Skip to content

Commit 10fa687

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
updated help file and unit tests
1 parent eea1089 commit 10fa687

File tree

6 files changed

+118
-22
lines changed

6 files changed

+118
-22
lines changed

‎java/ql/src/Security/CWE/CWE-926/ExampleBad.xml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<manifest ... >
2+
<application ...
3+
<!-- BAD: this component is implicitly exported -->
4+
<activity>
5+
android:name=".Activity">
6+
<intent-filter>
7+
<action android:name="android.intent.action.VIEW" />
8+
</intent-filter>
9+
</activity>
10+
</application>
11+
</manifest>

‎java/ql/src/Security/CWE/CWE-926/ExampleGood.xml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<manifest ... >
2+
<application ...
3+
<!-- GOOD: this component is not exported due to 'android:exported' explicitly set to 'false'-->
4+
<activity>
5+
android:name=".Activity">
6+
android:exported="false"
7+
<intent-filter>
8+
<action android:name="android.intent.action.VIEW" />
9+
</intent-filter>
10+
</activity>
11+
</application>
12+
</manifest>

‎java/ql/src/Security/CWE/CWE-926/ImplicitlyExportedAndroidComponent.qhelp

Lines changed: 19 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,30 +5,27 @@
55

66
<overview>
77
<p>The Android manifest file defines configuration settings for Android applications.
8-
In this file, the <code>android:debuggable</code> attribute of the <code>application</code> element can be used to
9-
define whether or not the application can be debugged. When set to <code>true</code>, this attribute will allow the
10-
application to be debugged even when running on a device in user mode.</p>
8+
In this file, components can be declared with intent filters which specify the types of intents the component can respond to.
9+
If the <code>android:exported</code> attribute is omitted from the component when an intent filter is included,
10+
then the component will be implicitly exported.</p>
1111

12-
<p>When a debugger is enabled it could allow for entry points in the application or reveal sensitive information.
13-
As a result, <code>android:debuggable</code> should only be enabled during development and should be disabled in
14-
production builds.</p>
12+
<p>An implicitly exported component could allow for improper access to the component and its data.</p>
1513

1614
</overview>
1715
<recommendation>
1816

19-
<p>In Android applications either set the <code>android:debuggable</code> attribute to <code>false</code>
20-
or do not include it in the manifest. The default value when not included is <code>false</code>.</p>
17+
<p>Explicitly set the <code>android:exported</code> attribute for every component or use permissions to limit access to the component.</p>
2118

2219
</recommendation>
2320
<example>
2421

25-
<p>In the example below, the <code>android:debuggable</code> attribute is set to <code>true</code>.</p>
22+
<p>In the example below, the component <code>android:exported</code> attribute is omitted when an intent filter is used.</p>
2623

27-
<!--<sample src="DebuggableTrue.xml" />-->
24+
<sample src="ExampleBad.xml" />
2825

29-
<p>The corrected version sets the <code>android:debuggable</code> attribute to <code>false</code>.</p>
26+
<p>A corrected version sets the <code>android:exported</code> attribute to <code>false</code>.</p>
3027

31-
<!--<sample src="DebuggableFalse.xml" />-->
28+
<sample src="ExampleGood.xml" />
3229

3330
</example>
3431
<references>
@@ -39,11 +36,19 @@ or do not include it in the manifest. The default value when not included is <co
3936
</li>
4037
<li>
4138
Android Developers:
42-
<a href="https://developer.android.com/guide/topics/manifest/application-element#debug">The android:debuggable attribute</a>.
39+
<a href="https://developer.android.com/guide/topics/manifest/intent-filter-element">intent-filter-element</a>.
4340
</li>
4441
<li>
4542
Android Developers:
46-
<a href="https://developer.android.com/studio/debug#enable-debug">Enable debugging</a>.
43+
<a href="https://developer.android.com/guide/topics/manifest/activity-element#exported">The android:exported attribute</a>.
44+
</li>
45+
<li>
46+
Android Developers:
47+
<a href="https://developer.android.com/guide/topics/manifest/activity-element#prmsn">The android:permission attribute</a>.
48+
</li>
49+
<li>
50+
Android Developers:
51+
<a href="https://developer.android.com/about/versions/12/behavior-changes-12#exported">Safer component exporting</a>.
4752
</li>
4853

