Skip to content

Commit 5e4498a

Browse files
joefarebrotherjoefarebrother
committed
Add more models; fix tests
1 parent 3ae5f13 commit 5e4498a

File tree

4 files changed

+239
-2
lines changed

4 files changed

+239
-2
lines changed

‎java/ql/lib/semmle/code/java/frameworks/android/Intent.qll

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,15 @@ private class IntentBundleFlowSteps extends SummaryModelCsv {
7979
"android.os;BaseBundle;true;putString;;;Argument[1];MapValue of Argument[-1];value",
8080
"android.os;BaseBundle;true;putStringArray;;;Argument[0];MapKey of Argument[-1];value",
8181
"android.os;BaseBundle;true;putStringArray;;;Argument[1];MapValue of Argument[-1];value",
82+
"android.os;Bundle;false;Bundle;(Bundle);;MapKey of Argument[0];MapKey of Argument[-1];value",
83+
"android.os;Bundle;false;Bundle;(Bundle);;MapValue of Argument[0];MapValue of Argument[-1];value",
84+
"android.os;Bundle;false;Bundle;(PersistableBundle);;MapKey of Argument[0];MapKey of Argument[-1];value",
85+
"android.os;Bundle;false;Bundle;(PersistableBundle);;MapValue of Argument[0];MapValue of Argument[-1];value",
86+
"android.os;Bundle;true;clone;();;MapKey of Argument[-1];MapKey of ReturnValue;value",
87+
"android.os;Bundle;true;clone;();;MapValue of Argument[-1];MapValue of ReturnValue;value",
88+
// model for Bundle.deepCopy is not fully precise, as some map values aren't copied by value
89+
"android.os;Bundle;true;deepCopy;();;MapKey of Argument[-1];MapKey of ReturnValue;value",
90+
"android.os;Bundle;true;deepCopy;();;MapValue of Argument[-1];MapValue of ReturnValue;value",
8291
"android.os;Bundle;true;getBinder;(String);;MapValue of Argument[-1];ReturnValue;value",
8392
"android.os;Bundle;true;getBundle;(String);;MapValue of Argument[-1];ReturnValue;value",
8493
"android.os;Bundle;true;getByteArray;(String);;MapValue of Argument[-1];ReturnValue;value",
@@ -133,6 +142,11 @@ private class IntentBundleFlowSteps extends SummaryModelCsv {
133142
"android.os;Bundle;true;putStringArrayList;;;Argument[1];MapValue of Argument[-1];value",
134143
"android.os;Bundle;true;readFromParcel;;;Argument[0];MapKey of Argument[-1];taint",
135144
"android.os;Bundle;true;readFromParcel;;;Argument[0];MapValue of Argument[-1];taint",
145+
// currently only the Extras part of the intent is fully modelled
146+
"android.content;Intent;true;addCategory;;;Argument[-1];ReturnValue;value",
147+
"android.content;Intent;true;addFlags;;;Argument[-1];ReturnValue;value",
148+
"android.content;Intent;false;Intent;(Intent);;MapKey of SyntheticField[android.content.Intent.extras] of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
149+
"android.content;Intent;false;Intent;(Intent);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
136150
"android.content;Intent;true;getExtras;();;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
137151
"android.content;Intent;true;getBundleExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
138152
"android.content;Intent;true;getByteArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
@@ -172,7 +186,20 @@ private class IntentBundleFlowSteps extends SummaryModelCsv {
172186
"android.content;Intent;true;replaceExtras;(Bundle);;Argument[-1];ReturnValue;value",
173187
"android.content;Intent;true;replaceExtras;(Intent);;MapKey of SyntheticField[android.content.Intent.extras] of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
174188
"android.content;Intent;true;replaceExtras;(Intent);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
175-
"android.content;Intent;true;replaceExtras;(Intent);;Argument[-1];ReturnValue;value"
189+
"android.content;Intent;true;replaceExtras;(Intent);;Argument[-1];ReturnValue;value",
190+
"android.content;Intent;true;setAction;;;Argument[-1];ReturnValue;value",
191+
"android.content;Intent;true;setClass;;;Argument[-1];ReturnValue;value",
192+
"android.content;Intent;true;setClassName;;;Argument[-1];ReturnValue;value",
193+
"android.content;Intent;true;setComponent;;;Argument[-1];ReturnValue;value",
194+
"android.content;Intent;true;setData;;;Argument[-1];ReturnValue;value",
195+
"android.content;Intent;true;setDataAndNormalize;;;Argument[-1];ReturnValue;value",
196+
"android.content;Intent;true;setDataAndType;;;Argument[-1];ReturnValue;value",
197+
"android.content;Intent;true;setDataAndTypeAndNormalize;;;Argument[-1];ReturnValue;value",
198+
"android.content;Intent;true;setFlags;;;Argument[-1];ReturnValue;value",
199+
"android.content;Intent;true;setIdentifier;;;Argument[-1];ReturnValue;value",
200+
"android.content;Intent;true;setPackage;;;Argument[-1];ReturnValue;value",
201+
"android.content;Intent;true;setType;;;Argument[-1];ReturnValue;value",
202+
"android.content;Intent;true;setTypeAndNormalize;;;Argument[-1];ReturnValue;value"
176203
]
177204
}
178205
}

