Skip to content

Commit b10abb6

Browse files
owen-mcowen-mc
committed
Add SPURIOUS and MISSING to some comments
1 parent 44e2363 commit b10abb6

14 files changed

Lines changed: 67 additions & 67 deletions

‎swift/ql/test/query-tests/Security/CWE-020/SemiAnchoredRegex.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ func realWorld(input: String) throws {
104104
_ = try Regex(#"^mouse|touch|click|contextmenu|drop|dragover|dragend"#).firstMatch(in: input) // $ Alert[swift/missing-regexp-anchor] // BAD (missing anchor)
105105
_ = try Regex(#"^xxx:|yyy:"#).ignoresCase().firstMatch(in: input) // $ Alert[swift/missing-regexp-anchor] // BAD (missing anchor)
106106
_ = try Regex(#"_xxx|_yyy|_zzz$"#).firstMatch(in: input) // $ Alert[swift/missing-regexp-anchor] // BAD (missing anchor)
107-
_ = try Regex(#"em|%$"#).firstMatch(in: input) // BAD (missing anchor) [NOT DETECTED] - not flagged at the moment due to the anchor not being for letters
107+
_ = try Regex(#"em|%$"#).firstMatch(in: input) // $ MISSING: Alert[swift/missing-regexp-anchor] // BAD (missing anchor) [NOT DETECTED] - not flagged at the moment due to the anchor not being for letters
108108

109109
// the following are MAYBE OK due to apparent complexity; not flagged
110110
_ = try Regex(#"(?:^[#?]?|&)([^=&]+)(?:=([^&]*))?"#).firstMatch(in: input)

‎swift/ql/test/query-tests/Security/CWE-020/UnanchoredUrlRegex.swift‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -104,25 +104,25 @@ func tests(url: String, secure: Bool) throws {
104104
_ = try NSRegularExpression(pattern: "verygood.com/?id=" + #"https?:\/\/good.com\/([0-9]+)"#).matches(in: url, range: urlRange)[0] // OK
105105

106106
_ = try NSRegularExpression(pattern: #"\.com|\.org"#).matches(in: input, range: inputRange) // OK, has no domain name
107-
_ = try NSRegularExpression(pattern: #"example\.com|whatever"#).matches(in: input, range: inputRange) // $ Alert[swift/missing-regexp-anchor] // OK, the other disjunction doesn't match a hostname [FALSE POSITIVE]
107+
_ = try NSRegularExpression(pattern: #"example\.com|whatever"#).matches(in: input, range: inputRange) // $ SPURIOUS: Alert[swift/missing-regexp-anchor] // OK, the other disjunction doesn't match a hostname [FALSE POSITIVE]
108108

109109
// tests for the `isLineAnchoredHostnameRegExp` case
110110

111111
let attackUrl1 = "evil.com/blabla?\ngood.com"
112112
let attackUrl1Range = NSMakeRange(0, attackUrl1.utf16.count)
113113
_ = try NSRegularExpression(pattern: "^good\\.com$").matches(in: attackUrl1, range: attackUrl1Range) // OK
114-
_ = try NSRegularExpression(pattern: "^good\\.com$", options: .anchorsMatchLines).matches(in: attackUrl1, range: attackUrl1Range) // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
114+
_ = try NSRegularExpression(pattern: "^good\\.com$", options: .anchorsMatchLines).matches(in: attackUrl1, range: attackUrl1Range) // $ MISSING: Alert[swift/missing-regexp-anchor] // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
115115
_ = try NSRegularExpression(pattern: "(?i)^good\\.com$").matches(in: attackUrl1, range: attackUrl1Range) // OK
116-
_ = try NSRegularExpression(pattern: "(?i)^good\\.com$", options: .anchorsMatchLines).matches(in: attackUrl1, range: attackUrl1Range) // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
116+
_ = try NSRegularExpression(pattern: "(?i)^good\\.com$", options: .anchorsMatchLines).matches(in: attackUrl1, range: attackUrl1Range) // $ MISSING: Alert[swift/missing-regexp-anchor] // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
117117
_ = try NSRegularExpression(pattern: "^good\\.com$|^another\\.com$").matches(in: attackUrl1, range: attackUrl1Range) // OK
118-
_ = try NSRegularExpression(pattern: "^good\\.com$|^another\\.com$", options: .anchorsMatchLines).matches(in: attackUrl1, range: attackUrl1Range) // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
118+
_ = try NSRegularExpression(pattern: "^good\\.com$|^another\\.com$", options: .anchorsMatchLines).matches(in: attackUrl1, range: attackUrl1Range) // $ MISSING: Alert[swift/missing-regexp-anchor] // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
119119

