From 127f81976249f8078c6d49913a8623a0e2a20002 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 6 Nov 2023 17:23:28 +0000 Subject: [PATCH 1/4] Swift: Move command injection query out from experimental. --- .../Security/CWE-078/CommandInjection.qhelp | 0 .../Security/CWE-078/CommandInjection.ql | 0 .../Security/CWE-078/CommandInjectionBad.swift | 0 .../Security/CWE-078/CommandInjectionGood.swift | 0 4 files changed, 0 insertions(+), 0 deletions(-) rename swift/ql/src/{experimental => queries}/Security/CWE-078/CommandInjection.qhelp (100%) rename swift/ql/src/{experimental => queries}/Security/CWE-078/CommandInjection.ql (100%) rename swift/ql/src/{experimental => queries}/Security/CWE-078/CommandInjectionBad.swift (100%) rename swift/ql/src/{experimental => queries}/Security/CWE-078/CommandInjectionGood.swift (100%) diff --git a/swift/ql/src/experimental/Security/CWE-078/CommandInjection.qhelp b/swift/ql/src/queries/Security/CWE-078/CommandInjection.qhelp similarity index 100% rename from swift/ql/src/experimental/Security/CWE-078/CommandInjection.qhelp rename to swift/ql/src/queries/Security/CWE-078/CommandInjection.qhelp diff --git a/swift/ql/src/experimental/Security/CWE-078/CommandInjection.ql b/swift/ql/src/queries/Security/CWE-078/CommandInjection.ql similarity index 100% rename from swift/ql/src/experimental/Security/CWE-078/CommandInjection.ql rename to swift/ql/src/queries/Security/CWE-078/CommandInjection.ql diff --git a/swift/ql/src/experimental/Security/CWE-078/CommandInjectionBad.swift b/swift/ql/src/queries/Security/CWE-078/CommandInjectionBad.swift similarity index 100% rename from swift/ql/src/experimental/Security/CWE-078/CommandInjectionBad.swift rename to swift/ql/src/queries/Security/CWE-078/CommandInjectionBad.swift diff --git a/swift/ql/src/experimental/Security/CWE-078/CommandInjectionGood.swift b/swift/ql/src/queries/Security/CWE-078/CommandInjectionGood.swift similarity index 100% rename from swift/ql/src/experimental/Security/CWE-078/CommandInjectionGood.swift rename to swift/ql/src/queries/Security/CWE-078/CommandInjectionGood.swift From 1c6a4b8cbf70281fb40c97668152db064dd66907 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 6 Nov 2023 17:32:25 +0000 Subject: [PATCH 2/4] Swift: Update the test .qlref. --- .../ql/test/query-tests/Security/CWE-078/CommandInjection.qlref | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/swift/ql/test/query-tests/Security/CWE-078/CommandInjection.qlref b/swift/ql/test/query-tests/Security/CWE-078/CommandInjection.qlref index 3556b36b1857..87be59af70b3 100644 --- a/swift/ql/test/query-tests/Security/CWE-078/CommandInjection.qlref +++ b/swift/ql/test/query-tests/Security/CWE-078/CommandInjection.qlref @@ -1 +1 @@ -experimental/Security/CWE-078/CommandInjection.ql \ No newline at end of file +queries/Security/CWE-078/CommandInjection.ql \ No newline at end of file From c85bdcd5abb1030f7f0e590a68e3ee35ca4a5909 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 6 Nov 2023 17:36:58 +0000 Subject: [PATCH 3/4] Swift: Change note. --- swift/ql/src/change-notes/2023-11-06-command-injection.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 swift/ql/src/change-notes/2023-11-06-command-injection.md diff --git a/swift/ql/src/change-notes/2023-11-06-command-injection.md b/swift/ql/src/change-notes/2023-11-06-command-injection.md new file mode 100644 index 000000000000..c04e596dab2d --- /dev/null +++ b/swift/ql/src/change-notes/2023-11-06-command-injection.md @@ -0,0 +1,5 @@ +--- +category: newQuery +--- + +* Added new query "System command built from user-controlled sources" (`swift/command-line-injection`) for Swift. This query detects system commands built from user-controlled sources without sufficient validation. The query was previously contributed to the 'experimental' directory but will now run by default for all code scanning users. From d78a7b9d940a8cbfb514d933b83806cd5d2333e2 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Wed, 8 Nov 2023 10:46:57 +0000 Subject: [PATCH 4/4] Swift: Add credit to change note. --- swift/ql/src/change-notes/2023-11-06-command-injection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/swift/ql/src/change-notes/2023-11-06-command-injection.md b/swift/ql/src/change-notes/2023-11-06-command-injection.md index c04e596dab2d..0ad3340c7cfc 100644 --- a/swift/ql/src/change-notes/2023-11-06-command-injection.md +++ b/swift/ql/src/change-notes/2023-11-06-command-injection.md @@ -2,4 +2,4 @@ category: newQuery --- -* Added new query "System command built from user-controlled sources" (`swift/command-line-injection`) for Swift. This query detects system commands built from user-controlled sources without sufficient validation. The query was previously contributed to the 'experimental' directory but will now run by default for all code scanning users. +* Added new query "System command built from user-controlled sources" (`swift/command-line-injection`) for Swift. This query detects system commands built from user-controlled sources without sufficient validation. The query was previously [contributed to the 'experimental' directory by @maikypedia](https://github.com/github/codeql/pull/13726) but will now run by default for all code scanning users.