‎java/ql/test/library-tests/dataflow/taintsources/remote.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
| IntentSources.java:16:20:16:30 | getIntent(...) | IntentSources.java:16:20:16:52 | getStringExtra(...) |
1515
| IntentSources.java:16:20:16:30 | getIntent(...) | IntentSources.java:17:29:17:35 | trouble |
1616
| IntentSources.java:23:20:23:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/content/Intent.java:1358:19:1358:27 | parameter this |
17+
| IntentSources.java:23:20:23:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/os/BaseBundle.java:600:19:600:27 | [summary] read: <map.value> of argument -1 in getString |
18+
| IntentSources.java:23:20:23:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/os/BaseBundle.java:600:19:600:27 | [summary] to write: return (return) in getString |
1719
| IntentSources.java:23:20:23:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/os/BaseBundle.java:600:19:600:27 | parameter this |
1820
| IntentSources.java:23:20:23:30 | getIntent(...) | IntentSources.java:23:20:23:30 | getIntent(...) |
1921
| IntentSources.java:23:20:23:30 | getIntent(...) | IntentSources.java:23:20:23:42 | getExtras(...) |

‎java/ql/test/library-tests/frameworks/android/intent/Test.java

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package generatedtest;
22

3+
import android.content.Context;
34
import android.content.Intent;
45
import android.os.BaseBundle;
56
import android.os.Bundle;
@@ -27,6 +28,34 @@ void sink(Object o) { }
2728

