Skip to content

Commit dedd29e

Browse files
egregius313egregius313
committed
Incomplete Android content provider permissions documentation
1 parent e37f62b commit dedd29e

5 files changed

+106
-0
lines changed

‎java/ql/src/Security/CWE/CWE-276/ContentProviderIncompletePermissions.qhelp

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>In the Android manifest file, an application's <code>provider</code> elements
7+
define the permissions necessary to access a resource using that provider.
8+
Permissions are specified with
9+
the <code>android:readPermission</code>, <code>android:writePermission</code>,
10+
or <code>android:permission</code> attributes. If an application only
11+
specifies the <code>android:readPermission</code>
12+
or <code>android:writePermission</code> attribute, no permissions will be
13+
required to do other operations.
14+
</p>
15+
16+
<p>Content providers should either define both the read and write permissions
17+
attributes, or define the general <code>android:permission</code> attribute.</p>
18+
</overview>
19+
20+
<recommendation>
21+
To prevent permission bypass, <code>provider</code> elements should either
22+
specify both the <code>android:readPermission</code>
23+
and <code>android:writePermission</code> attributes, or specify
24+
the <code>android:permission</code> attribute.
25+
</recommendation>
26+
27+
<example>
28+
29+
<p>In the following two (bad) examples, the provider is configured with only
30+
read or write permissions.</p>
31+
32+
<sample src="ContentProviderIncompletePermissionsReadOnly.xml"/>
33+
34+
<sample src="ContentProviderIncompletePermissionsWriteOnly.xml"/>
35+
36+
<p>In the following (good) examples, the provider is configured with full permissions.</p>
37+
38+
<sample src="ContentProviderIncompletePermissionsReadWrite.xml"/>
39+
40+
<sample src="ContentProviderIncompletePermissionsFull.xml"/>
41+
</example>
42+
43+
<references>
44+
<li>
45+
Android Documentation:
46+
<a href="https://developer.android.com/guide/topics/manifest/provider-element">Provider element</a>
47+
</li>
48+
<li>
49+
CVE-2021-41166: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41166">Insufficient
50+
permission control in Nextcloud Android app</a>
51+
</li>
52+
<li>
53+
GitHub Security Lab Research:
54+
<a href="https://securitylab.github.com/advisories/GHSL-2021-1007-Nextcloud_Android_app/#issue-2-permission-bypass-in-disklruimagecachefileprovider-ghsl-2021-1008">Insufficient permission control in Nextcloud Android app</a>
55+
</li>
56+
</references>
57+
</qhelp>

‎java/ql/src/Security/CWE/CWE-276/ContentProviderIncompletePermissionsFull.xml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<manifest ... >
2+
<application ...>
3+
<!-- Good: 'android:permission' is set -->
4+
<provider
5+
android:name=".MyContentProvider"
6+
android:authorities="table"
7+
android:enabled="true"
8+
android:exported="true"
9+
android:permission="android.permission.MANAGE_DOCUMENTS">
10+
</provider>
11+
</application>
12+
</manifest>

‎java/ql/src/Security/CWE/CWE-276/ContentProviderIncompletePermissionsReadOnly.xml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<manifest ... >
2+
<application ...>
3+
<!-- BAD: only 'android:readPermission' is set -->
4+
<provider
5+
android:name=".MyContentProvider"
6+
android:authorities="table"
7+
android:enabled="true"
8+
android:exported="true"
9+
android:readPermission="android.permission.MANAGE_DOCUMENTS">
10+
</provider>
11+
</application>
12+
</manifest>

‎java/ql/src/Security/CWE/CWE-276/ContentProviderIncompletePermissionsReadWrite.xml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<manifest ... >
2+
<application ...>
3+
<!-- Good: both 'android:readPermission' and 'android:writePermission' are set -->
4+
<provider
5+
android:name=".MyContentProvider"
6+
android:authorities="table"
7+
android:enabled="true"
8+
android:exported="true"
9+
android:writePermission="android.permission.MANAGE_DOCUMENTS"
10+
android:readPermission="android.permission.MANAGE_DOCUMENTS">
11+
</provider>
12+
</application>
13+
</manifest>

‎java/ql/src/Security/CWE/CWE-276/ContentProviderIncompletePermissionsWriteOnly.xml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<manifest ... >
2+
<application ...>
3+
<!-- BAD: only 'android:writePermission' is set -->
4+
<provider
5+
android:name=".MyContentProvider"
6+
android:authorities="table"
7+
android:enabled="true"
8+
android:exported="true"
9+
android:writePermission="android.permission.MANAGE_DOCUMENTS">
10+
</provider>
11+
</application>
12+
</manifest>

0 commit comments

Comments
 (0)