120120
let attackUrl2 = "evil.com/blabla?\ngood.com/"
121121
let attackUrl2Range = NSMakeRange(0, attackUrl2.utf16.count)
122122
_ = try NSRegularExpression(pattern: "^good\\.com/").matches(in: attackUrl2, range: attackUrl2Range) // OK
123-
_ = try NSRegularExpression(pattern: "^good\\.com/", options: .anchorsMatchLines).matches(in: attackUrl2, range: attackUrl2Range) // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
123+
_ = try NSRegularExpression(pattern: "^good\\.com/", options: .anchorsMatchLines).matches(in: attackUrl2, range: attackUrl2Range) // $ MISSING: Alert[swift/missing-regexp-anchor] // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
124124
_ = try NSRegularExpression(pattern: "(?i)^good\\.com/").matches(in: attackUrl2, range: attackUrl2Range) // OK
125-
_ = try NSRegularExpression(pattern: "(?i)^good\\.com/", options: .anchorsMatchLines).matches(in: attackUrl2, range: attackUrl2Range) // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
125+
_ = try NSRegularExpression(pattern: "(?i)^good\\.com/", options: .anchorsMatchLines).matches(in: attackUrl2, range: attackUrl2Range) // $ MISSING: Alert[swift/missing-regexp-anchor] // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
126126
_ = try NSRegularExpression(pattern: "^good\\.com/|^another\\.com/").matches(in: attackUrl2, range: attackUrl2Range) // OK
127-
_ = try NSRegularExpression(pattern: "^good\\.com/|^another\\.com/", options: .anchorsMatchLines).matches(in: attackUrl2, range: attackUrl2Range) // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
127+
_ = try NSRegularExpression(pattern: "^good\\.com/|^another\\.com/", options: .anchorsMatchLines).matches(in: attackUrl2, range: attackUrl2Range) // $ MISSING: Alert[swift/missing-regexp-anchor] // BAD [NOT DETECTED]: with the .anchorsMatchLines option this matches the attack URL
128128
}

‎swift/ql/test/query-tests/Security/CWE-020/test.swift‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,8 @@ func testHostnames(myUrl: URL) throws {
7373
_ = try Regex(#"^https?://api.example.com/"#).firstMatch(in: tainted) // $ Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname)
7474
_ = try Regex(#"^http[s]?://?sub1\.sub2\.example\.com/f/(.+)"#).firstMatch(in: tainted) // GOOD (it has a capture group after the TLD, so should be ignored)
7575
_ = try Regex(#"^https://[a-z]*.example.com$"#).firstMatch(in: tainted) // $ Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname)
76-
_ = try Regex(#"^(example.dev|example.com)"#).firstMatch(in: tainted) // $ Alert[swift/missing-regexp-anchor] // GOOD (any extended hostname wouldn't be included in the capture group) [FALSE POSITIVE]
77-
_ = try Regex(#"^protos?://(localhost|.+.example.net|.+.example-a.com|.+.example-b.com|.+.example.internal)"#).firstMatch(in: tainted) // $ Alert[swift/incomplete-hostname-regexp] Alert[swift/incomplete-hostname-regexp] Alert[swift/incomplete-hostname-regexp] Alert[swift/missing-regexp-anchor] // BAD (incomplete hostname x3, missing anchor x 1)
76+
_ = try Regex(#"^(example.dev|example.com)"#).firstMatch(in: tainted) // $ SPURIOUS: Alert[swift/missing-regexp-anchor] // GOOD (any extended hostname wouldn't be included in the capture group) [FALSE POSITIVE]
77+
_ = try Regex(#"^protos?://(localhost|.+.example.net|.+.example-a.com|.+.example-b.com|.+.example.internal)"#).firstMatch(in: tainted) // $ Alert[swift/incomplete-hostname-regexp] Alert[swift/missing-regexp-anchor] // BAD (incomplete hostname x3, missing anchor x 1)
7878