2829
public void test() throws Exception {
2930

31+
{
32+
// "android.content;Intent;false;Intent;(Intent);;MapKey of SyntheticField[android.content.Intent.extras] of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value"
33+
Intent out = null;
34+
Intent in = (Intent)newWithIntent_extrasDefault(newWithMapKeyDefault(source()));
35+
out = new Intent(in);
36+
sink(getMapKeyDefault(getIntent_extrasDefault(out))); // $ hasValueFlow
37+
}
38+
{
39+
// "android.content;Intent;false;Intent;(Intent);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value"
40+
Intent out = null;
41+
Intent in = (Intent)newWithIntent_extrasDefault(newWithMapValueDefault(source()));
42+
out = new Intent(in);
43+
sink(getMapValueDefault(getIntent_extrasDefault(out))); // $ hasValueFlow
44+
}
45+
{
46+
// "android.content;Intent;true;addCategory;;;Argument[-1];ReturnValue;value"
47+
Intent out = null;
48+
Intent in = (Intent)source();
49+
out = in.addCategory(null);
50+
sink(out); // $ hasValueFlow
51+
}
52+
{
53+
// "android.content;Intent;true;addFlags;;;Argument[-1];ReturnValue;value"
54+
Intent out = null;
55+
Intent in = (Intent)source();
56+
out = in.addFlags(0);
57+
sink(out); // $ hasValueFlow
58+
}
3059
{
3160
// "android.content;Intent;true;getBundleExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value"
3261
Bundle out = null;
@@ -790,6 +819,104 @@ public void test() throws Exception {
790819
out.replaceExtras(in);
791820
sink(getMapValueDefault(getIntent_extrasDefault(out))); // $ hasValueFlow
792821
}
822+
{
823+
// "android.content;Intent;true;setAction;;;Argument[-1];ReturnValue;value"
824+
Intent out = null;
825+
Intent in = (Intent)source();
826+
out = in.setAction(null);
827+
sink(out); // $ hasValueFlow
828+
}
829+
{
830+
// "android.content;Intent;true;setClass;;;Argument[-1];ReturnValue;value"
831+
Intent out = null;
832+
Intent in = (Intent)source();
833+
out = in.setClass(null, null);
834+
sink(out); // $ hasValueFlow
835+
}
836+
{
837+
// "android.content;Intent;true;setClassName;;;Argument[-1];ReturnValue;value"
838+
Intent out = null;
839+
Intent in = (Intent)source();
840+
out = in.setClassName((String)null, (String)null);
841+
sink(out); // $ hasValueFlow
842+
}
843+
{
844+
// "android.content;Intent;true;setClassName;;;Argument[-1];ReturnValue;value"
845+
Intent out = null;
846+
Intent in = (Intent)source();
847+
out = in.setClassName((Context)null, (String)null);
848+
sink(out); // $ hasValueFlow
849+
}
850+
{
851+
// "android.content;Intent;true;setComponent;;;Argument[-1];ReturnValue;value"
852+
Intent out = null;
853+
Intent in = (Intent)source();
854+
out = in.setComponent(null);
855+
sink(out); // $ hasValueFlow
856+
}
857+
{
858+
// "android.content;Intent;true;setData;;;Argument[-1];ReturnValue;value"
859+
Intent out = null;
860+
Intent in = (Intent)source();
861+
out = in.setData(null);
862+
sink(out); // $ hasValueFlow
863+
}
864+
{
865+
// "android.content;Intent;true;setDataAndNormalize;;;Argument[-1];ReturnValue;value"
866+
Intent out = null;
867+
Intent in = (Intent)source();
868+
out = in.setDataAndNormalize(null);
869+
sink(out); // $ hasValueFlow
870+
}
871+
{
872+
// "android.content;Intent;true;setDataAndType;;;Argument[-1];ReturnValue;value"
873+
Intent out = null;
874+
Intent in = (Intent)source();
875+
out = in.setDataAndType(null, null);
876+
sink(out); // $ hasValueFlow
877+
}
878+
{
879+
// "android.content;Intent;true;setDataAndTypeAndNormalize;;;Argument[-1];ReturnValue;value"
880+
Intent out = null;
881+
Intent in = (Intent)source();
882+
out = in.setDataAndTypeAndNormalize(null, null);
883+
sink(out); // $ hasValueFlow
884+
}
885+
{
886+
// "android.content;Intent;true;setFlags;;;Argument[-1];ReturnValue;value"
887+
Intent out = null;
888+
