Skip to content

Commit cd59b2c

Browse files
d10cd10c
committed
Swift: convert XXE test to .qlref
1 parent e231243 commit cd59b2c

File tree

6 files changed

+110
-49
lines changed

6 files changed

+110
-49
lines changed

‎swift/ql/test/query-tests/Security/CWE-611/XXETest.expected

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#select
2+
| testAEXMLDocumentXXE.swift:51:32:51:32 | remoteString | testAEXMLDocumentXXE.swift:50:24:50:78 | call to String.init(contentsOf:) | testAEXMLDocumentXXE.swift:51:32:51:32 | remoteString | XML parsing depends on a $@ without guarding against external entity expansion. | testAEXMLDocumentXXE.swift:50:24:50:78 | call to String.init(contentsOf:) | user-provided value |
3+
| testAEXMLDocumentXXE.swift:74:32:74:32 | remoteData | testAEXMLDocumentXXE.swift:70:24:70:78 | call to String.init(contentsOf:) | testAEXMLDocumentXXE.swift:74:32:74:32 | remoteData | XML parsing depends on a $@ without guarding against external entity expansion. | testAEXMLDocumentXXE.swift:70:24:70:78 | call to String.init(contentsOf:) | user-provided value |
4+
| testAEXMLDocumentXXE.swift:99:17:99:17 | remoteData | testAEXMLDocumentXXE.swift:97:24:97:78 | call to String.init(contentsOf:) | testAEXMLDocumentXXE.swift:99:17:99:17 | remoteData | XML parsing depends on a $@ without guarding against external entity expansion. | testAEXMLDocumentXXE.swift:97:24:97:78 | call to String.init(contentsOf:) | user-provided value |
5+
| testAEXMLDocumentXXE.swift:128:46:128:46 | remoteData | testAEXMLDocumentXXE.swift:126:24:126:78 | call to String.init(contentsOf:) | testAEXMLDocumentXXE.swift:128:46:128:46 | remoteData | XML parsing depends on a $@ without guarding against external entity expansion. | testAEXMLDocumentXXE.swift:126:24:126:78 | call to String.init(contentsOf:) | user-provided value |
6+
| testXMLDocumentXXE.swift:40:37:40:37 | remoteUrl | testXMLDocumentXXE.swift:38:24:38:78 | call to String.init(contentsOf:) | testXMLDocumentXXE.swift:40:37:40:37 | remoteUrl | XML parsing depends on a $@ without guarding against external entity expansion. | testXMLDocumentXXE.swift:38:24:38:78 | call to String.init(contentsOf:) | user-provided value |
7+
| testXMLDocumentXXE.swift:58:31:58:31 | remoteData | testXMLDocumentXXE.swift:56:24:56:78 | call to String.init(contentsOf:) | testXMLDocumentXXE.swift:58:31:58:31 | remoteData | XML parsing depends on a $@ without guarding against external entity expansion. | testXMLDocumentXXE.swift:56:24:56:78 | call to String.init(contentsOf:) | user-provided value |
8+
| testXMLDocumentXXE.swift:75:36:75:36 | remoteString | testXMLDocumentXXE.swift:74:24:74:78 | call to String.init(contentsOf:) | testXMLDocumentXXE.swift:75:36:75:36 | remoteString | XML parsing depends on a $@ without guarding against external entity expansion. | testXMLDocumentXXE.swift:74:24:74:78 | call to String.init(contentsOf:) | user-provided value |
9+
| testXMLParserXXE.swift:34:34:34:34 | remoteData | testXMLParserXXE.swift:32:24:32:78 | call to String.init(contentsOf:) | testXMLParserXXE.swift:34:34:34:34 | remoteData | XML parsing depends on a $@ without guarding against external entity expansion. | testXMLParserXXE.swift:32:24:32:78 | call to String.init(contentsOf:) | user-provided value |
10+
| testXMLParserXXE.swift:42:36:42:36 | remoteStream | testXMLParserXXE.swift:39:24:39:78 | call to String.init(contentsOf:) | testXMLParserXXE.swift:42:36:42:36 | remoteStream | XML parsing depends on a $@ without guarding against external entity expansion. | testXMLParserXXE.swift:39:24:39:78 | call to String.init(contentsOf:) | user-provided value |
11+
| testXMLParserXXE.swift:49:40:49:40 | remoteUrl | testXMLParserXXE.swift:47:24:47:78 | call to String.init(contentsOf:) | testXMLParserXXE.swift:49:40:49:40 | remoteUrl | XML parsing depends on a $@ without guarding against external entity expansion. | testXMLParserXXE.swift:47:24:47:78 | call to String.init(contentsOf:) | user-provided value |
12+
edges
13+
| testAEXMLDocumentXXE.swift:50:24:50:78 | call to String.init(contentsOf:) | testAEXMLDocumentXXE.swift:51:32:51:32 | remoteString | provenance | |