7979
_ = try Regex(#"^http://(..|...)\.example\.com/index\.html"#).firstMatch(in: tainted) // GOOD (wildcards are intentional)
8080
_ = try Regex(#"^http://.\.example\.com/index\.html"#).firstMatch(in: tainted) // GOOD (the wildcard is intentional)
@@ -85,7 +85,7 @@ func testHostnames(myUrl: URL) throws {
8585

8686
_ = try Regex(id(id(id(#"test.example.com$"#)))).firstMatch(in: tainted) // $ Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname)
8787

88-
let hostname = #"test.example.com$"# // BAD (incomplete hostname) [NOT DETECTED]
88+
let hostname = #"test.example.com$"# // $ MISSING: Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname) [NOT DETECTED]
8989
_ = try Regex("\(hostname)").firstMatch(in: tainted)
9090

9191
var domain = MyDomain("")
@@ -97,17 +97,17 @@ func testHostnames(myUrl: URL) throws {
9797
}
9898
_ = try convert1(MyDomain(#"test.example.com$"#)).firstMatch(in: tainted) // $ Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname)
9999

100-
let domains = [ MyDomain(#"test.example.com$"#) ] // BAD (incomplete hostname) [NOT DETECTED]
100+
let domains = [ MyDomain(#"test.example.com$"#) ] // $ MISSING: Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname) [NOT DETECTED]
101101
func convert2(_ domain: MyDomain) throws -> Regex<AnyRegexOutput> {
102102
return try Regex(domain.hostname)
103103
}
104104
_ = try domains.map({ try convert2($0).firstMatch(in: tainted) })
105105

106106
let primary = "example.com$"
107-
_ = try Regex("test." + primary).firstMatch(in: tainted) // BAD (incomplete hostname) [NOT DETECTED]
108-
_ = try Regex("test." + "example.com$").firstMatch(in: tainted) // BAD (incomplete hostname) [NOT DETECTED]
109-
_ = try Regex(#"^http://localhost:8000|" + "^https?://.+\.example\.com/"#).firstMatch(in: tainted) // BAD (incomplete hostname) [NOT DETECTED]
110-
_ = try Regex(#"^http://localhost:8000|" + "^https?://.+.example\.com/"#).firstMatch(in: tainted) // BAD (incomplete hostname) [NOT DETECTED]
107+
_ = try Regex("test." + primary).firstMatch(in: tainted) // $ MISSING: Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname) [NOT DETECTED]
108+
_ = try Regex("test." + "example.com$").firstMatch(in: tainted) // $ MISSING: Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname) [NOT DETECTED]
109+
_ = try Regex(#"^http://localhost:8000|" + "^https?://.+\.example\.com/"#).firstMatch(in: tainted) // $ MISSING: Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname) [NOT DETECTED]
110+
_ = try Regex(#"^http://localhost:8000|" + "^https?://.+.example\.com/"#).firstMatch(in: tainted) // $ MISSING: Alert[swift/incomplete-hostname-regexp] // BAD (incomplete hostname) [NOT DETECTED]
111111

112112
let harmless = #"^http://test.example.com"# // GOOD (never used as a regex)
113113
}

