Introduce TaintInheritingContent

smowton · smowton · commit 5da392ebfe7f · 2021-10-12T12:35:05.000+01:00
diff --git a/java/ql/lib/semmle/code/java/frameworks/android/Intent.qll b/java/ql/lib/semmle/code/java/frameworks/android/Intent.qll
@@ -75,6 +75,14 @@ class IntentGetParcelableExtraMethod extends Method {
   }
 }
 
+/**
+ * Specifies that if an `Intent` is tainted, then so are its synthetic fields.
+ */
+private class IntentFieldsInheritTaint extends DataFlow::SyntheticFieldContent,
+  TaintInheritingContent {
+  IntentFieldsInheritTaint() { this.getField().matches("android.content.Intent.%") }
+}
+
 private class IntentBundleFlowSteps extends SummaryModelCsv {
   override predicate row(string row) {
     row =

Original file line number	Diff line number	Diff line change
`@@ -75,6 +75,14 @@ class IntentGetParcelableExtraMethod extends Method {`
`75`	`75`	`}`
`76`	`76`	`}`
`77`	`77`
	`78`	`+/**`
	`79`	+ * Specifies that if an `Intent` is tainted, then so are its synthetic fields.
	`80`	`+ */`
	`81`	`+private class IntentFieldsInheritTaint extends DataFlow::SyntheticFieldContent,`
	`82`	`+ TaintInheritingContent {`
	`83`	`+ IntentFieldsInheritTaint() { this.getField().matches("android.content.Intent.%") }`
	`84`	`+}`
	`85`	`+`
`78`	`86`	`private class IntentBundleFlowSteps extends SummaryModelCsv {`
`79`	`87`	`override predicate row(string row) {`
`80`	`88`	`row =`