| Jul | AUG | Sep |
| 05 | ||
| 2022 | 2023 | 2024 |
COLLECTED BY
Collection: github.com
To see all available qualifiers, see our documentation.
Sign in /
geoffw0
commented
withUnsafeBytes and some similar closure methods.
Limitations:
●I've used .ArrayContent to access content when we know the Collection is an Array. I've used two models - one with .ArrayContent and one with no content specifier - when the object could be an Array or another type of Collection. I've used no content specifier for pointers (UnsafePointer etc) since we don't have content for any of those (yet). Thus, some level of conflation (e.g. between ptr and ptr[0]) is inevitable at this stage. We should be able to improve accuracy as we implement further types of content flow.
●another limitation is that certain methods and fields used in some of the tests (e.g. .baseAddress) are not yet modelled. There is an in-progress issue for these.
●I'm not sure why taint from array elements isn't always flowing into closures, e.g. in int.swift line 19. It works if the qualifier is a tainted array, but not if it's an array with tainted content as in the test (despite there being models for both cases).
●update: there's a fix in another PR that very likely addresses this.
TODO:
● rebase atop final Swift: add DataFlow::Content for arrays #13741
● add change note
● int.swift line 19)
Sorry, something went wrong.
geoffw0
added
the
Swift
label
github-actions
bot
added
the
documentation
label
Swift: Add tests of with* closure methods.
63c71f0
Swift: Add tests with some different container types.
feadd71
Swift: Remove special case from UnsafeJsEval query.
315cb32
Swift: Model update(repeating:), to support the tests.
49d1556
Swift: Add closure function models.
664dc01
Swift: Fix mistake in the string taint test.
c48d474
Swift: Array.withUnsafeBytes doesn't reliably match ContiguousBytes, …
b41d47b
…so define models there as well.
Swift: Use .ArrayElement in the models, where appropriate.
d24db3f
Swift: Change note.
af8d4e5
geoffw0
force-pushed
the
closuremodels
branch
from
c302748
to
af8d4e5
Compare
geoffw0
marked this pull request as ready for review
geoffw0
requested a review
from a team
as a code owner
Successfully merging this pull request may close these issues.
None yet
1 participant Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.