‎swift/ql/test/query-tests/Security/CWE-089/other.swift‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,9 @@ func test_heuristic(db: MyDatabase) throws {
5555
db.execute4(remoteString as! Sql) // $ Alert
5656

5757
db.query(sql: remoteString) // $ Alert
58-
db.query(sqlLiteral: remoteString) // BAD [NOT DETECTED]
59-
db.query(sqlStatement: remoteString) // BAD [NOT DETECTED]
60-
db.query(sqliteStatement: remoteString) // BAD [NOT DETECTED]
58+
db.query(sqlLiteral: remoteString) // $ MISSING: Alert // BAD [NOT DETECTED]
59+
db.query(sqlStatement: remoteString) // $ MISSING: Alert // BAD [NOT DETECTED]
60+
db.query(sqliteStatement: remoteString) // $ MISSING: Alert // BAD [NOT DETECTED]
6161

6262
db.doSomething(sqlIndex: Int(remoteString) ?? 0) // GOOD
6363
db.doSomething(sqliteContext: remoteString as! Sql) // GOOD

‎swift/ql/test/query-tests/Security/CWE-134/UncontrolledFormatString.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ func tests() throws {
148148
_ = vasprintf_l(nil, nil, "%s", getVaList([cstr])) // GOOD: format not tainted
149149
})
150150

151-
myFormatMessage(string: tainted, "abc") // BAD [NOT DETECTED]
151+
myFormatMessage(string: tainted, "abc") // $ MISSING: Alert // BAD [NOT DETECTED]
152152
myFormatMessage(string: "%s", tainted) // GOOD: format not tainted
153153

154154
_ = MyString(format: tainted, "abc") // $ Alert

‎swift/ql/test/query-tests/Security/CWE-311/testAlamofire.swift‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -159,25 +159,25 @@ func test1(username: String, password: String, email: String, harmless: String)
159159
let params1 = ["value": email]
160160
let params2 = ["value": harmless]
161161

162-
AF.request("http://example.com/", parameters: params1) // BAD [NOT DETECTED]
162+
AF.request("http://example.com/", parameters: params1) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
163163
AF.request("http://example.com/", parameters: params2) // GOOD (not sensitive)
164-
AF.request("http://example.com/", parameters: params1, encoding: URLEncoding.default) // BAD [NOT DETECTED]
164+
AF.request("http://example.com/", parameters: params1, encoding: URLEncoding.default) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
165165
AF.request("http://example.com/", parameters: params2, encoding: URLEncoding.default) // GOOD (not sensitive)
166-
AF.request("http://example.com/", parameters: params1, encoder: URLEncodedFormParameterEncoder.default) // BAD [NOT DETECTED]
166+
AF.request("http://example.com/", parameters: params1, encoder: URLEncodedFormParameterEncoder.default) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
167167
AF.request("http://example.com/", parameters: params2, encoder: URLEncodedFormParameterEncoder.default) // GOOD (not sensitive)
168-
AF.download("http://example.com/", parameters: params1) // BAD [NOT DETECTED]
168+
AF.download("http://example.com/", parameters: params1) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
169169
AF.download("http://example.com/", parameters: params2) // GOOD (not sensitive)
170170

171171
let params3 = ["values": ["...", email, "..."]]
172172
let params4 = ["values": ["...", harmless, "..."]]
173173

174-
AF.request("http://example.com/", method:.post, parameters: params3) // BAD [NOT DETECTED]
174+
AF.request("http://example.com/", method:.post, parameters: params3) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
175175
AF.request("http://example.com/", method:.post, parameters: params4) // GOOD (not sensitive)
176176

177177
let params5 = MyEncodable(value: email)
178178
let params6 = MyEncodable(value: harmless)
179179

180-
AF.request("http://example.com/", parameters: params5) // BAD [NOT DETECTED]
180+
AF.request("http://example.com/", parameters: params5) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
181181
AF.request("http://example.com/", parameters: params6) // GOOD (not sensitive)
182182

