Skip to content

Commit 4be2347

Browse files
smowtonsmowton
committed
Adapt to use the new shared Intent models
1 parent 91d8b3d commit 4be2347

File tree

4 files changed

+55
-48
lines changed

4 files changed

+55
-48
lines changed

‎java/ql/lib/semmle/code/java/frameworks/android/Intent.qll

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,25 +142,33 @@ private class IntentBundleFlowSteps extends SummaryModelCsv {
142142
"android.os;Bundle;true;putStringArrayList;;;Argument[1];MapValue of Argument[-1];value",
143143
"android.os;Bundle;true;readFromParcel;;;Argument[0];MapKey of Argument[-1];taint",
144144
"android.os;Bundle;true;readFromParcel;;;Argument[0];MapValue of Argument[-1];taint",
145-
// currently only the Extras part of the intent is fully modelled
145+
// currently only the Extras part of the intent and the data field are fully modelled
146146
"android.content;Intent;false;Intent;(Intent);;MapKey of SyntheticField[android.content.Intent.extras] of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
147147
"android.content;Intent;false;Intent;(Intent);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
148+
"android.content;Intent;false;Intent;(String,Uri);;Argument[1];MapValue of SyntheticField[android.content.Intent.data] of Argument[-1];value",
149+
"android.content;Intent;false;Intent;(String,Uri,Context,Class);;Argument[1];MapValue of SyntheticField[android.content.Intent.data] of Argument[-1];value",
148150
"android.content;Intent;true;addCategory;;;Argument[-1];ReturnValue;value",
149151
"android.content;Intent;true;addFlags;;;Argument[-1];ReturnValue;value",
152+
"android.content;Intent;false;createChooser;;;Argument[0..2];MapValue of SyntheticField[android.content.Intent.extras] of ReturnValue;value",
150153
"android.content;Intent;true;getBundleExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
151154
"android.content;Intent;true;getByteArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
152155
"android.content;Intent;true;getCharArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
153156
"android.content;Intent;true;getCharSequenceArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
154157
"android.content;Intent;true;getCharSequenceArrayListExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
155158
"android.content;Intent;true;getCharSequenceExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
159+
"android.content;Intent;true;getData;;;SyntheticField[android.content.Intent.data] of Argument[-1];ReturnValue;value",
160+
"android.content;Intent;true;getDataString;;;SyntheticField[android.content.Intent.data] of Argument[-1];ReturnValue;taint",
156161
"android.content;Intent;true;getExtras;();;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
162+
"android.content;Intent;false;getIntent;();;Argument[0];SyntheticField[android.content.Intent.data] of Argument[-1];taint",
163+
"android.content;Intent;false;getIntentOld;();;Argument[0];SyntheticField[android.content.Intent.data] of Argument[-1];taint",
157164
"android.content;Intent;true;getParcelableArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
158165
"android.content;Intent;true;getParcelableArrayListExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
159166
"android.content;Intent;true;getParcelableExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
160167
"android.content;Intent;true;getSerializableExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
161168
"android.content;Intent;true;getStringArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
162169
"android.content;Intent;true;getStringArrayListExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
163170
"android.content;Intent;true;getStringExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
171+
"android.content;Intent;false;parseUri;();;Argument[0];SyntheticField[android.content.Intent.data] of Argument[-1];taint",
164172
"android.content;Intent;true;putCharSequenceArrayListExtra;;;Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
165173
"android.content;Intent;true;putCharSequenceArrayListExtra;;;Argument[1];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
166174
"android.content;Intent;true;putCharSequenceArrayListExtra;;;Argument[-1];ReturnValue;value",
@@ -192,9 +200,13 @@ private class IntentBundleFlowSteps extends SummaryModelCsv {
192200
"android.content;Intent;true;setClassName;;;Argument[-1];ReturnValue;value",
193201
"android.content;Intent;true;setComponent;;;Argument[-1];ReturnValue;value",
194202
"android.content;Intent;true;setData;;;Argument[-1];ReturnValue;value",
203+
"android.content;Intent;true;setData;;;Argument[0];SyntheticField[android.content.Intent.data] of Argument[-1];value",
195204
"android.content;Intent;true;setDataAndNormalize;;;Argument[-1];ReturnValue;value",
205+
"android.content;Intent;true;setDataAndNormalize;;;Argument[0];SyntheticField[android.content.Intent.data] of Argument[-1];value",
196206
"android.content;Intent;true;setDataAndType;;;Argument[-1];ReturnValue;value",
207+
"android.content;Intent;true;setDataAndType;;;Argument[0];SyntheticField[android.content.Intent.data] of Argument[-1];value",
197208
"android.content;Intent;true;setDataAndTypeAndNormalize;;;Argument[-1];ReturnValue;value",
209+
"android.content;Intent;true;setDataAndTypeAndNormalize;;;Argument[0];SyntheticField[android.content.Intent.data] of Argument[-1];value",
198210
"android.content;Intent;true;setFlags;;;Argument[-1];ReturnValue;value",
199211
"android.content;Intent;true;setIdentifier;;;Argument[-1];ReturnValue;value",
200212
"android.content;Intent;true;setPackage;;;Argument[-1];ReturnValue;value",

