Skip to content

Commit 12059a8

Browse files
atorralbaatorralba
committed
Update models to use synthetic fields
1 parent d49e52f commit 12059a8

File tree

2 files changed

+99
-21
lines changed

2 files changed

+99
-21
lines changed

‎java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll

Lines changed: 94 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/** Provides classes and predicates for working with implicit `PendingIntent`s. */
22

33
import java
4+
private import semmle.code.java.dataflow.DataFlow
45
private import semmle.code.java.dataflow.ExternalFlow
6+
private import semmle.code.java.dataflow.FlowSteps
57

68
private class PendingIntentCreationModels extends SinkModelCsv {
79
override predicate row(string row) {
@@ -67,26 +69,26 @@ private class NotificationBuildersSummaryModels extends SummaryModelCsv {
6769
override predicate row(string row) {
6870
row =
6971
[
70-
"android.app;Notification$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint",
71-
"android.app;Notification$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint",
72-
"android.app;Notification$Action$Builder;true;Builder;(Icon,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint",
73-
"android.app;Notification$Action$Builder;true;Builder;(Action);;Argument[0];Argument[-1];taint",
74-
"android.app;Notification$Action$Builder;true;addExtras;;;MapKey of Argument[0];MapKey of SyntheticField[android.app.NotificationActionBuilder.extras] of Argument[-1];value",
75-
"android.app;Notification$Action$Builder;true;addExtras;;;MapValue of Argument[0];MapValue of SyntheticField[android.app.NotificationActionBuilder.extras] of Argument[-1];value",
76-
"android.app;Notification$Action$Builder;true;build;;;Argument[-1];ReturnValue;taint",
77-
"android.app;Notification$Action$Builder;true;getExtras;;;SyntheticField[android.app.NotificationActionBuilder.extras] of Argument[-1];ReturnValue;value",
78-
"android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint",
79-
"android.app;Notification$Builder;true;addAction;(Action);;Argument[0];Argument[-1];taint",
80-
"android.app;Notification$Builder;true;addExtras;;;MapKey of Argument[0];MapKey of SyntheticField[android.app.NotificationBuilder.extras] of Argument[-1];value",
81-
"android.app;Notification$Builder;true;addExtras;;;MapValue of Argument[0];MapValue of SyntheticField[android.app.NotificationBuilder.extras] of Argument[-1];value",
82-
"android.app;Notification$Builder;true;build;;;Argument[-1];ReturnValue;taint",
83-
"android.app;Notification$Builder;true;setContentIntent;;;Argument[0];Argument[-1];taint",
84-
"android.app;Notification$Builder;true;getExtras;;;SyntheticField[android.app.NotificationBuilder.extras] of Argument[-1];ReturnValue;value",
85-
"android.app;Notification$Builder;true;recoverBuilder;;;Argument[1];ReturnValue;taint",
86-
"android.app;Notification$Builder;true;setActions;;;ArrayElement of Argument[0];Argument[-1];taint",
87-
"android.app;Notification$Builder;true;setExtras;;;Argument[0];SyntheticField[android.app.NotificationBuilder.extras] of Argument[-1];value",
88-
"android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];Argument[-1];taint",
89-
"android.app;Notification$Builder;true;setPublicVersion;;;Argument[0];Argument[-1];taint",
72+
"android.app;Notification$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
73+
"android.app;Notification$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
74+
"android.app;Notification$Action$Builder;true;Builder;(Icon,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
75+
"android.app;Notification$Action$Builder;true;Builder;(Action);;SyntheticField[android.app.Notification.action] of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
76+
"android.app;Notification$Action$Builder;true;addExtras;;;MapKey of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
77+
"android.app;Notification$Action$Builder;true;addExtras;;;MapValue of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
78+
"android.app;Notification$Action$Builder;true;build;;;SyntheticField[android.app.Notification.action] of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint",
