Skip to content

Conversation

@janniclas
Copy link
Member

I added a special summary function to our IFDS Taint analysis which specifically handles Swift's String append methods.
With this extension we are able to find the taint flow from this example if we tag getPassword() as source and db.prepare() as sink.


@main
public struct SQLExecutableTaintTest {
    public static func main() throws {
        
        let db = try Connection() // in-memory database        

        // nameInput and passwordInput represent possible user input 
        // and are assumed to be received from external inputs
        let nameInput = "'Alice'"
        let passwordInput = getPassword() // source 

        let queryStringName = "SELECT * FROM users WHERE name=" + 
                                        nameInput + 
                                        " AND password="

        let queryString = queryStringName + passwordInput

        let stmt = try db.prepare(queryString) // sink
    }

    // this method represents possible user input
    public static func getPassword() -> String {
        return "'test' OR 1=1;" // this is why user input is dangerous
    }
}```

Copy link
Member

@MMory MMory left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@MMory MMory merged commit 900ae45 into development Mar 23, 2023
@MMory MMory deleted the f-taintUpdate branch March 23, 2023 15:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants