Merge pull request #14286 from geoffw0/interp

Swift: Fix bug in taint flow through string interpolation
github · Sep 22, 2023 · ab54f0c · ab54f0c
2 parents 0aeec1a + f2689dd
commit ab54f0c
Show file tree

Hide file tree

Showing 5 changed files with 182 additions and 36 deletions.
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll b/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll
@@ -33,7 +33,7 @@ private module Cached {
     exists(ApplyExpr apply, ExprCfgNode e |
       nodeFrom.asExpr() = [apply.getAnArgument().getExpr(), apply.getQualifier()] and
       apply.getStaticTarget().getName() = ["appendLiteral(_:)", "appendInterpolation(_:)"] and
-      e.getExpr() = [apply.getAnArgument().getExpr(), apply.getQualifier()] and
+      e.getExpr() = apply.getQualifier() and
       nodeTo.(PostUpdateNodeImpl).getPreUpdateNode().getCfgNode() = e
     )
     or