79+
"android.app;Notification$Action$Builder;true;getExtras;;;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
80+
"android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
81+
"android.app;Notification$Builder;true;addAction;(Action);;SyntheticField[android.app.Notification.action] of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
82+
"android.app;Notification$Builder;true;addExtras;;;MapKey of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
83+
"android.app;Notification$Builder;true;addExtras;;;MapValue of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
84+
"android.app;Notification$Builder;true;build;;;SyntheticField[android.app.Notification.action] of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint",
85+
"android.app;Notification$Builder;true;setContentIntent;;;Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
86+
"android.app;Notification$Builder;true;getExtras;;;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
87+
"android.app;Notification$Builder;true;recoverBuilder;;;SyntheticField[android.app.Notification.action] of Argument[1];SyntheticField[android.app.Notification.action] of ReturnValue;taint",
88+
"android.app;Notification$Builder;true;setActions;;;SyntheticField[android.app.Notification.action] of ArrayElement of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
89+
"android.app;Notification$Builder;true;setExtras;;;Argument[0];SyntheticField[android.content.Intent.extras] of Argument[-1];value",
90+
"android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
91+
"android.app;Notification$Builder;true;setPublicVersion;;;SyntheticField[android.app.Notification.action] of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
9092
// Fluent models
9193
"android.app;Notification$Action$Builder;true;" +
9294
[
@@ -111,3 +113,75 @@ private class NotificationBuildersSummaryModels extends SummaryModelCsv {
111113
]
112114
}
113115
}
116+
117+
// TODO: Remove when https://github.com/github/codeql/pull/6801 gets merged
118+
private class SliceBuildersSummaryModels extends SummaryModelCsv {
119+
override predicate row(string row) {
120+
row =
121+
[
122+
"androidx.slice.builders;ListBuilder;true;addAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
123+
"androidx.slice.builders;ListBuilder;true;addGridRow;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
124+
"androidx.slice.builders;ListBuilder;true;addInputRange;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
125+
"androidx.slice.builders;ListBuilder;true;addRange;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
126+
"androidx.slice.builders;ListBuilder;true;addRating;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
127+
"androidx.slice.builders;ListBuilder;true;addRow;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
128+
"androidx.slice.builders;ListBuilder;true;addSelection;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
129+
"androidx.slice.builders;ListBuilder;true;setHeader;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
130+
"androidx.slice.builders;ListBuilder;true;setSeeMoreAction;(PendingIntent);;Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
131+
"androidx.slice.builders;ListBuilder;true;setSeeMoreRow;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
132+
"androidx.slice.builders;ListBuilder;true;build;;;SyntheticField[androidx.slice.Slice.action] of Argument[-1];SyntheticField[androidx.slice.Slice.action] of ReturnValue;taint",
133+
"androidx.slice.builders;ListBuilder$HeaderBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
134+
"androidx.slice.builders;ListBuilder$InputRangeBuilder;true;addEndItem;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
135+
"androidx.slice.builders;ListBuilder$InputRangeBuilder;true;setInputAction;(PendingIntent);;Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
136+
"androidx.slice.builders;ListBuilder$InputRangeBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
137+
"androidx.slice.builders;ListBuilder$RangeBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
138+