‎java/ql/src/experimental/Security/CWE/CWE-200/AndroidFileIntentSource.qll

Lines changed: 13 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -28,45 +28,6 @@ class GetContentIntent extends ClassInstanceExpr {
2828
}
2929
}
3030

31-
/** Android intent data model in the new CSV format. */
32-
private class AndroidIntentDataModel extends SummaryModelCsv {
33-
override predicate row(string row) {
34-
row =
35-
[
36-
"android.content;Intent;true;addCategory;;;Argument[-1];ReturnValue;taint",
37-
"android.content;Intent;true;addFlags;;;Argument[-1];ReturnValue;taint",
38-
"android.content;Intent;true;createChooser;;;Argument[0];ReturnValue;taint",
39-
"android.content;Intent;true;getData;;;Argument[-1];ReturnValue;taint",
40-
"android.content;Intent;true;getDataString;;;Argument[-1];ReturnValue;taint",
41-
"android.content;Intent;true;getExtras;;;Argument[-1];ReturnValue;taint",
42-
"android.content;Intent;true;getIntent;;;Argument[-1];ReturnValue;taint",
43-
"android.content;Intent;true;get" +
44-
[
45-
"ParcelableArray", "ParcelableArrayList", "Parcelable", "Serializable", "StringArray",
46-
"StringArrayList", "String"
47-
] + "Extra;;;Argument[-1..1];ReturnValue;taint",
48-
"android.content;Intent;true;put" +
49-
[
50-
"", "CharSequenceArrayList", "IntegerArrayList", "ParcelableArrayList",
51-
"StringArrayList"
52-
] + "Extra;;;Argument[1];Argument[-1];taint",
53-
"android.content;Intent;true;putExtras;;;Argument[1];Argument[-1];taint",
54-
"android.content;Intent;true;setData;;;Argument[0];ReturnValue;taint",
55-
"android.content;Intent;true;setDataAndType;;;Argument[-1];ReturnValue;taint",
56-
"android.content;Intent;true;setFlags;;;Argument[-1];ReturnValue;taint",
57-
"android.content;Intent;true;setType;;;Argument[-1];ReturnValue;taint",
58-
"android.net;Uri;true;getEncodedPath;;;Argument[-1];ReturnValue;taint",
59-
"android.net;Uri;true;getEncodedQuery;;;Argument[-1];ReturnValue;taint",
60-
"android.net;Uri;true;getLastPathSegment;;;Argument[-1];ReturnValue;taint",
61-
"android.net;Uri;true;getPath;;;Argument[-1];ReturnValue;taint",
62-
"android.net;Uri;true;getPathSegments;;;Argument[-1];ReturnValue;taint",
63-
"android.net;Uri;true;getQuery;;;Argument[-1];ReturnValue;taint",
64-
"android.net;Uri;true;getQueryParameter;;;Argument[-1];ReturnValue;taint",
65-
"android.net;Uri;true;getQueryParameters;;;Argument[-1];ReturnValue;taint"
66-
]
67-
}
68-
}
69-
7031
/** Taint configuration for getting content intent. */
7132
class GetContentIntentConfig extends TaintTracking2::Configuration {
7233
GetContentIntentConfig() { this = "GetContentIntentConfig" }
@@ -80,6 +41,19 @@ class GetContentIntentConfig extends TaintTracking2::Configuration {
8041
ma.getMethod() instanceof StartActivityForResultMethod and sink.asExpr() = ma.getArgument(0)
8142
)
8243
}
44+
45+
override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content content) {
46+
super.allowImplicitRead(node, content)
47+
or
48+
// Allow the wrapped intent created by Intent.getChooser to be consumed
49+
// by at the sink:
50+
isSink(node) and
51+
(
52+
content.(DataFlow::SyntheticFieldContent).getField() = "android.content.Intent.extras"
53+
or
54+
content instanceof DataFlow::MapValueContent
55+
)
56+
}
8357
}
8458