183183
// request headers
@@ -187,32 +187,32 @@ func test1(username: String, password: String, email: String, harmless: String)
187187
let headers1: HTTPHeaders = ["Authorization": username + ":" + password]
188188
let headers2: HTTPHeaders = ["Value": harmless]
189189

190-
AF.request("http://example.com/", headers: headers1) // BAD [NOT DETECTED]
190+
AF.request("http://example.com/", headers: headers1) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
191191
AF.request("http://example.com/", headers: headers2) // GOOD (not sensitive)
192-
AF.streamRequest("http://example.com/", headers: headers1) // BAD [NOT DETECTED]
192+
AF.streamRequest("http://example.com/", headers: headers1) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
193193
AF.streamRequest("http://example.com/", headers: headers2) // GOOD (not sensitive)
194194

195195
let headers3 = HTTPHeaders(["Authorization": username + ":" + password])
196196
let headers4 = HTTPHeaders(["Value": harmless])
197197

198-
AF.request("http://example.com/", headers: headers3) // BAD [NOT DETECTED]
198+
AF.request("http://example.com/", headers: headers3) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
199199
AF.request("http://example.com/", headers: headers4) // GOOD (not sensitive)
200-
AF.download("http://example.com/", headers: headers1) // BAD [NOT DETECTED]
200+
AF.download("http://example.com/", headers: headers1) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
201201
AF.download("http://example.com/", headers: headers2) // GOOD (not sensitive)
202202

203203
var headers5 = HTTPHeaders([:])
204204
var headers6 = HTTPHeaders([:])
205205
headers5.add(name: "Authorization", value: username + ":" + password)
206206
headers6.add(name: "Data", value: harmless)
207207

208-
AF.request("http://example.com/", headers: headers5) // BAD [NOT DETECTED]
208+
AF.request("http://example.com/", headers: headers5) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
209209
AF.request("http://example.com/", headers: headers6) // GOOD (not sensitive)
210210

211211
var headers7 = HTTPHeaders([:])
212212
var headers8 = HTTPHeaders([:])
213213
headers7.update(name: "Authorization", value: username + ":" + password)
214214
headers8.update(name: "Data", value: harmless)
215215

216-
AF.request("http://example.com/", headers: headers7) // BAD [NOT DETECTED]
216+
AF.request("http://example.com/", headers: headers7) // $ MISSING: Alert[swift/cleartext-transmission] // BAD [NOT DETECTED]
217217
AF.request("http://example.com/", headers: headers8) // GOOD (not sensitive)
218218
}

‎swift/ql/test/query-tests/Security/CWE-311/testCoreData.swift‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -124,16 +124,16 @@ class SecureKeyStore {
124124
func test5(obj : NSManagedObject) {
125125
// more variants...
126126

127-
obj.setValue(createSecureKey(), forKey: "myKey") // BAD [NOT DETECTED]
127+
obj.setValue(createSecureKey(), forKey: "myKey") // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
128128
obj.setValue(generateSecretKey(), forKey: "myKey") // $ Alert[swift/cleartext-storage-database]
129129
obj.setValue(getCertificate(), forKey: "myKey") // $ Alert[swift/cleartext-storage-database]
130130

131131
let gen = KeyGen()
132132
let v = gen.generate()
133133

134-
obj.setValue(KeyGen().generate(), forKey: "myKey") // BAD [NOT DETECTED]
135-
obj.setValue(gen.generate(), forKey: "myKey") // BAD [NOT DETECTED]
136-
obj.setValue(v, forKey: "myKey") // BAD [NOT DETECTED]
137-
obj.setValue(KeyManager().generateKey(), forKey: "myKey") // BAD [NOT DETECTED]
138-
obj.setValue(SecureKeyStore().getEncryptionKey(), forKey: "myKey") // BAD [NOT DETECTED]
134+
obj.setValue(KeyGen().generate(), forKey: "myKey") // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
135+
obj.setValue(gen.generate(), forKey: "myKey") // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
136+
obj.setValue(v, forKey: "myKey") // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
137+
obj.setValue(KeyManager().generateKey(), forKey: "myKey") // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
138+
obj.setValue(SecureKeyStore().getEncryptionKey(), forKey: "myKey") // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
139139
}

