Swift: Add new query for XML External Entities (XML) vulnerabilities

[atorralba]

Adds a new query to cover XXE vulnerabilities. Only covers XMLParser sinks for now, follow up PRs will add more sinks in third-party libraries.

Note that the CSV summaries added for the classes Data and InputStream are the bare minimum for the XXE tests to work properly. These classes need proper modeling, which deserve their own PRs.

[github-actions]

QHelp previews:

swift/ql/src/queries/Security/CWE-611/XXE.qhelp

Resolving XML external entity in user-controlled data

Parsing untrusted XML files with a weakly configured XML parser may lead to an XML External Entity (XXE) attack. This type of attack uses external entity references to access arbitrary files on a system, carry out denial-of-service attacks, or server-side request forgery. Even when the result of parsing is not returned to the user, out-of-band data retrieval techniques may allow attackers to steal sensitive data. Denial of services can also be carried out in this situation.

Recommendation

The easiest way to prevent XXE attacks is to disable external entity handling when parsing untrusted data. How this is done depends on the library being used. Note that some libraries, such as recent versions of XMLParser, disable entity expansion by default, so unless you have explicitly enabled entity expansion, no further action needs to be taken.

Example

The following example uses the XMLParser class to parse a string data. If that string is from an untrusted source, this code may be vulnerable to an XXE attack, since the parser is also setting its shouldResolveExternalEntities option to true:

let parser = XMLParser(data: remoteData) // BAD (parser explicitly enables external entities)
parser.shouldResolveExternalEntities = true

To guard against XXE attacks, the shouldResolveExternalEntities option should be left unset or explicitly set to false.

let parser = XMLParser(data: remoteData) // GOOD (parser explicitly disables external entities)
parser.shouldResolveExternalEntities = false

References

• OWASP: XML External Entity (XXE) Processing.
• OWASP: XML External Entity Prevention Cheat Sheet.
• Timothy D. Morgan and Omar Al Ibrahim XML Schema, DTD, and Entity Attacks: A Compendium of Known Techniques.
• Timur Yunusov, Alexey Osipov: XML Out-Of-Band Data Retrieval.
• Common Weakness Enumeration: CWE-611.
• Common Weakness Enumeration: CWE-776.
• Common Weakness Enumeration: CWE-827.

[geoffw0]

I think this might be ready for docs review?

[mchammer01]

I'll review this for Docs 😃

[mchammer01]

@atorralba - this LGTM ✨
A few minor suggestions 🙂

[atorralba]

Hey @mchammer01 thanks for the review! Actually, the QHelp file was copy-pasted from the XXE query of other languages, but still I applied your suggestions. We can always apply those same fixes to the other languages in a follow-up PR 😄

[mchammer01]

Oh sorry @atorralba - I didn't know that 🙈

[mchammer01]

LGTM 💖

[geoffw0]

DCA run looks good to me (aside from some noise that has nothing to do with the new query). 👍