Intent in = (Intent)source();
889+
out = in.setFlags(0);
890+
sink(out); // $ hasValueFlow
891+
}
892+
{
893+
// "android.content;Intent;true;setIdentifier;;;Argument[-1];ReturnValue;value"
894+
Intent out = null;
895+
Intent in = (Intent)source();
896+
out = in.setIdentifier(null);
897+
sink(out); // $ hasValueFlow
898+
}
899+
{
900+
// "android.content;Intent;true;setPackage;;;Argument[-1];ReturnValue;value"
901+
Intent out = null;
902+
Intent in = (Intent)source();
903+
out = in.setPackage(null);
904+
sink(out); // $ hasValueFlow
905+
}
906+
{
907+
// "android.content;Intent;true;setType;;;Argument[-1];ReturnValue;value"
908+
Intent out = null;
909+
Intent in = (Intent)source();
910+
out = in.setType(null);
911+
sink(out); // $ hasValueFlow
912+
}
913+
{
914+
// "android.content;Intent;true;setTypeAndNormalize;;;Argument[-1];ReturnValue;value"
915+
Intent out = null;
916+
Intent in = (Intent)source();
917+
out = in.setTypeAndNormalize(null);
918+
sink(out); // $ hasValueFlow
919+
}
793920
{
794921
// "android.os;BaseBundle;true;get;(String);;MapValue of Argument[-1];ReturnValue;value"
795922
Object out = null;
@@ -931,6 +1058,62 @@ public void test() throws Exception {
9311058
out.putStringArray(null, in);
9321059
sink(getMapValueDefault(out)); // $ hasValueFlow
9331060
}
1061+
{
1062+
// "android.os;Bundle;false;Bundle;(Bundle);;MapKey of Argument[0];MapKey of Argument[-1];value"
1063+
Bundle out = null;
1064+
Bundle in = (Bundle)newWithMapKeyDefault(source());
1065+
out = new Bundle(in);
1066+
sink(getMapKeyDefault(out)); // $ hasValueFlow
1067+
}
1068+
{
1069+
// "android.os;Bundle;false;Bundle;(Bundle);;MapValue of Argument[0];MapValue of Argument[-1];value"
1070+
Bundle out = null;
1071+
Bundle in = (Bundle)newWithMapValueDefault(source());
1072+
out = new Bundle(in);
1073+
sink(getMapValueDefault(out)); // $ hasValueFlow
1074+
}
1075+
{
1076+
// "android.os;Bundle;false;Bundle;(PersistableBundle);;MapKey of Argument[0];MapKey of Argument[-1];value"
1077+
Bundle out = null;
1078+
PersistableBundle in = (PersistableBundle)newWithMapKeyDefault(source());
1079+
out = new Bundle(in);
1080+
sink(getMapKeyDefault(out)); // $ hasValueFlow
1081+
}
1082+
{
1083+
// "android.os;Bundle;false;Bundle;(PersistableBundle);;MapValue of Argument[0];MapValue of Argument[-1];value"
1084+
Bundle out = null;
1085+
PersistableBundle in = (PersistableBundle)newWithMapValueDefault(source());
1086+
out = new Bundle(in);
1087+
sink(getMapValueDefault(out)); // $ hasValueFlow
1088+
}
1089+
{
1090+
// "android.os;Bundle;true;clone;();;MapKey of Argument[-1];MapKey of ReturnValue;value"
1091+
Object out = null;
1092+
Bundle in = (Bundle)newWithMapKeyDefault(source());
1093+
out = in.clone();
1094+
sink(getMapKeyDefault(out)); // $ hasValueFlow
1095+
}
1096+
{
1097+
// "android.os;Bundle;true;clone;();;MapValue of Argument[-1];MapValue of ReturnValue;value"
1098+
Object out = null;
1099+
Bundle in = (Bundle)newWithMapValueDefault(source());
1100+
out = in.clone();
1101+
sink(getMapValueDefault(out)); // $ hasValueFlow
1102+
}
1103+
{
1104+
// "android.os;Bundle;true;deepCopy;();;MapKey of Argument[-1];MapKey of ReturnValue;value"
1105+
Bundle out = null;
1106+
Bundle in = (Bundle)newWithMapKeyDefault(source());
1107+
out = in.deepCopy();
1108+
sink(getMapKeyDefault(out)); // $ hasValueFlow
1109+
}
1110+
{
1111+
// "android.os;Bundle;true;deepCopy;();;MapValue of Argument[-1];MapValue of ReturnValue;value"
1112+
Bundle out = null;
1113+
Bundle in = (Bundle)newWithMapValueDefault(source());
1114+
out = in.deepCopy();
1115+
sink(getMapValueDefault(out)); // $ hasValueFlow
1116+
}
9341117
{
9351118
// "android.os;Bundle;true;getBinder;(String);;MapValue of Argument[-1];ReturnValue;value"
9361119
IBinder out = null;