14+
| testAEXMLDocumentXXE.swift:70:24:70:78 | call to String.init(contentsOf:) | testAEXMLDocumentXXE.swift:71:27:71:27 | remoteString | provenance | |
15+
| testAEXMLDocumentXXE.swift:71:22:71:39 | call to Data.init(_:) | testAEXMLDocumentXXE.swift:74:32:74:32 | remoteData | provenance | |
16+
| testAEXMLDocumentXXE.swift:71:27:71:27 | remoteString | testAEXMLDocumentXXE.swift:71:22:71:39 | call to Data.init(_:) | provenance | |
17+
| testAEXMLDocumentXXE.swift:97:24:97:78 | call to String.init(contentsOf:) | testAEXMLDocumentXXE.swift:98:27:98:27 | remoteString | provenance | |
18+
| testAEXMLDocumentXXE.swift:98:22:98:39 | call to Data.init(_:) | testAEXMLDocumentXXE.swift:99:17:99:17 | remoteData | provenance | |
19+
| testAEXMLDocumentXXE.swift:98:27:98:27 | remoteString | testAEXMLDocumentXXE.swift:98:22:98:39 | call to Data.init(_:) | provenance | |
20+
| testAEXMLDocumentXXE.swift:126:24:126:78 | call to String.init(contentsOf:) | testAEXMLDocumentXXE.swift:127:27:127:27 | remoteString | provenance | |
21+
| testAEXMLDocumentXXE.swift:127:22:127:39 | call to Data.init(_:) | testAEXMLDocumentXXE.swift:128:46:128:46 | remoteData | provenance | |
22+
| testAEXMLDocumentXXE.swift:127:27:127:27 | remoteString | testAEXMLDocumentXXE.swift:127:22:127:39 | call to Data.init(_:) | provenance | |
23+
| testXMLDocumentXXE.swift:38:24:38:78 | call to String.init(contentsOf:) | testXMLDocumentXXE.swift:39:33:39:33 | remoteString | provenance | |
24+
| testXMLDocumentXXE.swift:39:21:39:45 | call to URL.init(string:) [some:0] | testXMLDocumentXXE.swift:39:21:39:46 | ...! | provenance | |
25+
| testXMLDocumentXXE.swift:39:21:39:46 | ...! | testXMLDocumentXXE.swift:40:37:40:37 | remoteUrl | provenance | |
26+
| testXMLDocumentXXE.swift:39:33:39:33 | remoteString | testXMLDocumentXXE.swift:39:21:39:45 | call to URL.init(string:) [some:0] | provenance | |
27+
| testXMLDocumentXXE.swift:56:24:56:78 | call to String.init(contentsOf:) | testXMLDocumentXXE.swift:57:27:57:27 | remoteString | provenance | |
28+
| testXMLDocumentXXE.swift:57:22:57:39 | call to Data.init(_:) | testXMLDocumentXXE.swift:58:31:58:31 | remoteData | provenance | |
29+
| testXMLDocumentXXE.swift:57:27:57:27 | remoteString | testXMLDocumentXXE.swift:57:22:57:39 | call to Data.init(_:) | provenance | |
30+
| testXMLDocumentXXE.swift:74:24:74:78 | call to String.init(contentsOf:) | testXMLDocumentXXE.swift:75:36:75:36 | remoteString | provenance | |
31+
| testXMLParserXXE.swift:32:24:32:78 | call to String.init(contentsOf:) | testXMLParserXXE.swift:33:27:33:27 | remoteString | provenance | |
32+
| testXMLParserXXE.swift:33:22:33:39 | call to Data.init(_:) | testXMLParserXXE.swift:34:34:34:34 | remoteData | provenance | |
33+
| testXMLParserXXE.swift:33:27:33:27 | remoteString | testXMLParserXXE.swift:33:22:33:39 | call to Data.init(_:) | provenance | |
34+
| testXMLParserXXE.swift:39:24:39:78 | call to String.init(contentsOf:) | testXMLParserXXE.swift:40:27:40:27 | remoteString | provenance | |
35+
| testXMLParserXXE.swift:40:22:40:39 | call to Data.init(_:) | testXMLParserXXE.swift:41:42:41:42 | remoteData | provenance | |
36+
| testXMLParserXXE.swift:40:22:40:39 | call to Data.init(_:) | testXMLParserXXE.swift:42:36:42:36 | remoteStream | provenance | AdditionalTaintStep |
37+
| testXMLParserXXE.swift:40:27:40:27 | remoteString | testXMLParserXXE.swift:40:22:40:39 | call to Data.init(_:) | provenance | |
38+
| testXMLParserXXE.swift:41:24:41:52 | call to InputStream.init(data:) | testXMLParserXXE.swift:42:36:42:36 | remoteStream | provenance | |
39+
| testXMLParserXXE.swift:41:42:41:42 | remoteData | testXMLParserXXE.swift:41:24:41:52 | call to InputStream.init(data:) | provenance | |
40+
| testXMLParserXXE.swift:47:24:47:78 | call to String.init(contentsOf:) | testXMLParserXXE.swift:48:33:48:33 | remoteString | provenance | |
41+
| testXMLParserXXE.swift:48:21:48:45 | call to URL.init(string:) [some:0] | testXMLParserXXE.swift:48:21:48:46 | ...! | provenance | |
42+
