Skip to content

Commit f9bb004

Browse files
joefarebrotherjoefarebrother
committed
Add sink models to notification builder setters
1 parent cd19a91 commit f9bb004

File tree

4 files changed

+106
-12
lines changed

4 files changed

+106
-12
lines changed

‎java/ql/lib/ext/android.app.model.yml

Lines changed: 49 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,55 @@ extensions:
3838
- ["android.app", "PendingIntent", False, "send", "(Context,int,Intent,PendingIntent$OnFinished,Handler)", "", "Argument[2]", "pending-intents", "manual"]
3939
- ["android.app", "PendingIntent", False, "send", "(Context,int,Intent,PendingIntent$OnFinished,Handler,String)", "", "Argument[2]", "pending-intents", "manual"]
4040
- ["android.app", "PendingIntent", False, "send", "(Context,int,Intent,PendingIntent$OnFinished,Handler,String,Bundle)", "", "Argument[2]", "pending-intents", "manual"]
41-
- ["android.app", "NotificationManager", True, "notify", "(String,int,Notification)", "", "Argument[2]", "notification", "manual"]
42-
- ["android.app", "NotificationManager", True, "notify", "(int,Notification)", "", "Argument[1]", "notification", "manual"]
43-
- ["android.app", "NotificationManager", True, "notifyAsPackage", "(String,String,int,Notification)", "", "Argument[3]", "notification", "manual"]
44-
- ["android.app", "NotificationManager", True, "notifyAsUser", "(String,int,Notification,UserHandle)", "", "Argument[2]", "notification", "manual"]
41+
42+
- ["android.app", "Notification$Action", True, "Action", "(int,CharSequence,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
43+
- ["android.app", "Notification$Action$Builder", True, "Builder", "(Icon,CharSequence,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
44+
- ["android.app", "Notification$Action$Builder", True, "Builder", "(int,CharSequence,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
45+
- ["android.app", "Notification$Action$Builder", True, "addExtras", "(Bundle)", "", "Argument[0]", "notification", "manual"]
46+
- ["android.app", "Notification$BigPictureStyle", True, "setBigContentTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
47+
- ["android.app", "Notification$BigPictureStyle", True, "setContentDescription", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
48+
- ["android.app", "Notification$BigPictureStyle", True, "setSummaryText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
49+
- ["android.app", "Notification$BigTextStyle", True, "bigText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
50+
- ["android.app", "Notification$BigTextStyle", True, "setBigContentTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
51+
- ["android.app", "Notification$BigTextStyle", True, "setContentDescription", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
52+
- ["android.app", "Notification$Builder", True, "addAction", "(int,CharSequence,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
53+
- ["android.app", "Notification$Builder", True, "addExtras", "(Bundle)", "", "Argument[0]", "notification", "manual"]
54+
- ["android.app", "Notification$Builder", True, "setCategory", "(String)", "", "Argument[0]", "notification", "manual"]
55+
- ["android.app", "Notification$Builder", True, "setChannel", "(String)", "", "Argument[0]", "notification", "manual"]
56+
- ["android.app", "Notification$Builder", True, "setContent", "(RemoteViews)", "", "Argument[0]", "notification", "manual"]
57+
- ["android.app", "Notification$Builder", True, "setContentInfo", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
58+
- ["android.app", "Notification$Builder", True, "setContentText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
59+
- ["android.app", "Notification$Builder", True, "setContentTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
60+
- ["android.app", "Notification$Builder", True, "setCustomBigContentView", "(RemoteViews)", "", "Argument[0]", "notification", "manual"]
61+