‎java/ql/test/library-tests/frameworks/android/intent/models.csv

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,14 @@ android.os;BaseBundle;true;putString;;;Argument[0];MapKey of Argument[-1];value
1818
android.os;BaseBundle;true;putString;;;Argument[1];MapValue of Argument[-1];value
1919
android.os;BaseBundle;true;putStringArray;;;Argument[0];MapKey of Argument[-1];value
2020
android.os;BaseBundle;true;putStringArray;;;Argument[1];MapValue of Argument[-1];value
21+
android.os;Bundle;false;Bundle;(Bundle);;MapKey of Argument[0];MapKey of Argument[-1];value
22+
android.os;Bundle;false;Bundle;(Bundle);;MapValue of Argument[0];MapValue of Argument[-1];value
23+
android.os;Bundle;false;Bundle;(PersistableBundle);;MapKey of Argument[0];MapKey of Argument[-1];value
24+
android.os;Bundle;false;Bundle;(PersistableBundle);;MapValue of Argument[0];MapValue of Argument[-1];value
25+
android.os;Bundle;true;clone;();;MapKey of Argument[-1];MapKey of ReturnValue;value
26+
android.os;Bundle;true;clone;();;MapValue of Argument[-1];MapValue of ReturnValue;value
27+
android.os;Bundle;true;deepCopy;();;MapKey of Argument[-1];MapKey of ReturnValue;value
28+
android.os;Bundle;true;deepCopy;();;MapValue of Argument[-1];MapValue of ReturnValue;value
2129
android.os;Bundle;true;getBinder;(String);;MapValue of Argument[-1];ReturnValue;value
2230
android.os;Bundle;true;getBundle;(String);;MapValue of Argument[-1];ReturnValue;value
2331
android.os;Bundle;true;getByteArray;(String);;MapValue of Argument[-1];ReturnValue;value
@@ -72,6 +80,10 @@ android.os;Bundle;true;putStringArrayList;;;Argument[0];MapKey of Argument[-1];v
7280
android.os;Bundle;true;putStringArrayList;;;Argument[1];MapValue of Argument[-1];value
7381
android.os;Bundle;true;readFromParcel;;;Argument[0];MapKey of Argument[-1];taint
7482
android.os;Bundle;true;readFromParcel;;;Argument[0];MapValue of Argument[-1];taint
83+
android.content;Intent;true;addCategory;;;Argument[-1];ReturnValue;value
84+
android.content;Intent;true;addFlags;;;Argument[-1];ReturnValue;value
85+
android.content;Intent;false;Intent;(Intent);;MapKey of SyntheticField[android.content.Intent.extras] of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value
86+
android.content;Intent;false;Intent;(Intent);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value
7587
android.content;Intent;true;getExtras;();;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value
7688
android.content;Intent;true;getBundleExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value
7789
android.content;Intent;true;getByteArrayExtra;(String);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value
@@ -111,4 +123,17 @@ android.content;Intent;true;replaceExtras;(Bundle);;MapValue of Argument[0];MapV
111123
android.content;Intent;true;replaceExtras;(Bundle);;Argument[-1];ReturnValue;value
112124
android.content;Intent;true;replaceExtras;(Intent);;MapKey of SyntheticField[android.content.Intent.extras] of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value
113125
android.content;Intent;true;replaceExtras;(Intent);;MapValue of SyntheticField[android.content.Intent.extras] of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value
114-
android.content;Intent;true;replaceExtras;(Intent);;Argument[-1];ReturnValue;value
126+
android.content;Intent;true;replaceExtras;(Intent);;Argument[-1];ReturnValue;value
127+
android.content;Intent;true;setAction;;;Argument[-1];ReturnValue;value
128+
android.content;Intent;true;setClass;;;Argument[-1];ReturnValue;value
129+
android.content;Intent;true;setClassName;;;Argument[-1];ReturnValue;value
130+
android.content;Intent;true;setComponent;;;Argument[-1];ReturnValue;value
131+
android.content;Intent;true;setData;;;Argument[-1];ReturnValue;value
132+
android.content;Intent;true;setDataAndNormalize;;;Argument[-1];ReturnValue;value
133+
android.content;Intent;true;setDataAndType;;;Argument[-1];ReturnValue;value
134+
android.content;Intent;true;setDataAndTypeAndNormalize;;;Argument[-1];ReturnValue;value
135+
android.content;Intent;true;setFlags;;;Argument[-1];ReturnValue;value
136+
android.content;Intent;true;setIdentifier;;;Argument[-1];ReturnValue;value
137+
android.content;Intent;true;setPackage;;;Argument[-1];ReturnValue;value
138+
android.content;Intent;true;setType;;;Argument[-1];ReturnValue;value
139+
android.content;Intent;true;setTypeAndNormalize;;;Argument[-1];ReturnValue;value

0 commit comments

Comments
 (0)