"androidx.slice.builders;ListBuilder$RatingBuilder;true;setInputAction;(PendingIntent);;Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
139+
"androidx.slice.builders;ListBuilder$RatingBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
140+
"androidx.slice.builders;ListBuilder$RowBuilder;true;addEndItem;(SliceAction,boolean);;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
141+
"androidx.slice.builders;ListBuilder$RowBuilder;true;addEndItem;(SliceAction);;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
142+
"androidx.slice.builders;ListBuilder$RowBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
143+
"androidx.slice.builders;ListBuilder$RowBuilder;true;setTitleItem;(SliceAction,boolean);;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
144+
"androidx.slice.builders;ListBuilder$RowBuilder;true;setTitleItem;(SliceAction);;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
145+
"androidx.slice.builders;SliceAction;true;create;(PendingIntent,IconCompat,int,CharSequence);;Argument[0];SyntheticField[androidx.slice.Slice.action] of ReturnValue;taint",
146+
"androidx.slice.builders;SliceAction;true;createDeeplink;(PendingIntent,IconCompat,int,CharSequence);;Argument[0];SyntheticField[androidx.slice.Slice.action] of ReturnValue;taint",
147+
"androidx.slice.builders;SliceAction;true;createToggle;(PendingIntent,CharSequence,boolean);;Argument[0];SyntheticField[androidx.slice.Slice.action] of ReturnValue;taint",
148+
"androidx.slice.builders;SliceAction;true;getAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[-1];ReturnValue;taint",
149+
// Fluent models
150+
"androidx.slice.builders;ListBuilder;true;" +
151+
[
152+
"addAction", "addGridRow", "addInputRange", "addRange", "addRating", "addRow",
153+
"addSelection", "setAccentColor", "setHeader", "setHostExtras", "setIsError",
154+
"setKeywords", "setLayoutDirection", "setSeeMoreAction", "setSeeMoreRow"
155+
] + ";;;Argument[-1];ReturnValue;value",
156+
"androidx.slice.builders;ListBuilder$HeaderBuilder;true;" +
157+
[
158+
"setContentDescription", "setLayoutDirection", "setPrimaryAction", "setSubtitle",
159+
"setSummary", "setTitle"
160+
] + ";;;Argument[-1];ReturnValue;value",
161+
"androidx.slice.builders;ListBuilder$InputRangeBuilder;true;" +
162+
[
163+
"addEndItem", "setContentDescription", "setInputAction", "setLayoutDirection", "setMax",
164+
"setMin", "setPrimaryAction", "setSubtitle", "setThumb", "setTitle", "setTitleItem",
165+
"setValue"
166+
] + ";;;Argument[-1];ReturnValue;value",
167+
"androidx.slice.builders;ListBuilder$RangeBuilder;true;" +
168+
[
169+
"setContentDescription", "setMax", "setMode", "setPrimaryAction", "setSubtitle",
170+
"setTitle", "setTitleItem", "setValue"
171+
] + ";;;Argument[-1];ReturnValue;value",
172+
"androidx.slice.builders;ListBuilder$RatingBuilder;true;" +
173+
[
174+
"setContentDescription", "setInputAction", "setMax", "setMin", "setPrimaryAction",
175+
"setSubtitle", "setTitle", "setTitleItem", "setValue"
176+
] + ";;;Argument[-1];ReturnValue;value",
177+
"androidx.slice.builders;ListBuilder$RowBuilder;true;" +
178+
[
179+
"addEndItem", "setContentDescription", "setEndOfSection", "setLayoutDirection",
180+
"setPrimaryAction", "setSubtitle", "setTitle", "setTitleItem"
181+
] + ";;;Argument[-1];ReturnValue;value",
182+
"androidx.slice.builders;SliceAction;true;" +
183+
["setChecked", "setContentDescription", "setPriority"] +
184+
";;;Argument[-1];ReturnValue;value"
185+
]
186+
}
187+
}

‎java/ql/lib/semmle/code/java/security/ImplicitPendingIntentsQuery.qll

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,11 @@ class ImplicitPendingIntentStartConf extends TaintTracking::Configuration {
3636
super.allowImplicitRead(node, c)
3737
or
3838
this.isSink(node) and
39-
allowIntentExtrasImplicitRead(node, c)
39+
(
40+
allowIntentExtrasImplicitRead(node, c) or
41+
c.(DataFlow::SyntheticFieldContent).getField() =
42+
["android.app.Notification.action", "androidx.slice.Slice.action"]
43+
)
4044
or
4145
this.isAdditionalTaintStep(node, _) and
4246
c.(DataFlow::FieldContent).getType() instanceof PendingIntent

0 commit comments

Comments
 (0)