Add security rules and tests for biometric authentication and WKWebView

rules/swift/security/insecure-biometrics-swift.yml

@@ -0,0 +1,54 @@
+id: insecure-biometrics-swift
+language: swift
+severity: info
+message: >-
+  The application was observed to leverage biometrics via Local
+      Authentication, which returns a simple boolean result for authentication.
+      This design is subject to bypass with runtime tampering tools such as
+      Frida, Substrate, and others. Although this is limited to rooted
+      (jailbroken) devices, consider implementing biometric authentication the
+      reliable way - via Keychain Services.
+note: >-
+  [CWE-305] Authentication Bypass by Primary Weakness
+  [REFERENCES]
+      - https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06f-testing-local-authentication
+      - https://shirazkhan030.medium.com/biometric-authentication-in-ios-6c53c54f17df
+
+rule:
+  kind: navigation_expression
+  pattern: $X.evaluatePolicy
+
+constraints:
+  X:
+    any:
+      - pattern: LAContext()
+      - kind: simple_identifier
+        inside:
+          stopBy: end
+          follows:
+            stopBy: end
+            kind: property_declaration
+            all:
+              - has:
+                  stopBy: end
+                  kind: simple_identifier
+                  pattern: $X
+              - has:
+                  stopBy: end
+                  kind: call_expression
+                  field: value
+                  pattern: LAContext()
+      - kind: simple_identifier
+        follows:
+          stopBy: end
+          kind: property_declaration
+          all:
+            - has:
+                stopBy: end
+                kind: simple_identifier
+                pattern: $X
+            - has:
+                stopBy: end
+                kind: call_expression
+                field: value
+                pattern: LAContext()

rules/swift/security/swift-webview-config-allows-js-open-windows-swift.yml

@@ -0,0 +1,141 @@
+id: swift-webview-config-allows-js-open-windows-swift
+language: swift
+severity: warning
+message: >-
+  Webviews were observed that explictly allow JavaScript in an WKWebview
+  to open windows automatically. Consider disabling this functionality if
+  not required, following the principle of least privelege.
+note: >-
+  [CWE-272]: Least Privilege Violation
+  [REFERENCES]
+       https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/
+       https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati
+utils:
+  match_JavaScriptCanOpenWindowsAutomatically:
+    kind: assignment
+    all:
+      - has:
+          stopBy: end
+          kind: navigation_expression
+          has:
+            stopBy: end
+            kind: simple_identifier
+            pattern: $R
+      - has:
+          stopBy: end
+          kind: navigation_suffix
+          has:
+            stopBy: end
+            kind: simple_identifier
+            regex: "^JavaScriptCanOpenWindowsAutomatically$"
+      - has:
+          kind: boolean_literal
+          regex: "^true$"
+      - follows:
+          stopBy: end
+          kind: property_declaration
+          all:
+            - has:
+                stopBy: end
+                kind: pattern
+                field: name
+                has:
+                  kind: simple_identifier
+                  pattern: $R
+            - has:
+                stopBy: end
+                kind: call_expression
+                field: value
+                all:
+                  - has:
+                      stopBy: end
+                      kind: simple_identifier
+                      regex: "^WKPreferences$"
+                  - has:
+                      stopBy: end
+                      kind: call_suffix
+                      has:
+                        stopBy: end
+                        kind: value_arguments
+      - not:
+          precedes:
+            stopBy: neighbor
+            kind: assignment
+            has:
+              stopBy: end
+              kind: boolean_literal
+              regex: "^true$|false"
+      - not:
+          follows:
+            stopBy: neighbor
+            kind: assignment
+            has:
+              stopBy: end
+              kind: boolean_literal
+              regex: "^true$"
+  match_non_boolean:
+    kind: assignment
+    all:
+      - has:
+          stopBy: end
+          kind: navigation_expression
+          has:
+            stopBy: end
+            kind: simple_identifier
+            pattern: $R
+      - has:
+          stopBy: end
+          kind: navigation_suffix
+          has:
+            stopBy: end
+            kind: simple_identifier
+            regex: "^JavaScriptCanOpenWindowsAutomatically$"
+      - has:
+          kind: simple_identifier
+      - follows:
+          stopBy: end
+          kind: property_declaration
+          all:
+            - has:
+                stopBy: end
+                kind: pattern
+                field: name
+                has:
+                  kind: simple_identifier
+                  pattern: $R
+            - has:
+                stopBy: end
+                kind: call_expression
+                field: value
+                all:
+                  - has:
+                      stopBy: end
+                      kind: simple_identifier
+                      regex: "^WKPreferences$"
+                  - has:
+                      stopBy: end
+                      kind: call_suffix
+                      has:
+                        stopBy: end
+                        kind: value_arguments
+      - not:
+          precedes:
+            stopBy: neighbor
+            kind: assignment
+            has:
+              stopBy: end
+              kind: boolean_literal
+              regex: "^true$|false"
+      - not:
+          follows:
+            stopBy: neighbor
+            kind: assignment
+            has:
+              stopBy: end
+              kind: boolean_literal
+              regex: "^true$"
+
+rule:
+  any:
+    - matches: match_JavaScriptCanOpenWindowsAutomatically
+    - matches: match_non_boolean