‎swift/ql/test/query-tests/Security/CWE-311/testCoreData2.swift‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -35,21 +35,21 @@ func testCoreData2_1(obj: MyManagedObject2, maybeObj: MyManagedObject2?, value:
3535
// @NSManaged fields of an NSManagedObject...
3636
obj.myValue = value // GOOD (not sensitive)
3737
obj.myValue = bankAccountNo // $ Alert[swift/cleartext-storage-database]
38-
obj.myBankAccountNumber = value // BAD [NOT DETECTED]
38+
obj.myBankAccountNumber = value // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
3939
obj.myBankAccountNumber = bankAccountNo // $ Alert[swift/cleartext-storage-database]
40-
obj.myBankAccountNumber2 = value // BAD [NOT DETECTED]
40+
obj.myBankAccountNumber2 = value // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
4141
obj.myBankAccountNumber2 = bankAccountNo // $ Alert[swift/cleartext-storage-database]
4242
obj.notStoredBankAccountNumber = value // GOOD (not stored in the database)
43-
obj.notStoredBankAccountNumber = bankAccountNo // $ Alert[swift/cleartext-storage-database] // GOOD (not stored in the datbase) [FALSE POSITIVE]
43+
obj.notStoredBankAccountNumber = bankAccountNo // $ SPURIOUS: Alert[swift/cleartext-storage-database] // GOOD (not stored in the datbase) [FALSE POSITIVE]
4444

4545
maybeObj?.myValue = value // GOOD (not sensitive)
4646
maybeObj?.myValue = bankAccountNo // $ Alert[swift/cleartext-storage-database]
47-
maybeObj?.myBankAccountNumber = value // BAD [NOT DETECTED]
47+
maybeObj?.myBankAccountNumber = value // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
4848
maybeObj?.myBankAccountNumber = bankAccountNo // $ Alert[swift/cleartext-storage-database]
49-
maybeObj?.myBankAccountNumber2 = value // BAD [NOT DETECTED]
49+
maybeObj?.myBankAccountNumber2 = value // $ MISSING: Alert[swift/cleartext-storage-database] // BAD [NOT DETECTED]
5050
maybeObj?.myBankAccountNumber2 = bankAccountNo // $ Alert[swift/cleartext-storage-database]
5151
maybeObj?.notStoredBankAccountNumber = value // GOOD (not stored in the database)
52-
maybeObj?.notStoredBankAccountNumber = bankAccountNo // $ Alert[swift/cleartext-storage-database] // GOOD (not stored in the datbase) [FALSE POSITIVE]
52+
maybeObj?.notStoredBankAccountNumber = bankAccountNo // $ SPURIOUS: Alert[swift/cleartext-storage-database] // GOOD (not stored in the datbase) [FALSE POSITIVE]
5353
}
5454

5555
class testCoreData2_2 {
@@ -102,5 +102,5 @@ func testCoreData2_3(dbObj: MyManagedObject2, maybeObj: MyManagedObject2?, conta
102102
var f: MyContainer?
103103
f?.value = e.value
104104
dbObj.myValue = e.value // $ Alert[swift/cleartext-storage-database]
105-
dbObj.myValue = e.value2 // $ Alert[swift/cleartext-storage-database] // GOOD [FALSE POSITIVE]
105+
dbObj.myValue = e.value2 // $ SPURIOUS: Alert[swift/cleartext-storage-database] // GOOD [FALSE POSITIVE]
106106
}

0 commit comments

Comments
 (0)