Skip to content

Commit 6720dba

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
draft android debug query
1 parent 79bae0c commit 6720dba

File tree

9 files changed

+152
-0
lines changed

9 files changed

+152
-0
lines changed

‎java/ql/src/Security/CWE/CWE-489/DebuggableAttributeTrue.qhelp

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p>The <code>debuggable</code> attribute in the application section of the AndroidManifest.xml file should
8+
never be enabled in production builds.</p>
9+
10+
<p>ADD MORE/EDIT?</p>
11+
12+
</overview>
13+
<recommendation>
14+
15+
<p>Make sure that the <code>debuggable</code> attribute is set to false in production builds.</p>
16+
17+
</recommendation>
18+
<example>
19+
20+
<p>In the example below, the <code>debuggable</code> attribute is set to <code>true</code>.</p>
21+
22+
23+
<p>The corrected version sets the <code>debuggable</code> attribute to <code>false</code>.</p>
24+
25+
26+
</example>
27+
<references>
28+
29+
<li>
30+
Java SE Documentation:
31+
<a href="https://www.oracle.com/java/technologies/javase/codeconventions-statements.html#15395">Compound Statements</a>.
32+
</li>
33+
<li>
34+
Wikipedia:
35+
<a href="https://en.wikipedia.org/wiki/Indentation_style">Indentation style</a>.
36+
</li>
37+
38+
</references>
39+
</qhelp>

‎java/ql/src/Security/CWE/CWE-489/DebuggableAttributeTrue.ql

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// TODO: Fix up metadata
2+
/**
3+
* @name Debuggable set to true
4+
* @description The 'debuggable' attribute in the application section of the AndroidManifest.xml file should never be enabled in production builds // TODO: edit to be in-line wth guidelines
5+
* @kind problem
6+
* @problem.severity warning
7+
* @id java/android/debuggable-true // TODO: consider editing
8+
* @tags security // TODO: look into CWEs some more
9+
* external/cwe/cwe-489
10+
* external/cwe/cwe-710
11+
* @precision high // TODO: adjust once review query results and FP ratio
12+
* @security-severity 0.1 // TODO: auto-calculated: https://github.blog/changelog/2021-07-19-codeql-code-scanning-new-severity-levels-for-security-alerts/
13+
*/
14+
15+
import java
16+
import semmle.code.xml.AndroidManifest
17+
18+
from AndroidXmlAttribute androidXmlAttr
19+
where
20+
androidXmlAttr.getName() = "debuggable" and
21+
androidXmlAttr.getValue() = "true"
22+
select androidXmlAttr, "Warning: 'android:debuggable=true' set"

‎java/ql/test/query-tests/security/CWE-489/DebuggableAttributeTrue.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| TestTrue.xml:7:5:17:30 | debuggable=true | Warning: 'android:debuggable=true' set |

‎java/ql/test/query-tests/security/CWE-489/DebuggableAttributeTrue.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE/CWE-489/DebuggableAttributeTrue.ql

‎java/ql/test/query-tests/security/CWE-489/Test.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
// No need for Java code since only testing XML files
2+
public class Test { }

‎java/ql/test/query-tests/security/CWE-489/TestFalse.xml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
3+
xmlns:tools="http://schemas.android.com/tools"
4+
package="com.example.happybirthday">
5+
6+
<!-- Safe: 'debuggable' set to false -->
7+
<application
8+
android:debuggable="false"
9+
android:allowBackup="true"
10+
android:dataExtractionRules="@xml/data_extraction_rules"
11+
android:fullBackupContent="@xml/backup_rules"
12+
android:icon="@mipmap/ic_launcher"
13+
android:label="@string/app_name"
14+
android:roundIcon="@mipmap/ic_launcher_round"
15+
android:supportsRtl="true"
16+
android:theme="@style/Theme.HappyBirthday"
17+
tools:targetApi="31">
18+
<activity
19+
android:name=".MainActivity"
20+
android:exported="true">
21+
<intent-filter>
22+
<action android:name="android.intent.action.MAIN" />
23+
24+
<category android:name="android.intent.category.LAUNCHER" />
25+
</intent-filter>
26+
</activity>
27+
</application> <!-- test -->
28+
29+
</manifest>

‎java/ql/test/query-tests/security/CWE-489/TestNotSet.xml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
3+
xmlns:tools="http://schemas.android.com/tools"
4+
package="com.example.happybirthday">
5+
6+
<!-- Safe: 'debuggable' not set at all -->
7+
<application
8+
android:allowBackup="true"
9+
android:dataExtractionRules="@xml/data_extraction_rules"
10+
android:fullBackupContent="@xml/backup_rules"
11+
android:icon="@mipmap/ic_launcher"
12+
android:label="@string/app_name"
13+
android:roundIcon="@mipmap/ic_launcher_round"
14+
android:supportsRtl="true"
15+
android:theme="@style/Theme.HappyBirthday"
16+
tools:targetApi="31">
17+
<activity
18+
android:name=".MainActivity"
19+
android:exported="true">
20+
<intent-filter>
21+
<action android:name="android.intent.action.MAIN" />
22+
23+
<category android:name="android.intent.category.LAUNCHER" />
24+
</intent-filter>
25+
</activity>
26+
</application> <!-- test -->
27+
28+
</manifest>

‎java/ql/test/query-tests/security/CWE-489/TestTrue.xml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
3+
xmlns:tools="http://schemas.android.com/tools"
4+
package="com.example.happybirthday">
5+
6+
<!-- Not Safe: 'debuggable' set to true -->
7+
<application
8+
android:debuggable="true"
9+
android:allowBackup="true"
10+
android:dataExtractionRules="@xml/data_extraction_rules"
11+
android:fullBackupContent="@xml/backup_rules"
12+
android:icon="@mipmap/ic_launcher"
13+
android:label="@string/app_name"
14+
android:roundIcon="@mipmap/ic_launcher_round"
15+
android:supportsRtl="true"
16+
android:theme="@style/Theme.HappyBirthday"
17+
tools:targetApi="31">
18+
<activity
19+
android:name=".MainActivity"
20+
android:exported="true">
21+
<intent-filter>
22+
<action android:name="android.intent.action.MAIN" />
23+
24+
<category android:name="android.intent.category.LAUNCHER" />
25+
</intent-filter>
26+
</activity>
27+
</application> <!-- test -->
28+
29+
</manifest>

‎java/ql/test/query-tests/security/CWE-489/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/google-android-9.0.0

0 commit comments

Comments
 (0)