| testXMLParserXXE.swift:48:21:48:46 | ...! | testXMLParserXXE.swift:49:40:49:40 | remoteUrl | provenance | |
43+
| testXMLParserXXE.swift:48:33:48:33 | remoteString | testXMLParserXXE.swift:48:21:48:45 | call to URL.init(string:) [some:0] | provenance | |
44+
nodes
45+
| testAEXMLDocumentXXE.swift:50:24:50:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
46+
| testAEXMLDocumentXXE.swift:51:32:51:32 | remoteString | semmle.label | remoteString |
47+
| testAEXMLDocumentXXE.swift:70:24:70:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
48+
| testAEXMLDocumentXXE.swift:71:22:71:39 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
49+
| testAEXMLDocumentXXE.swift:71:27:71:27 | remoteString | semmle.label | remoteString |
50+
| testAEXMLDocumentXXE.swift:74:32:74:32 | remoteData | semmle.label | remoteData |
51+
| testAEXMLDocumentXXE.swift:97:24:97:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
52+
| testAEXMLDocumentXXE.swift:98:22:98:39 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
53+
| testAEXMLDocumentXXE.swift:98:27:98:27 | remoteString | semmle.label | remoteString |
54+
| testAEXMLDocumentXXE.swift:99:17:99:17 | remoteData | semmle.label | remoteData |
55+
| testAEXMLDocumentXXE.swift:126:24:126:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
56+
| testAEXMLDocumentXXE.swift:127:22:127:39 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
57+
| testAEXMLDocumentXXE.swift:127:27:127:27 | remoteString | semmle.label | remoteString |
58+
| testAEXMLDocumentXXE.swift:128:46:128:46 | remoteData | semmle.label | remoteData |
59+
| testXMLDocumentXXE.swift:38:24:38:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
60+
| testXMLDocumentXXE.swift:39:21:39:45 | call to URL.init(string:) [some:0] | semmle.label | call to URL.init(string:) [some:0] |
61+
| testXMLDocumentXXE.swift:39:21:39:46 | ...! | semmle.label | ...! |
62+
| testXMLDocumentXXE.swift:39:33:39:33 | remoteString | semmle.label | remoteString |
63+
| testXMLDocumentXXE.swift:40:37:40:37 | remoteUrl | semmle.label | remoteUrl |
64+
| testXMLDocumentXXE.swift:56:24:56:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
65+
| testXMLDocumentXXE.swift:57:22:57:39 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
66+
| testXMLDocumentXXE.swift:57:27:57:27 | remoteString | semmle.label | remoteString |
67+
| testXMLDocumentXXE.swift:58:31:58:31 | remoteData | semmle.label | remoteData |
68+
| testXMLDocumentXXE.swift:74:24:74:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
69+
| testXMLDocumentXXE.swift:75:36:75:36 | remoteString | semmle.label | remoteString |
70+
| testXMLParserXXE.swift:32:24:32:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
71+
| testXMLParserXXE.swift:33:22:33:39 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
72+
| testXMLParserXXE.swift:33:27:33:27 | remoteString | semmle.label | remoteString |
73+
| testXMLParserXXE.swift:34:34:34:34 | remoteData | semmle.label | remoteData |
74+
| testXMLParserXXE.swift:39:24:39:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
75+
| testXMLParserXXE.swift:40:22:40:39 | call to Data.init(_:) | semmle.label | call to Data.init(_:) |
76+
| testXMLParserXXE.swift:40:27:40:27 | remoteString | semmle.label | remoteString |
77+
| testXMLParserXXE.swift:41:24:41:52 | call to InputStream.init(data:) | semmle.label | call to InputStream.init(data:) |
78+
| testXMLParserXXE.swift:41:42:41:42 | remoteData | semmle.label | remoteData |
79+
| testXMLParserXXE.swift:42:36:42:36 | remoteStream | semmle.label | remoteStream |
80+
| testXMLParserXXE.swift:47:24:47:78 | call to String.init(contentsOf:) | semmle.label | call to String.init(contentsOf:) |
81+
| testXMLParserXXE.swift:48:21:48:45 | call to URL.init(string:) [some:0] | semmle.label | call to URL.init(string:) [some:0] |
82+
| testXMLParserXXE.swift:48:21:48:46 | ...! | semmle.label | ...! |
83+
| testXMLParserXXE.swift:48:33:48:33 | remoteString | semmle.label | remoteString |
84+
| testXMLParserXXE.swift:49:40:49:40 | remoteUrl | semmle.label | remoteUrl |
85+
subpaths