8559
/** Android `Intent` input to request file loading. */

‎java/ql/src/experimental/Security/CWE/CWE-200/SensitiveAndroidFileLeak.ql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ import semmle.code.java.controlflow.Guards
1414
import AndroidFileIntentSink
1515
import AndroidFileIntentSource
1616
import DataFlow::PathGraph
17+
// For readStep, to implement `isAdditionalTaintStep`
18+
private import semmle.code.java.dataflow.internal.DataFlowPrivate
1719

1820
private class StartsWithSanitizer extends DataFlow::BarrierGuard {
1921
StartsWithSanitizer() { this.(MethodAccess).getMethod().hasName("startsWith") }
@@ -64,13 +66,19 @@ class AndroidFileLeakConfig extends TaintTracking::Configuration {
6466
)
6567
or
6668
exists(MethodAccess csma, ServiceOnStartCommandMethod ssm, ClassInstanceExpr ce |
69+
// An intent passed to startService will later be passed to the onStartCommand event of the corresponding service
6770
csma.getMethod() instanceof ContextStartServiceMethod and
6871
ce.getConstructedType() instanceof TypeIntent and // Intent intent = new Intent(context, FileUploader.class);
6972
ce.getArgument(1).(TypeLiteral).getReferencedType() = ssm.getDeclaringType() and
7073
DataFlow::localExprFlow(ce, csma.getArgument(0)) and // context.startService(intent);
7174
prev.asExpr() = csma.getArgument(0) and
7275
succ.asParameter() = ssm.getParameter(0) // public int onStartCommand(Intent intent, int flags, int startId) {...} in FileUploader
7376
)
77+
or
78+
// When a whole Intent is tainted (e.g., due to this Configuration's source), treat its fields as tainted
79+
readStep(prev,
80+
any(DataFlow::SyntheticFieldContent c | c.getField().matches("android.content.Intent.%")),
81+
succ)
7482
}
7583

7684
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {

‎java/ql/test/experimental/query-tests/security/CWE-200/SensitiveAndroidFileLeak.expected

