Skip to content

Swift: Generalize flow through subscript writes / test and fix some closure methods of Data #14680

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Nov 6, 2023

Conversation

geoffw0
Copy link
Contributor

@geoffw0 geoffw0 commented Nov 3, 2023

Add test cases for some Data methods involving closures. It turns out we already had models for these, though an issue with data flow through subscripts was causing some of the flows to be missed. That issue is fixed in this PR.

(I also deleted some duplicate models for withUnsafeBytes)

@geoffw0 geoffw0 added the Swift label Nov 3, 2023
@geoffw0 geoffw0 requested a review from a team as a code owner November 3, 2023 15:05
Copy link
Contributor

@MathiasVP MathiasVP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM once we have a successful DCA run

@geoffw0
Copy link
Contributor Author

geoffw0 commented Nov 6, 2023

Good point, definitely needed for this PR...

@geoffw0
Copy link
Contributor Author

geoffw0 commented Nov 6, 2023

The DCA run shows 1 new result for swift/cleartext-logging, in DVIA-v2. 🎉

  • it looks reasonable to me. They're populating a user object with details including a password field and personal information, then outputting user.description which is likely to contain some or all of that information.
  • DVIA-v2 is a deliberately vulnerable app and this result is in a directory Vulnerabilities / Side Channel Data Leakage, which matches what we're flagging.

Also, no problems with performance etc were highlighted by the DCA run.

@geoffw0 geoffw0 merged commit 3465c34 into github:main Nov 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants