Skip to content

Commit 03db15a

Browse files
smowtonsmowton
authored
Merge pull request github#6685 from smowton/smowton/admin/android-uri-model
Java: Add models for android.net.Uri[.Builder]
2 parents 8485b6f + e5b84fb commit 03db15a

File tree

8 files changed

+698
-0
lines changed

8 files changed

+698
-0
lines changed

‎java/change-notes/2021-09-13-android-uri.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* Added taint-propagating models for Android's Uri class and its nested Builder class. This means that new data-flow alerts may be raised where those classes are involved.

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ private module Frameworks {
110110
private import semmle.code.java.security.MvelInjection
111111
private import semmle.code.java.security.OgnlInjection
112112
private import semmle.code.java.security.XPath
113+
private import semmle.code.java.frameworks.android.Android
113114
private import semmle.code.java.frameworks.android.SQLite
114115
private import semmle.code.java.frameworks.Jdbc
115116
private import semmle.code.java.frameworks.SpringJdbc

‎java/ql/lib/semmle/code/java/frameworks/android/Android.qll

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
*/
44

55
import java
6+
import semmle.code.java.dataflow.ExternalFlow
67
import semmle.code.xml.AndroidManifest
78

89
/**
@@ -79,3 +80,71 @@ class AndroidContentResolver extends AndroidComponent {
7980
this.getASupertype*().hasQualifiedName("android.content", "ContentResolver")
8081
}
8182
}
83+
84+
private class UriModel extends SummaryModelCsv {
85+
override predicate row(string row) {
86+
row =
87+
[
88+
"android.net;Uri;true;buildUpon;;;Argument[-1];ReturnValue;taint",
89+
"android.net;Uri;false;decode;;;Argument[0];ReturnValue;taint",
90+
"android.net;Uri;false;encode;;;Argument[0];ReturnValue;taint",
91+
"android.net;Uri;false;fromFile;;;Argument[0];ReturnValue;taint",
92+
"android.net;Uri;false;fromParts;;;Argument[0..2];ReturnValue;taint",
93+
"android.net;Uri;true;getAuthority;;;Argument[-1];ReturnValue;taint",
94+
"android.net;Uri;true;getEncodedAuthority;;;Argument[-1];ReturnValue;taint",
95+
"android.net;Uri;true;getEncodedFragment;;;Argument[-1];ReturnValue;taint",
96+
"android.net;Uri;true;getEncodedPath;;;Argument[-1];ReturnValue;taint",
97+
"android.net;Uri;true;getEncodedQuery;;;Argument[-1];ReturnValue;taint",
98+
"android.net;Uri;true;getEncodedSchemeSpecificPart;;;Argument[-1];ReturnValue;taint",
99+
"android.net;Uri;true;getEncodedUserInfo;;;Argument[-1];ReturnValue;taint",
100+
"android.net;Uri;true;getFragment;;;Argument[-1];ReturnValue;taint",
101+
"android.net;Uri;true;getHost;;;Argument[-1];ReturnValue;taint",
102+
"android.net;Uri;true;getLastPathSegment;;;Argument[-1];ReturnValue;taint",
103+
"android.net;Uri;true;getPath;;;Argument[-1];ReturnValue;taint",
104+
"android.net;Uri;true;getPathSegments;;;Argument[-1];ReturnValue;taint",
105+
"android.net;Uri;true;getQuery;;;Argument[-1];ReturnValue;taint",
106+
"android.net;Uri;true;getQueryParameter;;;Argument[-1];ReturnValue;taint",
107+
"android.net;Uri;true;getQueryParameterNames;;;Argument[-1];ReturnValue;taint",
108+
"android.net;Uri;true;getQueryParameters;;;Argument[-1];ReturnValue;taint",
109+