‎swift/ql/test/query-tests/Security/CWE-611/XXETest.ql

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎swift/ql/test/query-tests/Security/CWE-611/XXETest.qlref

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
query: queries/Security/CWE-611/XXE.ql
2+
postprocess:
3+
- utils/test/InlineExpectationsTestQuery.ql

‎swift/ql/test/query-tests/Security/CWE-611/testAEXMLDocumentXXE.swift

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@ func testString() {
4747
var options = AEXMLOptions()
4848
options.parserSettings.shouldResolveExternalEntities = true
4949

50-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
51-
let _ = AEXMLDocument(xml: remoteString, encoding: String.Encoding.utf8, options: options) // $ hasXXE=50
50+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
51+
let _ = AEXMLDocument(xml: remoteString, encoding: String.Encoding.utf8, options: options) // $Alert
5252
}
5353

5454
func testStringSafeImplicit() {
@@ -67,11 +67,11 @@ func testStringSafeExplicit() {
6767
}
6868

6969
func testData() {
70-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
70+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
7171
let remoteData = Data(remoteString)
7272
var options = AEXMLOptions()
7373
options.parserSettings.shouldResolveExternalEntities = true
74-
let _ = AEXMLDocument(xml: remoteData, options: options) // $ hasXXE=70
74+
let _ = AEXMLDocument(xml: remoteData, options: options) // $Alert
7575
}
7676

7777
func testDataSafeImplicit() {
@@ -94,9 +94,9 @@ func testDataLoadXml() {
9494
options.parserSettings.shouldResolveExternalEntities = true
9595
let doc = AEXMLDocument(root: nil, options: options)
9696

97-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
97+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
9898
let remoteData = Data(remoteString)
99-
doc.loadXML(remoteData) // $ hasXXE=97
99+
doc.loadXML(remoteData) // $Alert
100100
}
101101

