Skip to content

Commit dc863c3

Browse files
geoffw0geoffw0
committed
Swift: Add test cases for an alternative pattern of calls to Insecure.MD5.hash.
1 parent b6155ff commit dc863c3

3 files changed

Lines changed: 13 additions & 5 deletions

File tree

‎swift/ql/test/query-tests/Security/CWE-328/WeakPasswordHashing.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ edges
33
| testCryptoKit.swift:199:38:199:53 | .utf8 | testCryptoKit.swift:199:33:199:57 | call to Data.init(_:) | provenance | |
44
nodes
55
| testCryptoKit.swift:65:47:65:47 | passwd | semmle.label | passwd |
6+
| testCryptoKit.swift:71:36:71:36 | passwd | semmle.label | passwd |
67
| testCryptoKit.swift:77:44:77:44 | passwd | semmle.label | passwd |
78
| testCryptoKit.swift:83:37:83:37 | passwd | semmle.label | passwd |
89
| testCryptoKit.swift:89:37:89:37 | passwd | semmle.label | passwd |
@@ -48,6 +49,7 @@ nodes
4849
subpaths
4950
#select
5051
| testCryptoKit.swift:65:47:65:47 | passwd | testCryptoKit.swift:65:47:65:47 | passwd | testCryptoKit.swift:65:47:65:47 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:65:47:65:47 | passwd | password (passwd) |
52+
| testCryptoKit.swift:71:36:71:36 | passwd | testCryptoKit.swift:71:36:71:36 | passwd | testCryptoKit.swift:71:36:71:36 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:71:36:71:36 | passwd | password (passwd) |
5153
| testCryptoKit.swift:77:44:77:44 | passwd | testCryptoKit.swift:77:44:77:44 | passwd | testCryptoKit.swift:77:44:77:44 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:77:44:77:44 | passwd | password (passwd) |
5254
| testCryptoKit.swift:83:37:83:37 | passwd | testCryptoKit.swift:83:37:83:37 | passwd | testCryptoKit.swift:83:37:83:37 | passwd | Insecure hashing algorithm (SHA256) depends on $@. | testCryptoKit.swift:83:37:83:37 | passwd | password (passwd) |
5355
| testCryptoKit.swift:89:37:89:37 | passwd | testCryptoKit.swift:89:37:89:37 | passwd | testCryptoKit.swift:89:37:89:37 | passwd | Insecure hashing algorithm (SHA384) depends on $@. | testCryptoKit.swift:89:37:89:37 | passwd | password (passwd) |

‎swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ nodes
33
| testCryptoKit.swift:66:43:66:43 | cert | semmle.label | cert |
44
| testCryptoKit.swift:68:43:68:43 | account_no | semmle.label | account_no |
55
| testCryptoKit.swift:69:43:69:43 | credit_card_no | semmle.label | credit_card_no |
6+
| testCryptoKit.swift:72:36:72:36 | cert | semmle.label | cert |
7+
| testCryptoKit.swift:74:36:74:36 | account_no | semmle.label | account_no |
8+
| testCryptoKit.swift:75:36:75:36 | credit_card_no | semmle.label | credit_card_no |
69
| testCryptoKit.swift:78:44:78:44 | cert | semmle.label | cert |
710
| testCryptoKit.swift:80:44:80:44 | account_no | semmle.label | account_no |
811
| testCryptoKit.swift:81:44:81:44 | credit_card_no | semmle.label | credit_card_no |
@@ -33,6 +36,9 @@ subpaths
3336
| testCryptoKit.swift:66:43:66:43 | cert | testCryptoKit.swift:66:43:66:43 | cert | testCryptoKit.swift:66:43:66:43 | cert | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:66:43:66:43 | cert | sensitive data (credential cert) |
3437
| testCryptoKit.swift:68:43:68:43 | account_no | testCryptoKit.swift:68:43:68:43 | account_no | testCryptoKit.swift:68:43:68:43 | account_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:68:43:68:43 | account_no | sensitive data (private information account_no) |
3538
| testCryptoKit.swift:69:43:69:43 | credit_card_no | testCryptoKit.swift:69:43:69:43 | credit_card_no | testCryptoKit.swift:69:43:69:43 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:69:43:69:43 | credit_card_no | sensitive data (private information credit_card_no) |
39+
| testCryptoKit.swift:72:36:72:36 | cert | testCryptoKit.swift:72:36:72:36 | cert | testCryptoKit.swift:72:36:72:36 | cert | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:72:36:72:36 | cert | sensitive data (credential cert) |
40+
| testCryptoKit.swift:74:36:74:36 | account_no | testCryptoKit.swift:74:36:74:36 | account_no | testCryptoKit.swift:74:36:74:36 | account_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:74:36:74:36 | account_no | sensitive data (private information account_no) |
41+
| testCryptoKit.swift:75:36:75:36 | credit_card_no | testCryptoKit.swift:75:36:75:36 | credit_card_no | testCryptoKit.swift:75:36:75:36 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCryptoKit.swift:75:36:75:36 | credit_card_no | sensitive data (private information credit_card_no) |
3642
| testCryptoKit.swift:78:44:78:44 | cert | testCryptoKit.swift:78:44:78:44 | cert | testCryptoKit.swift:78:44:78:44 | cert | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:78:44:78:44 | cert | sensitive data (credential cert) |
3743
| testCryptoKit.swift:80:44:80:44 | account_no | testCryptoKit.swift:80:44:80:44 | account_no | testCryptoKit.swift:80:44:80:44 | account_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:80:44:80:44 | account_no | sensitive data (private information account_no) |
3844
| testCryptoKit.swift:81:44:81:44 | credit_card_no | testCryptoKit.swift:81:44:81:44 | credit_card_no | testCryptoKit.swift:81:44:81:44 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCryptoKit.swift:81:44:81:44 | credit_card_no | sensitive data (private information credit_card_no) |

‎swift/ql/test/query-tests/Security/CWE-328/testCryptoKit.swift‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -68,11 +68,11 @@ func testHashMethods(passwd : UnsafeRawBufferPointer, cert: String, encrypted_pa
6868
hash = Crypto.Insecure.MD5.hash(data: account_no) // BAD
6969
hash = Crypto.Insecure.MD5.hash(data: credit_card_no) // BAD
7070

71-
72-
73-
74-
75-
71+
hash = Insecure.MD5.hash(data: passwd) // BAD
72+
hash = Insecure.MD5.hash(data: cert) // BAD
73+
hash = Insecure.MD5.hash(data: encrypted_passwd) // GOOD (not sensitive)
74+
hash = Insecure.MD5.hash(data: account_no) // BAD
75+
hash = Insecure.MD5.hash(data: credit_card_no) // BAD
7676

7777
hash = Crypto.Insecure.SHA1.hash(data: passwd) // BAD
7878
hash = Crypto.Insecure.SHA1.hash(data: cert) // BAD

0 commit comments

Comments
 (0)