Skip to content

Commit 0919042

Browse files
joefarebrotherjoefarebrother
committed
Model Bundle and Intent extra methods
1 parent f14e3f6 commit 0919042

File tree

2 files changed

+125
-0
lines changed

2 files changed

+125
-0
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ private import FlowSummary
7878
private module Frameworks {
7979
private import internal.ContainerFlow
8080
private import semmle.code.java.frameworks.android.XssSinks
81+
private import semmle.code.java.frameworks.android.Intent
8182
private import semmle.code.java.frameworks.ApacheHttp
8283
private import semmle.code.java.frameworks.apache.Collections
8384
private import semmle.code.java.frameworks.apache.Lang

‎java/ql/lib/semmle/code/java/frameworks/android/Intent.qll

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import java
22
import semmle.code.java.dataflow.FlowSteps
3+
import semmle.code.java.dataflow.ExternalFlow
34

45
class TypeIntent extends Class {
56
TypeIntent() { hasQualifiedName("android.content", "Intent") }
@@ -52,3 +53,126 @@ class BundleGetterMethod extends Method, TaintPreservingCallable {
5253

5354
override predicate returnsTaintFrom(int arg) { arg = -1 }
5455
}
56+
57+
private class IntentBundleFlowSteps extends SummaryModelCsv {
58+
override predicate row(string row) {
59+
row =
60+
[
61+
//"namespace;type;subtypes;name;signature;ext;input;output;kind"
62+
"android.os;BaseBundle;true;get;(String);;MapValue of Argument[-1];ReturnValue;value",
63+
"android.os;BaseBundle;true;getString;(String);;MapValue of Argument[-1];ReturnValue;value",
64+
"android.os;BaseBundle;true;getString;(String,String);;MapValue of Argument[-1];ReturnValue;value",
65+
"android.os;BaseBundle;true;getString;(String,String);;Argument[1];ReturnValue;value",
66+
"android.os;BaseBundle;true;getStringArray;(String);;MapValue of Argument[-1];ReturnValue;value",
67+
"android.os;BaseBundle;true;keySet;();;MapKey of Argument[-1];Element of ReturnValue;value",
68+
"android.os;BaseBundle;true;putAll;(PersistableBundle);;MapKey of Argument[0];MapKey of Argument[-1];value",
69+
"android.os;BaseBundle;true;putAll;(PersistableBundle);;MapValue of Argument[0];MapValue of Argument[-1];value",
70+
"android.os;BaseBundle;true;putBoolean;;;Argument[0];MapKey of Argument[-1];value",
71+
"android.os;BaseBundle;true;putBooleanArray;;;Argument[0];MapKey of Argument[-1];value",
72+
"android.os;BaseBundle;true;putDouble;;;Argument[0];MapKey of Argument[-1];value",
73+
"android.os;BaseBundle;true;putDoubleArray;;;Argument[0];MapKey of Argument[-1];value",
74+
"android.os;BaseBundle;true;putInt;;;Argument[0];MapKey of Argument[-1];value",
75+
"android.os;BaseBundle;true;putIntArray;;;Argument[0];MapKey of Argument[-1];value",
76+
"android.os;BaseBundle;true;putLong;;;Argument[0];MapKey of Argument[-1];value",
77+
"android.os;BaseBundle;true;putLongArray;;;Argument[0];MapKey of Argument[-1];value",
78+
"android.os;BaseBundle;true;putString;;;Argument[0];MapKey of Argument[-1];value",
79+
"android.os;BaseBundle;true;putString;;;Argument[1];MapValue of Argument[-1];value",
80+
"android.os;BaseBundle;true;putStringArray;;;Argument[0];MapKey of Argument[-1];value",
81+
"android.os;BaseBundle;true;putStringArray;;;Argument[1];MapValue of Argument[-1];value",
82+
"android.os;Bundle;true;getBinder;(String);;MapValue of Argument[-1];ReturnValue;value",
83+
"android.os;Bundle;true;getBundle;(String);;MapValue of Argument[-1];ReturnValue;value",
84+
"android.os;Bundle;true;getByteArray;(String);;MapValue of Argument[-1];ReturnValue;value",
85+
"android.os;Bundle;true;getCharArray;(String);;MapValue of Argument[-1];ReturnValue;value",
86+
"android.os;Bundle;true;getCharSequence;(String);;MapValue of Argument[-1];ReturnValue;value",
87+
"android.os;Bundle;true;getCharSequence;(String,CharSequence);;MapValue of Argument[-1];ReturnValue;value",
88+
"android.os;Bundle;true;getCharSequence;(String,CharSequence);;Argument[1];ReturnValue;value",
89+
"android.os;Bundle;true;getCharSequenceArray;(String);;MapValue of Argument[-1];ReturnValue;value",
90+
"android.os;Bundle;true;getCharSequenceArrayList;(String);;MapValue of Argument[-1];ReturnValue;value",
91+
"android.os;Bundle;true;getParcelable;(String);;MapValue of Argument[-1];ReturnValue;value",
