Repository navigation
Conversation
Establish a byte-for-byte original Swift baseline for the unified Swift port, including query help and samples. Adaptations follow separately. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Inline the original query configuration and extension declarations unchanged, recording their provenance before adapting them to unified APIs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use models-as-data sources and format-string sinks, update the query ID and test reference, and record the compiling baseline with missing expectations. Formatting sink models, the variadic-call heuristic and numeric barriers remain to be ported. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Translate the standard formatting sinks into models-as-data for String and Foundation formatting APIs and common printf variants. The original cases now produce ten results; omitted variadic arguments, closure-based C string flow and custom formatting heuristics remain missing. All unified security query tests pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add positive and safe comparisons for localized formatting, NSLog and imported C format functions without closure-based conversion. All ten prior results are preserved and eight additional sink locations are covered. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…rence Record the remaining printf models and extraction prerequisite for custom variadic-call heuristics. Use the verified canonical OWASP reference and clarify the predicate-injection negative case. Help XML and samples validate, and all five affected query and model tests pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
geoffw0
added
no-change-note-required
Contributor
|
QHelp previews: unified/ql/src/queries/security/CWE-134/UncontrolledFormatString.qhelpUncontrolled format stringPassing untrusted format strings to functions that use RecommendationUse a constant string literal for the format string to prevent the possibility of data flow from an untrusted source. This also helps to prevent errors where the format arguments do not match the format string. If the format string cannot be constant, ensure that it comes from a secure data source or is compiled into the source code. If you need to include a string value from the user, use an appropriate specifier (such as ExampleIn this example, the format string includes a user-controlled print(String(format: "User input: " + inputString)) // vulnerableTo fix it, make print(String(format: "User input: %@", inputString)) // fixedReferences
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The format-string model misses calls with zero or multiple variadic values and incorrectly flags NSException’s plain-message initializer as a format-string sink.
2 open issues
What changed in this PR
Adds unified/swift/uncontrolled-format-string, a security query that uses Unified’s data-flow libraries to trace untrusted input into printf-style format strings.
Changes:
- Introduces the CWE-134 path query and formatting sink models.
- Adds Swift regression tests, including known detection gaps, and expected flow paths.
- Provides query help with vulnerable and corrected examples.
| File | Description |
|---|---|
unified/ql/test/query-tests/security/CWE-134/UncontrolledFormatString/UncontrolledFormatString.swift |
Tests formatting APIs, safe inputs, and known gaps. |
unified/ql/test/query-tests/security/CWE-134/UncontrolledFormatString/UncontrolledFormatString.qlref |
Connects the query to inline-expectation checks. |
unified/ql/test/query-tests/security/CWE-134/UncontrolledFormatString/UncontrolledFormatString.expected |
Records expected alerts and flow paths. |
unified/ql/src/queries/security/CWE-134/UncontrolledFormatStringGood.swift |
Demonstrates a constant-format fix. |
unified/ql/src/queries/security/CWE-134/UncontrolledFormatStringBad.swift |
Demonstrates a user-controlled format string. |
unified/ql/src/queries/security/CWE-134/UncontrolledFormatString.ql |
Implements the taint-flow query and metadata. |
unified/ql/src/queries/security/CWE-134/UncontrolledFormatString.qhelp |
Explains the risk and remediation. |
unified/ql/lib/ext/format-string.model.yml |
Defines Foundation and C formatting sinks. |
Review effort: Max (auto)
| pack: codeql/unified-all | ||
| extensible: legacySinkModel | ||
| data: # namespace, type, subtypes, name, signature, ext, input, kind, provenance | ||
| - ["", "String", true, "init(_:format:)", "", "", "Argument[format:]", "format-string", "manual"] |
| - ["", "NSMutableString", true, "localizedStringWithFormat(_:_:)", "", "", "Argument[0]", "format-string", "manual"] | ||
| - ["", "NSMutableString", true, "appendFormat(_:_:)", "", "", "Argument[0]", "format-string", "manual"] | ||
| - ["", "StringProtocol", true, "appendingFormat(_:_:)", "", "", "Argument[0]", "format-string", "manual"] | ||
| - ["", "NSException", true, "init(name:reason:userInfo:)", "", "", "Argument[reason:]", "format-string", "manual"] |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
unified/swift/uncontrolled-format-stringquery for unified Swift. Created with the usual Copilot skill + some manual fixup + TODOs to follow-up on later.Does quite well on tests, though there are certainly missing cases.
DCA to follow.DCA LGTM.