102102
func testDataLoadXmlSafeImplicit() {
@@ -123,9 +123,9 @@ func testParser() {
123123
options.parserSettings.shouldResolveExternalEntities = true
124124
let doc = AEXMLDocument(root: nil, options: options)
125125

126-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
126+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
127127
let remoteData = Data(remoteString)
128-
let _ = AEXMLParser(document: doc, data: remoteData) // $ hasXXE=126
128+
let _ = AEXMLParser(document: doc, data: remoteData) // $Alert
129129
}
130130

131131
func testParserSafeImplicit() {
@@ -145,4 +145,4 @@ func testParserSafeExplicit() {
145145
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
146146
let remoteData = Data(remoteString)
147147
let _ = AEXMLParser(document: doc, data: remoteData) // NO XXE
148-
}
148+
}

‎swift/ql/test/query-tests/Security/CWE-611/testXMLDocumentXXE.swift

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ class XMLDocument {
3535
// --- tests ---
3636

3737
func testUrl() {
38-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
38+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
3939
let remoteUrl = URL(string: remoteString)!
40-
let _ = XMLDocument(contentsOf: remoteUrl, options: [.nodeLoadExternalEntitiesAlways]) // $ hasXXE=38
40+
let _ = XMLDocument(contentsOf: remoteUrl, options: [.nodeLoadExternalEntitiesAlways]) // $Alert
4141
}
4242

4343
func testUrlSafeImplicit() {
@@ -53,9 +53,9 @@ func testUrlSafeExplicit() {
5353
}
5454

5555
func testData() {
56-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
56+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
5757
let remoteData = Data(remoteString)
58-
let _ = XMLDocument(data: remoteData, options: [.nodeLoadExternalEntitiesAlways]) // $ hasXXE=56
58+
let _ = XMLDocument(data: remoteData, options: [.nodeLoadExternalEntitiesAlways]) // $Alert
5959
}
6060

6161
func testDataSafeImplicit() {
@@ -71,8 +71,8 @@ func testDataSafeExplicit() {
7171
}
7272

7373
func testString() {
74-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
75-
let _ = XMLDocument(xmlString: remoteString, options: [.nodeLoadExternalEntitiesAlways]) // $ hasXXE=74
74+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
75+
let _ = XMLDocument(xmlString: remoteString, options: [.nodeLoadExternalEntitiesAlways]) // $Alert
7676
}
7777

7878
func testStringSafeImplicit() {

‎swift/ql/test/query-tests/Security/CWE-611/testXMLParserXXE.swift

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,24 +29,24 @@ class XMLParser {
2929
// --- tests ---
3030

3131
func testData() {
32-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
32+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
3333
let remoteData = Data(remoteString)
34-
let parser = XMLParser(data: remoteData) // $ hasXXE=32
34+
let parser = XMLParser(data: remoteData) // $Alert
3535
parser.shouldResolveExternalEntities = true
3636
}
3737

3838
func testInputStream() {
39-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
39+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
4040
let remoteData = Data(remoteString)
4141
let remoteStream = InputStream(data: remoteData)
42-
let parser = XMLParser(stream: remoteStream) // $ hasXXE=39
42+
let parser = XMLParser(stream: remoteStream) // $Alert
4343
parser.shouldResolveExternalEntities = true
4444
}
4545

4646
func testUrl() {
47-
let remoteString = String(contentsOf: URL(string: "http://example.com/")!)
47+
let remoteString = String(contentsOf: URL(string: "http://example.com/")!) // $Source
4848
let remoteUrl = URL(string: remoteString)!
49-
let parser = XMLParser(contentsOf: remoteUrl) // $ hasXXE=47
49+
let parser = XMLParser(contentsOf: remoteUrl) // $Alert
5050
parser?.shouldResolveExternalEntities = true
5151
}
5252

@@ -89,4 +89,4 @@ func testUrlSafeExplicit() {
8989
let remoteUrl = URL(string: remoteString)!
9090
let parser = XMLParser(contentsOf: remoteUrl) // NO XXE: parser disables external entities
9191
parser?.shouldResolveExternalEntities = false
92-
}
92+
}

0 commit comments

Comments
 (0)