4954
</references>

‎java/ql/test/query-tests/security/CWE-926/AndroidManifest.xml

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
android:roundIcon="@mipmap/ic_launcher_round"
1313
android:supportsRtl="true"
1414
android:theme="@style/Theme.HappyBirthday"
15-
android:permission="android.permission.SEND_SMS"
1615
tools:targetApi="31"> <!-- test -->
1716
<!-- Safe: category LAUNCHER --> <activity
1817
android:name=".MainActivity">
@@ -29,6 +28,26 @@
2928
<action android:name="android.intent.action.MAIN" />
3029
</intent-filter>
3130
</activity>
31+
32+
<!-- Safe: 'android:exported' explicitly set --> <activity
33+
android:name=".MainActivity"
34+
android:exported="true">
35+
<intent-filter>
36+
<action android:name="android.intent.action.MAIN" />
37+
</intent-filter>
38+
</activity>
39+
40+
<!-- Safe: no intent filter --> <activity
41+
android:name=".MainActivity">
42+
</activity>
43+
44+
<!-- Safe: has 'permission' attribute --> <activity
45+
android:name=".MainActivity"
46+
android:permission=".Test">
47+
<intent-filter>
48+
<action android:name="android.intent.action.MAIN" />
49+
</intent-filter>
50+
</activity>
3251
</application>
3352

3453
</manifest>

‎java/ql/test/query-tests/security/CWE-926/ImplicitlyExportedAndroidComponentTest.ql

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,9 @@ class ImplicitlyExportedAndroidComponentTest extends InlineExpectationsTest {
99

1010
override predicate hasActualResult(Location location, string element, string tag, string value) {
1111
tag = "hasImplicitExport" and
12-
exists(AndroidComponentXmlElement compElem, AndroidIntentFilterXmlElement intFiltElem |
13-
not compElem.hasAttribute("exported") and
14-
//compElem.getAnIntentFilterElement() instanceof AndroidIntentFilterXmlElement
15-
not intFiltElem.getParent() = compElem
16-
|
17-
compElem.getLocation() = location and
18-
element = compElem.toString() and
12+
exists(AndroidComponentXmlElement compElement | compElement.isImplicitlyExported() |
13+
compElement.getLocation() = location and
14+
element = compElement.toString() and
1915
value = ""
2016
)
2117
}

‎java/ql/test/query-tests/security/CWE-926/Testbuild/AndroidManifest.xml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
3+
xmlns:tools="http://schemas.android.com/tools"
4+
package="com.example.happybirthday">
5+
6+
<application
7+
android:allowBackup="true"
8+
android:dataExtractionRules="@xml/data_extraction_rules"
9+
android:fullBackupContent="@xml/backup_rules"
10+
android:icon="@mipmap/ic_launcher"
11+
android:label="@string/app_name"
12+
android:roundIcon="@mipmap/ic_launcher_round"
13+
android:supportsRtl="true"
14+
android:theme="@style/Theme.HappyBirthday"
15+
tools:targetApi="31"> <!-- test -->
16+
<!-- Safe: category LAUNCHER --> <activity
17+
android:name=".MainActivity">
18+
<intent-filter>
19+
<action android:name="android.intent.action.MAIN" />
20+
21+
<category android:name="android.intent.category.LAUNCHER" />
22+
</intent-filter>
23+
</activity>
24+
25+
<!-- Safe: in build directory --> <activity
26+
android:name=".MainActivity">
27+
<intent-filter>
28+
<action android:name="android.intent.action.MAIN" />
29+
</intent-filter>
30+
</activity>
31+
32+
<!-- Safe: 'android:exported' explicitly set --> <activity
33+
android:name=".MainActivity"
34+
android:exported="true">
35+
<intent-filter>
36+
<action android:name="android.intent.action.MAIN" />
37+
</intent-filter>
38+
</activity>
39+
40+
<!-- Safe: no intent filter --> <activity
41+
android:name=".MainActivity">
42+
</activity>
43+
44+
<!-- Safe: has 'permission' attribute --> <activity
45+
android:name=".MainActivity"
46+
android:permission=".Test">
47+
<intent-filter>
48+
<action android:name="android.intent.action.MAIN" />
49+
</intent-filter>
50+
</activity>
51+
</application>
52+
53+
</manifest>

0 commit comments

Comments
 (0)