Conversation
The data flow graph has no actual edges yet
Contributor
|
QHelp previews: unified/ql/src/queries/security/CWE-312/CleartextLogging.qhelpCleartext logging of sensitive informationAttackers could gain access to sensitive information that is logged unencrypted. RecommendationAlways make sure to encrypt or obfuscate sensitive information before you log it. Generally, you should decrypt sensitive information only at the point where it is necessary for it to be used in cleartext. Be aware that external processes often store the standard output and standard error streams of the application. This will include logged sensitive information. ExampleThe following example code logs user credentials (in this case, their password) in plaintext: let password = "P@ssw0rd"
NSLog("User password changed to \(password)")Instead, you should encrypt or obfuscate the credentials, or omit them entirely: let password = "P@ssw0rd"
NSLog("User password changed")References
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| */ | ||
| predicate relevantNode(AstNode node) { | ||
| // Match an ancestor node by location so its whole subtree is shown. | ||
| node.getParent*().getLocation().toString().matches("%test.swift@13:%") |
|
|
||
| from DummyFlow::PathNode source, DummyFlow::PathNode sink | ||
| where DummyFlow::flowPath(source, sink) | ||
| select sink.getNode(), source, sink, "Logging of $@", source.getNode(), "sensitive data" |
asgerf
force-pushed
the
unified/dataflow2
branch
from
September 14, 2026 12:00
44d00a0 to
b3f892e
Compare
asgerf
force-pushed
the
unified/dataflow2
branch
from
September 14, 2026 12:05
b3f892e to
2d1a99c
Compare
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The standard query is knowingly noisy, while type contexts and tuple indices above 20 are modeled incorrectly.
Get a fresh assessment by requesting another Copilot review.
Review tier: Balanced
Findings: 3
Open findings (3)
What changed in this PR
Adds foundational Unified data-flow/taint tracking and a Swift cleartext-logging query.
Changes:
- Implements data-flow nodes, SSA integration, content tracking, and flow steps.
- Exposes public data-flow APIs and testing utilities.
- Adds cleartext-logging query documentation and tests.
| File | Description |
|---|---|
CleartextLoggingGood.swift (test) |
Adds negative query case. |
CleartextLoggingBad.swift (test) |
Adds positive query case. |
CleartextLogging.qlref |
Configures query test. |
CleartextLogging.expected |
Generated query expectation. |
dataflow/test.swift |
Exercises local and taint flow. |
dataflow/test.ql |
Runs inline flow tests. |
dataflow/test.expected |
Generated flow expectations. |
dataflow/implicit-self.swift |
Tests implicit receiver flow. |
CleartextLoggingGood.swift (query) |
Adds safe documentation example. |
CleartextLoggingBad.swift (query) |
Adds unsafe documentation example. |
CleartextLogging.ql |
Implements the security query. |
CleartextLogging.qhelp |
Documents the query. |
InlineFlowTest.qll |
Adds Unified flow-test support. |
unified.qll |
Exports the data-flow API. |
qlpack.yml |
Adds data-flow dependencies. |
StaticNameBinding.qll |
Exposes member names. |
FacadeAst.qll |
Adds call argument counting. |
ExprPositions.qll |
Classifies expression contexts. |
debugDataFlowGraph.ql |
Adds graph visualization. |
VariableRefKind.qll |
Defines variable access kinds. |
TaintTrackingInstantiation.qll |
Instantiates taint tracking. |
Step.qll |
Defines flow-step kinds. |
LocalSsa.qll |
Integrates local SSA. |
DataFlowPublic.qll |
Exposes public modules. |
DataFlowNode.qll |
Defines data-flow nodes. |
DataFlowInstantiation.qll |
Instantiates data flow. |
DataFlowGraph.qll |
Constructs local flow edges. |
Content.qll |
Models field-sensitive content. |
AllDataFlow.qll |
Aggregates internal modules. |
AstExtra.qll |
Separates identifier labels. |
DataFlowConsistency.ql |
Adds consistency checks. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| or | ||
| // Tuple elements can be accessed as named members, e.g. `tuple.0`, `tuple.1`, etc, | ||
| // so just model their elements as named members. | ||
| name = [0 .. 20].toString() |
| * @kind path-problem | ||
| * @problem.severity error | ||
| * @security-severity 7.5 | ||
| * @precision high |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
asgerf
marked this pull request as ready for review
September 14, 2026 13:31
geoffw0
reviewed
Sep 14, 2026
geoffw0
left a comment
geoffw0
left a comment
Contributor
There was a problem hiding this comment.
Prototype query, .qhelp and query test LGTM (apart from one dead link). 🎉 🚀
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the first basic version of data flow, with the following features:
selfaccessThe PR also adds a basic version of the clear-text logging query, mainly for exercising data flow in DCA. This query was chosen because it is easily stubbed without elaborate library modelling and will tend to have sources and sinks in many projects. It is not expected to be precise at this point in time.
What is not included:
Commit-by-commit review strongly recommended.