92+
"android.os;Bundle;true;getParcelableArray;(String);;MapValue of Argument[-1];ReturnValue;value",
93+
"android.os;Bundle;true;getParcelableArrayList;(String);;MapValue of Argument[-1];ReturnValue;value",
94+
"android.os;Bundle;true;getSerializable;(String);;MapValue of Argument[-1];ReturnValue;value",
95+
"android.os;Bundle;true;getSparseParcelableArray;(String);;MapValue of Argument[-1];ReturnValue;value",
96+
"android.os;Bundle;true;getStringArrayList;(String);;MapValue of Argument[-1];ReturnValue;value",
97+
"android.os;Bundle;true;putAll;(Bundle);;MapKey of Argument[0];MapKey of Argument[-1];value",
98+
"android.os;Bundle;true;putAll;(Bundle);;MapValue of Argument[0];MapValue of Argument[-1];value",
99+
"android.os;Bundle;true;putBinder;;;Argument[0];MapKey of Argument[-1];value",
100+
"android.os;Bundle;true;putBinder;;;Argument[1];MapValue of Argument[-1];value",
101+
"android.os;Bundle;true;putBundle;;;Argument[0];MapKey of Argument[-1];value",
102+
"android.os;Bundle;true;putBundle;;;Argument[1];MapValue of Argument[-1];value",
103+
"android.os;Bundle;true;putByte;;;Argument[0];MapKey of Argument[-1];value",
104+
"android.os;Bundle;true;putByteArray;;;Argument[0];MapKey of Argument[-1];value",
105+
"android.os;Bundle;true;putByteArray;;;Argument[1];MapValue of Argument[-1];value",
106+
"android.os;Bundle;true;putChar;;;Argument[0];MapKey of Argument[-1];value",
107+
"android.os;Bundle;true;putCharArray;;;Argument[0];MapKey of Argument[-1];value",
108+
"android.os;Bundle;true;putCharArray;;;Argument[1];MapValue of Argument[-1];value",
109+
"android.os;Bundle;true;putCharSequence;;;Argument[0];MapKey of Argument[-1];value",
110+
"android.os;Bundle;true;putCharSequence;;;Argument[1];MapValue of Argument[-1];value",
111+
"android.os;Bundle;true;putCharSequenceArray;;;Argument[0];MapKey of Argument[-1];value",
112+
"android.os;Bundle;true;putCharSequenceArray;;;Argument[1];MapValue of Argument[-1];value",
113+
"android.os;Bundle;true;putCharSequenceArrayList;;;Argument[0];MapKey of Argument[-1];value",
114+
"android.os;Bundle;true;putCharSequenceArrayList;;;Argument[1];MapValue of Argument[-1];value",
115+
"android.os;Bundle;true;putFloat;;;Argument[0];MapKey of Argument[-1];value",
116+
"android.os;Bundle;true;putFloatArray;;;Argument[0];MapKey of Argument[-1];value",
117+
"android.os;Bundle;true;putIntegerArrayList;;;Argument[0];MapKey of Argument[-1];value",
118+
"android.os;Bundle;true;putParcelable;;;Argument[0];MapKey of Argument[-1];value",
119+
"android.os;Bundle;true;putParcelable;;;Argument[1];MapValue of Argument[-1];value",
120+
"android.os;Bundle;true;putParcelableArray;;;Argument[0];MapKey of Argument[-1];value",
121+
"android.os;Bundle;true;putParcelableArray;;;Argument[1];MapValue of Argument[-1];value",
122+
"android.os;Bundle;true;putParcelableArrayList;;;Argument[0];MapKey of Argument[-1];value",
123+
"android.os;Bundle;true;putParcelableArrayList;;;Argument[1];MapValue of Argument[-1];value",
124+
"android.os;Bundle;true;putSerializable;;;Argument[0];MapKey of Argument[-1];value",
125+
"android.os;Bundle;true;putSerializable;;;Argument[1];MapValue of Argument[-1];value",
126+
"android.os;Bundle;true;putShort;;;Argument[0];MapKey of Argument[-1];value",
127+
"android.os;Bundle;true;putShortArray;;;Argument[0];MapKey of Argument[-1];value",
128+
"android.os;Bundle;true;putSize;;;Argument[0];MapKey of Argument[-1];value",
129+
"android.os;Bundle;true;putSizeF;;;Argument[0];MapKey of Argument[-1];value",
130+
"android.os;Bundle;true;putSparceParcelableArray;;;Argument[0];MapKey of Argument[-1];value",
131+
"android.os;Bundle;true;putSparseParcelableArray;;;Argument[1];MapValue of Argument[-1];value",
132+
"android.os;Bundle;true;putStringArrayList;;;Argument[0];MapKey of Argument[-1];value",
133+
"android.os;Bundle;true;putStringArrayList;;;Argument[1];MapValue of Argument[-1];value",
134+
"android.os;Bundle;true;readFromParcel;;;Argument[0];MapKey of Argument[-1];taint",
135+
"android.os;Bundle;true;readFromParcel;;;Argument[0];MapValue of Argument[-1];taint",
136+
"android.content;Intent;true;getExtras;();;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
137+
"android.content;Intent;true;getBundleExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