"android.net;Uri;true;getScheme;;;Argument[-1];ReturnValue;taint",
110+
"android.net;Uri;true;getSchemeSpecificPart;;;Argument[-1];ReturnValue;taint",
111+
"android.net;Uri;true;getUserInfo;;;Argument[-1];ReturnValue;taint",
112+
"android.net;Uri;true;normalizeScheme;;;Argument[-1];ReturnValue;taint",
113+
"android.net;Uri;false;parse;;;Argument[0];ReturnValue;taint",
114+
"android.net;Uri;true;toString;;;Argument[-1];ReturnValue;taint",
115+
"android.net;Uri;false;withAppendedPath;;;Argument[0..1];ReturnValue;taint",
116+
"android.net;Uri;false;writeToParcel;;;Argument[1];Argument[0];taint",
117+
"android.net;Uri$Builder;false;appendEncodedPath;;;Argument[0];Argument[-1];taint",
118+
"android.net;Uri$Builder;false;appendEncodedPath;;;Argument[-1];ReturnValue;value",
119+
"android.net;Uri$Builder;false;appendPath;;;Argument[0];Argument[-1];taint",
120+
"android.net;Uri$Builder;false;appendPath;;;Argument[-1];ReturnValue;value",
121+
"android.net;Uri$Builder;false;appendQueryParameter;;;Argument[0..1];Argument[-1];taint",
122+
"android.net;Uri$Builder;false;appendQueryParameter;;;Argument[-1];ReturnValue;value",
123+
"android.net;Uri$Builder;false;authority;;;Argument[0];Argument[-1];taint",
124+
"android.net;Uri$Builder;false;authority;;;Argument[-1];ReturnValue;value",
125+
"android.net;Uri$Builder;false;build;;;Argument[-1];ReturnValue;taint",
126+
"android.net;Uri$Builder;false;clearQuery;;;Argument[-1];ReturnValue;value",
127+
"android.net;Uri$Builder;false;encodedAuthority;;;Argument[0];Argument[-1];taint",
128+
"android.net;Uri$Builder;false;encodedAuthority;;;Argument[-1];ReturnValue;value",
129+
"android.net;Uri$Builder;false;encodedFragment;;;Argument[0];Argument[-1];taint",
130+
"android.net;Uri$Builder;false;encodedFragment;;;Argument[-1];ReturnValue;value",
131+
"android.net;Uri$Builder;false;encodedOpaquePart;;;Argument[0];Argument[-1];taint",
132+
"android.net;Uri$Builder;false;encodedOpaquePart;;;Argument[-1];ReturnValue;value",
133+
"android.net;Uri$Builder;false;encodedPath;;;Argument[0];Argument[-1];taint",
134+
"android.net;Uri$Builder;false;encodedPath;;;Argument[-1];ReturnValue;value",
135+
"android.net;Uri$Builder;false;encodedQuery;;;Argument[0];Argument[-1];taint",
136+
"android.net;Uri$Builder;false;encodedQuery;;;Argument[-1];ReturnValue;value",
137+
"android.net;Uri$Builder;false;fragment;;;Argument[0];Argument[-1];taint",
138+
"android.net;Uri$Builder;false;fragment;;;Argument[-1];ReturnValue;value",
139+
"android.net;Uri$Builder;false;opaquePart;;;Argument[0];Argument[-1];taint",
140+
"android.net;Uri$Builder;false;opaquePart;;;Argument[-1];ReturnValue;value",
141+
"android.net;Uri$Builder;false;path;;;Argument[0];Argument[-1];taint",
142+
"android.net;Uri$Builder;false;path;;;Argument[-1];ReturnValue;value",
143+
"android.net;Uri$Builder;false;query;;;Argument[0];Argument[-1];taint",
144+
"android.net;Uri$Builder;false;query;;;Argument[-1];ReturnValue;value",
145+
"android.net;Uri$Builder;false;scheme;;;Argument[0];Argument[-1];taint",
146+
"android.net;Uri$Builder;false;scheme;;;Argument[-1];ReturnValue;value",
147+
"android.net;Uri$Builder;false;toString;;;Argument[-1];ReturnValue;taint"
148+
]
149+
}
150+
}

0 commit comments

Comments
 (0)