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,46 @@
11
edges
22
| FileService.java:20:31:20:43 | intent : Intent | FileService.java:21:28:21:33 | intent : Intent |
33
| FileService.java:20:31:20:43 | intent : Intent | FileService.java:25:42:25:50 | localPath : String |
4-
| FileService.java:21:28:21:33 | intent : Intent | FileService.java:21:28:21:64 | getStringExtra(...) : String |
5-
| FileService.java:21:28:21:64 | getStringExtra(...) : String | FileService.java:25:42:25:50 | localPath : String |
4+
| FileService.java:21:28:21:33 | intent : Intent | FileService.java:21:28:21:64 | getStringExtra(...) : Object |
5+
| FileService.java:21:28:21:64 | getStringExtra(...) : Object | FileService.java:25:42:25:50 | localPath : Object |
66
| FileService.java:25:13:25:51 | makeParamsToExecute(...) : Object[] | FileService.java:40:41:40:55 | params : Object[] |
7+
| FileService.java:25:13:25:51 | makeParamsToExecute(...) [[]] : Object | FileService.java:25:13:25:51 | makeParamsToExecute(...) : Object[] |
78
| FileService.java:25:13:25:51 | makeParamsToExecute(...) [[]] : String | FileService.java:25:13:25:51 | makeParamsToExecute(...) : Object[] |
9+
| FileService.java:25:42:25:50 | localPath : Object | FileService.java:25:13:25:51 | makeParamsToExecute(...) [[]] : Object |
10+
| FileService.java:25:42:25:50 | localPath : Object | FileService.java:32:13:32:28 | sourceUri : Object |
811
| FileService.java:25:42:25:50 | localPath : String | FileService.java:25:13:25:51 | makeParamsToExecute(...) [[]] : String |
912
| FileService.java:25:42:25:50 | localPath : String | FileService.java:32:13:32:28 | sourceUri : String |
13+
| FileService.java:32:13:32:28 | sourceUri : Object | FileService.java:35:17:35:25 | sourceUri : Object |
1014
| FileService.java:32:13:32:28 | sourceUri : String | FileService.java:35:17:35:25 | sourceUri : String |
15+
| FileService.java:34:20:36:13 | {...} [[]] : Object | FileService.java:34:20:36:13 | new Object[] [[]] : Object |
1116
| FileService.java:34:20:36:13 | {...} [[]] : String | FileService.java:34:20:36:13 | new Object[] [[]] : String |
17+
| FileService.java:35:17:35:25 | sourceUri : Object | FileService.java:34:20:36:13 | {...} [[]] : Object |
1218
| FileService.java:35:17:35:25 | sourceUri : String | FileService.java:34:20:36:13 | {...} [[]] : String |
1319
| FileService.java:40:41:40:55 | params : Object[] | FileService.java:44:33:44:52 | (...)... : Object |
1420
| FileService.java:44:33:44:52 | (...)... : Object | FileService.java:45:53:45:59 | ...[...] |
1521
| LeakFileActivity2.java:15:13:15:18 | intent : Intent | LeakFileActivity2.java:16:26:16:31 | intent : Intent |
1622
| LeakFileActivity2.java:16:26:16:31 | intent : Intent | FileService.java:20:31:20:43 | intent : Intent |
1723
| LeakFileActivity.java:14:35:14:38 | data : Intent | LeakFileActivity.java:18:40:18:59 | contentIntent : Intent |
1824
| LeakFileActivity.java:18:40:18:59 | contentIntent : Intent | LeakFileActivity.java:19:31:19:43 | contentIntent : Intent |
19-
| LeakFileActivity.java:19:31:19:43 | contentIntent : Intent | LeakFileActivity.java:19:31:19:53 | getData(...) : Uri |
20-
| LeakFileActivity.java:19:31:19:53 | getData(...) : Uri | LeakFileActivity.java:21:58:21:72 | streamsToUpload : Uri |
21-
| LeakFileActivity.java:21:58:21:72 | streamsToUpload : Uri | LeakFileActivity.java:21:58:21:82 | getPath(...) |
25+
| LeakFileActivity.java:19:31:19:43 | contentIntent : Intent | LeakFileActivity.java:19:31:19:53 | getData(...) : Object |
26+
| LeakFileActivity.java:19:31:19:53 | getData(...) : Object | LeakFileActivity.java:21:58:21:72 | streamsToUpload : Object |
27+