138+
"android.content;Intent;true;getByteArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
139+
"android.content;Intent;true;getCharArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
140+
"android.content;Intent;true;getCharSequenceArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
141+
"android.content;Intent;true;getCharSequenceArrayListExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
142+
"android.content;Intent;true;getCharSequenceExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
143+
"android.content;Intent;true;getParcelableArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
144+
"android.content;Intent;true;getParcelableArrayListExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
145+
"android.content;Intent;true;getParcelableExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
146+
"android.content;Intent;true;getSerializableExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
147+
"android.content;Intent;true;getStringArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
148+
"android.content;Intent;true;getStringArrayListExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
149+
"android.content;Intent;true;getStringExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
150+
"android.content;Intent;true;putCharSequenceArrayListExtra;;;Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
151+
"android.content;Intent;true;putCharSequenceArrayListExtra;;;Argument[1];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
152+
"android.content;Intent;true;putCharSequenceArrayListExtra;;;Argument[-1];ReturnValue;value",
153+
"android.content;Intent;true;putExtra;;;Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
154+
"android.content;Intent;true;putExtra;;;Argument[1];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
155+
"android.content;Intent;true;putExtra;;;Argument[-1];ReturnValue;value",
156+
"android.content;Intent;true;putIntegerArrayListExtra;;;Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
157+
"android.content;Intent;true;putIntegerArrayListExtra;;;Argument[-1];ReturnValue;value",
158+
"android.content;Intent;true;putParcelableArrayListExtra;;;Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
159+
"android.content;Intent;true;putParcelableArrayListExtra;;;Argument[1];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
160+
"android.content;Intent;true;putParcelableArrayListExtra;;;Argument[-1];ReturnValue;value",
161+
"android.content;Intent;true;putStringArrayListExtra;;;Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
162+
"android.content;Intent;true;putStringArrayListExtra;;;Argument[1];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
163+
"android.content;Intent;true;putStringArrayListExtra;;;Argument[-1];ReturnValue;value",
164+
"android.content;Intent;true;putExtras;(Bundle);;MapKey of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
165+
"android.content;Intent;true;putExtras;(Bundle);;MapValue of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
166+
"android.content;Intent;true;putExtras;(Bundle);;Argument[-1];ReturnValue;value",
167+
"android.content;Intent;true;putExtras;(Intent);;MapKey of SyntheticField[android.content.Intent.extras] of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
168+
"android.content;Intent;true;putExtras;(Intent);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
169+
"android.content;Intent;true;putExtras;(Intent);;Argument[-1];ReturnValue;value",
170+
"android.content;Intent;true;replaceExtras;(Bundle);;MapKey of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
171+
"android.content;Intent;true;replaceExtras;(Bundle);;MapValue of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
172+
"android.content;Intent;true;replaceExtras;(Bundle);;Argument[-1];ReturnValue;value",
173+
"android.content;Intent;true;replaceExtras;(Intent);;MapKey of SyntheticField[android.content.Intent.extras] of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
174+
"android.content;Intent;true;replaceExtras;(Intent);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
175+
"android.content;Intent;true;replaceExtras;(Intent);;Argument[-1];ReturnValue;value"
176+
]
177+
}
178+
}

0 commit comments

Comments
 (0)