@@ -20,7 +20,7 @@ import semmle.code.java.dataflow.TaintTracking
20
20
21
21
MethodAccess getClassLoaderReachableMethodAccess ( DataFlow:: Node node )
22
22
{
23
- exists ( MethodCall maGetClassLoader |
23
+ exists ( MethodAccess maGetClassLoader |
24
24
maGetClassLoader .getCallee ( ) .getName ( ) = "getClassLoader" and
25
25
maGetClassLoader .getQualifier ( ) = node .asExpr ( ) and
26
26
result = maGetClassLoader .getControlFlowNode ( ) .getASuccessor + ( )
@@ -44,7 +44,7 @@ MethodAccess getDangerousReachableMethodAccess(MethodAccess ma)
44
44
45
45
module SignaturePackageConfig implements DataFlow:: ConfigSig {
46
46
predicate isSource ( DataFlow:: Node source ) {
47
- exists ( MethodCall maCheckSignatures |
47
+ exists ( MethodAccess maCheckSignatures |
48
48
maCheckSignatures
49
49
.getMethod ( )
50
50
.hasQualifiedName ( "android.content.pm" , "PackageManager" , "checkSignatures" ) and
@@ -70,16 +70,16 @@ predicate isSignaturesChecked(MethodAccess maCreatePackageContext)
70
70
}
71
71
72
72
from
73
- MethodCall maCreatePackageContext , LocalVariableDeclExpr lvdePackageContext ,
74
- Expr sinkPackageContext , MethodCall maGetMethod , MethodCall maInvoke
73
+ MethodAccess maCreatePackageContext , LocalVariableDeclExpr lvdePackageContext ,
74
+ DataFlow :: Node sinkPackageContext , MethodAccess maGetMethod , MethodAccess maInvoke
75
75
where
76
76
maCreatePackageContext
77
77
.getMethod ( )
78
78
.hasQualifiedName ( "android.content" , [ "ContextWrapper" , "Context" ] , "createPackageContext" ) and
79
79
not isSignaturesChecked ( maCreatePackageContext ) and
80
80
lvdePackageContext .getEnclosingStmt ( ) = maCreatePackageContext .getEnclosingStmt ( ) and
81
- TaintTracking:: localExprTaint ( lvdePackageContext .getAnAccess ( ) , sinkPackageContext ) and
82
- getClassLoaderReachableMethodCall ( sinkPackageContext ) = maGetMethod and
83
- getGetMethodMethodCall ( maGetMethod ) = maInvoke
81
+ TaintTracking:: localTaint ( DataFlow :: exprNode ( lvdePackageContext .getAnAccess ( ) ) , sinkPackageContext ) and
82
+ getClassLoaderReachableMethodAccess ( sinkPackageContext ) = maGetMethod and
83
+ getDangerousReachableMethodAccess ( maGetMethod ) = maInvoke
84
84
select maInvoke , "Potential arbitary code execution due to $@ without $@ signature checking." , sinkPackageContext , "class loading" , sinkPackageContext , "package"
85
85
0 commit comments