- Notifications
You must be signed in to change notification settings - Fork1.7k
Swift: Diff-informed queries: phase 3 (non-trivial locations)#20082
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Pull Request Overview
This PR enables diff-informed mode on Swift security queries that select non-trivial locations (other than dataflow source or sink). The changes add location override predicates to handle cases where queries select locations that need special handling for diff-informed analysis.
- Adds
observeDiffInformedIncrementalMode()predicate to four security query modules - Implements
getASelectedSinkLocation()predicate for queries that can support diff-informed mode - Disables diff-informed mode for queries with location selection complexities
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| UnsafeWebViewFetchQuery.qll | Disables diff-informed mode due to secondary location use in select |
| InsecureTLSQuery.qll | Disables diff-informed mode due to Swift nodes with problematic locations |
| CleartextStoragePreferencesQuery.qll | Enables diff-informed mode with custom sink location handling |
| CleartextStorageDatabaseQuery.qll | Enables diff-informed mode with custom sink location handling |
| predicate observeDiffInformedIncrementalMode() { any() } | ||
| Location getASelectedSinkLocation(DataFlow::Node sink) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
The logic ingetASelectedSinkLocation is duplicated across CleartextStoragePreferencesQuery.qll and CleartextStorageDatabaseQuery.qll. Consider extracting this common pattern into a shared utility predicate to improve maintainability.
Copilot uses AI. Check for mistakes.
This PR enables diff-informed mode on queries that select a location other than dataflow source or sink. This entails adding a non-trivial location override that returns the locations that are actually selected.
Prior work includes PRs like#19663,#19759, and#19817. This PR uses the same patch script as those PRs to find candidate queries to convert to diff-enabled. This is the final step in mass-enabling diff-informed queries on all the languages.
Commit-by-commit reviewing is recommended.