacy Swift models.
• Port query help, safe and unsafe examples, and annotated regression tests.
• Model Process.run calls that omit the termination handler.

File	Description
unified/​ql/​test/​query-tests/​security/​CWE-078/​CommandInjection/​CommandInjection.swift	Ports Swift test cases and marks known detection gaps.
unified/​ql/​test/​query-tests/​security/​CWE-078/​CommandInjection/​CommandInjection.qlref	Runs the query with inline-expectation checking.
unified/​ql/​test/​query-tests/​security/​CWE-078/​CommandInjection/​CommandInjection.expected	Records current alerts and taint paths.
unified/​ql/​src/​queries/​security/​CWE-078/​CommandInjectionGood.swift	Demonstrates command allowlisting.
unified/​ql/​src/​queries/​security/​CWE-078/​CommandInjectionBad.swift	Demonstrates unsafe shell-command construction.
unified/​ql/​src/​queries/​security/​CWE-078/​CommandInjection.ql	Defines the command-injection query and metadata.
unified/​ql/​src/​queries/​security/​CWE-078/​CommandInjection.qhelp	Documents the risk, recommendations, and examples.
unified/​ql/​lib/​ext/​legacy-swift.model.yml	Adds the shortened Process.run signature.

_{Review effort: Max}

[asgerf]

I've opened #22898 to fix the buggy 'Check query IDs' CI check

[geoffw0]

Docs team, this is a direct port of a query from our original Swift to unified Swift language (technically different at the CodeQL level, but the same target language as far as users are concerned). The .qhelp is copied from Swift and the only change was fixing a dead link (the same one as in #22880 updated).

Do you want to review future PRs like this when they're just copies from Swift to unified Swift? Do you want to review them if they have only very minor doc changes (fixing dead links, typos, changes to the example code)?