- ["android.app", "Notification$Builder", True, "setCustomContentView", "(RemoteViews)", "", "Argument[0]", "notification", "manual"]
62+
- ["android.app", "Notification$Builder", True, "setCustomHeadsUpContentView", "(RemoteViews)", "", "Argument[0]", "notification", "manual"]
63+
- ["android.app", "Notification$Builder", True, "setDeleteIntent", "(PendingIntent)", "", "Argument[0]", "notification", "manual"]
64+
- ["android.app", "Notification$Builder", True, "setExtras", "(Bundle)", "", "Argument[0]", "notification", "manual"]
65+
- ["android.app", "Notification$Builder", True, "setGroup", "(String)", "", "Argument[0]", "notification", "manual"]
66+
- ["android.app", "Notification$Builder", True, "setRemoteInputHistory", "(CharSequence[])", "", "Argument[0]", "notification", "manual"]
67+
- ["android.app", "Notification$Builder", True, "setSettingsText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
68+
- ["android.app", "Notification$Builder", True, "setSortKey", "(String)", "", "Argument[0]", "notification", "manual"]
69+
- ["android.app", "Notification$Builder", True, "setSubText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
70+
- ["android.app", "Notification$Builder", True, "setTicker", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
71+
- ["android.app", "Notification$Builder", True, "setTicker", "(CharSequence, RemoteViews)", "", "Argument[0..1]", "notification", "manual"]
72+
- ["android.app", "Notification$CallStyle", True, "forIncomingCall", "(Person,PendingIntent,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
73+
- ["android.app", "Notification$CallStyle", True, "forOngoingCallCall", "(Person,PendingIntent)", "", "Argument[1]", "notification", "manual"]
74+
- ["android.app", "Notification$CallStyle", True, "forScreeningCall", "(Person,PendingIntent,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
75+
- ["android.app", "Notification$CallStyle", True, "setVerificationText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
76+
- ["android.app", "Notification$InboxStyle", True, "addLine", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
77+
- ["android.app", "Notification$InboxStyle", True, "setBigContentTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
78+
- ["android.app", "Notification$InboxStyle", True, "setSummaryText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
79+
- ["android.app", "Notification$MediaStyle", True, "setSummaryText", "(CharSequence,int,PendingIntent)", "", "Argument[0]", "notification", "manual"]
80+
- ["android.app", "Notification$MediaStyle", True, "setSummaryText", "(CharSequence,int,PendingIntent)", "", "Argument[2]", "notification", "manual"]
81+
- ["android.app", "Notification$MessagingStyle", True, "MessagingStyle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
82+
- ["android.app", "Notification$MessagingStyle", True, "addMessage", "(CharSequence,long,CharSequence)", "", "Argument[0]", "notification", "manual"]
83+
- ["android.app", "Notification$MessagingStyle", True, "addMessage", "(CharSequence,long,CharSequence)", "", "Argument[2]", "notification", "manual"]
84+
- ["android.app", "Notification$MessagingStyle", True, "addMessage", "(CharSequence,long,Person)", "", "Argument[0]", "notification", "manual"]
85+
- ["android.app", "Notification$MessagingStyle", True, "setConversationTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
86+
- ["android.app", "Notification$MessagingStyle$Message", True, "Message", "(CharSequence,long,CharSequence)", "", "Argument[0]", "notification", "manual"]
87+
- ["android.app", "Notification$MessagingStyle$Message", True, "Message", "(CharSequence,long,CharSequence)", "", "Argument[2]", "notification", "manual"]
88+
- ["android.app", "Notification$MessagingStyle$Message", True, "Message", "(CharSequence,long,Person)", "", "Argument[0]", "notification", "manual"]
89+
4590
- addsTo:
4691
pack: codeql/java-all
4792
extensible: summaryModel