| LeakFileActivity.java:21:58:21:72 | streamsToUpload : Object | LeakFileActivity.java:21:58:21:82 | getPath(...) |
2228
nodes
2329
| FileService.java:20:31:20:43 | intent : Intent | semmle.label | intent : Intent |
2430
| FileService.java:21:28:21:33 | intent : Intent | semmle.label | intent : Intent |
25-
| FileService.java:21:28:21:64 | getStringExtra(...) : String | semmle.label | getStringExtra(...) : String |
31+
| FileService.java:21:28:21:64 | getStringExtra(...) : Object | semmle.label | getStringExtra(...) : Object |
2632
| FileService.java:25:13:25:51 | makeParamsToExecute(...) : Object[] | semmle.label | makeParamsToExecute(...) : Object[] |
33+
| FileService.java:25:13:25:51 | makeParamsToExecute(...) [[]] : Object | semmle.label | makeParamsToExecute(...) [[]] : Object |
2734
| FileService.java:25:13:25:51 | makeParamsToExecute(...) [[]] : String | semmle.label | makeParamsToExecute(...) [[]] : String |
35+
| FileService.java:25:42:25:50 | localPath : Object | semmle.label | localPath : Object |
2836
| FileService.java:25:42:25:50 | localPath : String | semmle.label | localPath : String |
37+
| FileService.java:32:13:32:28 | sourceUri : Object | semmle.label | sourceUri : Object |
2938
| FileService.java:32:13:32:28 | sourceUri : String | semmle.label | sourceUri : String |
39+
| FileService.java:34:20:36:13 | new Object[] [[]] : Object | semmle.label | new Object[] [[]] : Object |
3040
| FileService.java:34:20:36:13 | new Object[] [[]] : String | semmle.label | new Object[] [[]] : String |
41+
| FileService.java:34:20:36:13 | {...} [[]] : Object | semmle.label | {...} [[]] : Object |
3142
| FileService.java:34:20:36:13 | {...} [[]] : String | semmle.label | {...} [[]] : String |
43+
| FileService.java:35:17:35:25 | sourceUri : Object | semmle.label | sourceUri : Object |
3244
| FileService.java:35:17:35:25 | sourceUri : String | semmle.label | sourceUri : String |
3345
| FileService.java:40:41:40:55 | params : Object[] | semmle.label | params : Object[] |
3446
| FileService.java:44:33:44:52 | (...)... : Object | semmle.label | (...)... : Object |
@@ -38,10 +50,11 @@ nodes
3850
| LeakFileActivity.java:14:35:14:38 | data : Intent | semmle.label | data : Intent |
3951
| LeakFileActivity.java:18:40:18:59 | contentIntent : Intent | semmle.label | contentIntent : Intent |
4052
| LeakFileActivity.java:19:31:19:43 | contentIntent : Intent | semmle.label | contentIntent : Intent |
41-
| LeakFileActivity.java:19:31:19:53 | getData(...) : Uri | semmle.label | getData(...) : Uri |
42-
| LeakFileActivity.java:21:58:21:72 | streamsToUpload : Uri | semmle.label | streamsToUpload : Uri |
53+
| LeakFileActivity.java:19:31:19:53 | getData(...) : Object | semmle.label | getData(...) : Object |
54+
| LeakFileActivity.java:21:58:21:72 | streamsToUpload : Object | semmle.label | streamsToUpload : Object |
4355
| LeakFileActivity.java:21:58:21:82 | getPath(...) | semmle.label | getPath(...) |
4456
subpaths
57+
| FileService.java:25:42:25:50 | localPath : Object | FileService.java:32:13:32:28 | sourceUri : Object | FileService.java:34:20:36:13 | new Object[] [[]] : Object | FileService.java:25:13:25:51 | makeParamsToExecute(...) [[]] : Object |
4558
| FileService.java:25:42:25:50 | localPath : String | FileService.java:32:13:32:28 | sourceUri : String | FileService.java:34:20:36:13 | new Object[] [[]] : String | FileService.java:25:13:25:51 | makeParamsToExecute(...) [[]] : String |
4659
#select
4760
| FileService.java:45:53:45:59 | ...[...] | LeakFileActivity2.java:15:13:15:18 | intent : Intent | FileService.java:45:53:45:59 | ...[...] | Leaking arbitrary Android file from $@. | LeakFileActivity2.java:15:13:15:18 | intent | this user input |

0 commit comments

Comments
 (0)