Swift: InsecureTLSQuery

d10c · d10c · commit 3e3e856c2442 · 2025-07-11T14:49:28.000+02:00
diff --git a/swift/ql/lib/codeql/swift/security/InsecureTLSQuery.qll b/swift/ql/lib/codeql/swift/security/InsecureTLSQuery.qll
@@ -22,9 +22,9 @@ module InsecureTlsConfig implements DataFlow::ConfigSig {
     any(InsecureTlsExtensionsAdditionalFlowStep s).step(nodeFrom, nodeTo)
   }
 
-  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
+  predicate observeDiffInformedIncrementalMode() {
+    none() // query selects some Swift nodes (e.g. "[post] self") that have location file://:0:0:0:0, which always fall outside the diff range.
+  }
 }
 
 module InsecureTlsFlow = TaintTracking::Global<InsecureTlsConfig>;

Original file line number	Diff line number	Diff line change
`@@ -22,9 +22,9 @@ module InsecureTlsConfig implements DataFlow::ConfigSig {`
`22`	`22`	`any(InsecureTlsExtensionsAdditionalFlowStep s).step(nodeFrom, nodeTo)`
`23`	`23`	`}`
`24`	`24`
`25`		`- predicate observeDiffInformedIncrementalMode() { any() }`
`26`		`-`
`27`		`- Location getASelectedSourceLocation(DataFlow::Node source) { none() }`
	`25`	`+ predicate observeDiffInformedIncrementalMode() {`
	`26`	`+ none() // query selects some Swift nodes (e.g. "[post] self") that have location file://:0:0:0:0, which always fall outside the diff range.`
	`27`	`+ }`
`28`	`28`	`}`
`29`	`29`
`30`	`30`	`module InsecureTlsFlow = TaintTracking::Global<InsecureTlsConfig>;`