‎java/ql/lib/ext/androidx.core.app.model.yml

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,54 @@ extensions:
99
- ["androidx.core.app", "AlarmManagerCompat", True, "setExactAndAllowWhileIdle", "", "", "Argument[3]", "pending-intents", "manual"]
1010
- ["androidx.core.app", "NotificationManagerCompat", True, "notify", "(String,int,Notification)", "", "Argument[2]", "pending-intents", "manual"]
1111
- ["androidx.core.app", "NotificationManagerCompat", True, "notify", "(int,Notification)", "", "Argument[1]", "pending-intents", "manual"]
12-
- ["androidx.core.app", "NotificationManagerCompat", True, "notify", "(String,int,Notification)", "", "Argument[2]", "notification", "manual"]
13-
- ["androidx.core.app", "NotificationManagerCompat", True, "notify", "(int,Notification)", "", "Argument[1]", "notification", "manual"]
12+
13+
- ["androidx.core.app", "NotificationCompat$Action", True, "Action", "(int,CharSequence,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
14+
- ["androidx.core.app", "NotificationCompat$Action$Builder", True, "Builder", "(Icon,CharSequence,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
15+
- ["androidx.core.app", "NotificationCompat$Action$Builder", True, "Builder", "(int,CharSequence,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
16+
- ["androidx.core.app", "NotificationCompat$Action$Builder", True, "addExtras", "(Bundle)", "", "Argument[0]", "notification", "manual"]
17+
- ["androidx.core.app", "NotificationCompat$BigPictureStyle", True, "setBigContentTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
18+
- ["androidx.core.app", "NotificationCompat$BigPictureStyle", True, "setContentDescription", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
19+
- ["androidx.core.app", "NotificationCompat$BigPictureStyle", True, "setSummaryText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
20+
- ["androidx.core.app", "NotificationCompat$BigTextStyle", True, "bigText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
21+
- ["androidx.core.app", "NotificationCompat$BigTextStyle", True, "setBigContentTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
22+
- ["androidx.core.app", "NotificationCompat$BigTextStyle", True, "setContentDescription", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
23+
- ["androidx.core.app", "NotificationCompat$Builder", True, "addAction", "(int,CharSequence,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
24+
- ["androidx.core.app", "NotificationCompat$Builder", True, "addExtras", "(Bundle)", "", "Argument[0]", "notification", "manual"]
25+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setCategory", "(String)", "", "Argument[0]", "notification", "manual"]
26+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setChannel", "(String)", "", "Argument[0]", "notification", "manual"]
27+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setContent", "(RemoteViews)", "", "Argument[0]", "notification", "manual"]
28+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setContentInfo", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
29+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setContentText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
30+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setContentTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
31+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setCustomBigContentView", "(RemoteViews)", "", "Argument[0]", "notification", "manual"]
32+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setCustomContentView", "(RemoteViews)", "", "Argument[0]", "notification", "manual"]
33+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setCustomHeadsUpContentView", "(RemoteViews)", "", "Argument[0]", "notification", "manual"]
34+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setDeleteIntent", "(PendingIntent)", "", "Argument[0]", "notification", "manual"]
35+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setExtras", "(Bundle)", "", "Argument[0]", "notification", "manual"]
36+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setGroup", "(String)", "", "Argument[0]", "notification", "manual"]
37+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setRemoteInputHistory", "(CharSequence[])", "", "Argument[0]", "notification", "manual"]
38+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setSettingsText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
39+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setSortKey", "(String)", "", "Argument[0]", "notification", "manual"]
40+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setSubText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
41+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setTicker", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
42+
- ["androidx.core.app", "NotificationCompat$Builder", True, "setTicker", "(CharSequence, RemoteViews)", "", "Argument[0..1]", "notification", "manual"]
43+
- ["androidx.core.app", "NotificationCompat$CallStyle", True, "forIncomingCall", "(Person,PendingIntent,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
44+
- ["androidx.core.app", "NotificationCompat$CallStyle", True, "forOngoingCallCall", "(Person,PendingIntent)", "", "Argument[1]", "notification", "manual"]
45+
- ["androidx.core.app", "NotificationCompat$CallStyle", True, "forScreeningCall", "(Person,PendingIntent,PendingIntent)", "", "Argument[1..2]", "notification", "manual"]
46+
- ["androidx.core.app", "NotificationCompat$CallStyle", True, "setVerificationText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
47+
- ["androidx.core.app", "NotificationCompat$InboxStyle", True, "addLine", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
48+
- ["androidx.core.app", "NotificationCompat$InboxStyle", True, "setBigContentTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
49+
- ["androidx.core.app", "NotificationCompat$InboxStyle", True, "setSummaryText", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
50+
- ["androidx.core.app", "NotificationCompat$MediaStyle", True, "setSummaryText", "(CharSequence,int,PendingIntent)", "", "Argument[0]", "notification", "manual"]
51+
- ["androidx.core.app", "NotificationCompat$MediaStyle", True, "setSummaryText", "(CharSequence,int,PendingIntent)", "", "Argument[2]", "notification", "manual"]
52+
- ["androidx.core.app", "NotificationCompat$MessagingStyle", True, "addMessage", "(CharSequence,long,CharSequence)", "", "Argument[0]", "notification", "manual"]
53+
- ["androidx.core.app", "NotificationCompat$MessagingStyle", True, "addMessage", "(CharSequence,long,CharSequence)", "", "Argument[2]", "notification", "manual"]
54+
- ["androidx.core.app", "NotificationCompat$MessagingStyle", True, "addMessage", "(CharSequence,long,Person)", "", "Argument[0]", "notification", "manual"]
55+
- ["androidx.core.app", "NotificationCompat$MessagingStyle", True, "setConversationTitle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
56+
- ["androidx.core.app", "NotificationCompat$MessagingStyle", True, "MessagingStyle", "(CharSequence)", "", "Argument[0]", "notification", "manual"]
57+
- ["androidx.core.app", "NotificationCompat$MessagingStyle$Message", True, "Message", "(CharSequence,long,CharSequence)", "", "Argument[0]", "notification", "manual"]
58+
- ["androidx.core.app", "NotificationCompat$MessagingStyle$Message", True, "Message", "(CharSequence,long,CharSequence)", "", "Argument[2]", "notification", "manual"]
59+
- ["androidx.core.app", "NotificationCompat$MessagingStyle$Message", True, "Message", "(CharSequence,long,Person)", "", "Argument[0]", "notification", "manual"]
1460
- addsTo:
1561
pack: codeql/java-all
1662
extensible: summaryModel

‎java/ql/lib/semmle/code/java/security/SensitiveUiQuery.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ private import semmle.code.java.security.SensitiveActions
99
private module NotificationTrackingConfig implements DataFlow::ConfigSig {
1010
predicate isSource(DataFlow::Node src) { src.asExpr() instanceof SensitiveExpr }
1111

12-
predicate isSink(DataFlow::Node sink) { sinkNode(sink, "notifications") }
12+
predicate isSink(DataFlow::Node sink) { sinkNode(sink, "notification") }
1313
}
1414

1515
/** Taint tracking flow for sensitive data flowing to system notifications. */

‎java/ql/test/query-tests/security/CWE-200/semmle/tests/SensitiveNotification/Test.java

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
import android.app.Activity;
2+
import android.app.Notification;
23
import androidx.core.app.NotificationCompat;
3-
import androidx.core.app.NotificationManagerCompat;
44

55
class Test extends Activity {
66
void test(String password) {
7-
NotificationManagerCompat manager = NotificationManagerCompat.from(this);
8-
97
NotificationCompat.Builder builder = new NotificationCompat.Builder(this, "");
10-
builder.setContentText(password);
11-
manager.notify(0, builder.build()); // sensitive-notification
8+
builder.setContentText(password); // $sensitive-notification
9+
10+
}
11+
12+
void test2(String password) {
13+
Notification.Builder builder = new Notification.Builder(this, "");
14+
builder.setContentText(password); // $sensitive-notification
1215
}
1316
}

0 commit comments

Comments
 (0)