Skip to content

Commit 8c400d9

Browse files
atorralbaatorralba
committed
Added tests and stubs
1 parent d006db9 commit 8c400d9

18 files changed

+706
-1140
lines changed

‎java/ql/src/semmle/code/java/security/AndroidIntentRedirect.qll

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
import java
2+
private import semmle.code.java.dataflow.DataFlow
3+
private import semmle.code.java.frameworks.android.Intent
4+
5+
abstract class IntentRedirectSink extends DataFlow::Node { }
6+
7+
abstract class IntentRedirectSanitizer extends DataFlow::Node { }
8+
9+
class IntentRedirectAdditionalTaintStep extends Unit {
10+
abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
11+
}
12+
13+
private class DefaultIntentRedirectSink extends IntentRedirectSink {
14+
DefaultIntentRedirectSink() {
15+
exists(MethodAccess ma, Method m |
16+
ma.getMethod() = m and
17+
this.asExpr() = ma.getAnArgument() and
18+
(
19+
this.asExpr().getType() instanceof TypeIntent
20+
or
21+
this.asExpr().getType().(Array).getComponentType() instanceof TypeIntent
22+
)
23+
|
24+
m instanceof StartActivityMethod or
25+
m instanceof StartServiceMethod or
26+
m instanceof SendBroadcastMethod
27+
)
28+
}
29+
}

‎java/ql/src/semmle/code/java/security/AndroidIntentRedirectQuery.qll

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import java
44
import semmle.code.java.dataflow.FlowSources
55
import semmle.code.java.dataflow.TaintTracking
6+
import semmle.code.java.security.AndroidIntentRedirect
67

78
/**
89
* A taint tracking configuration for user-provided Intents being used to start Android components.
@@ -12,13 +13,13 @@ class IntentRedirectConfiguration extends TaintTracking::Configuration {
1213

1314
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
1415

15-
override predicate isSink(DataFlow::Node sink) {
16-
exists(MethodAccess ma |
17-
ma.getMethod() instanceof StartActivityMethod or
18-
ma.getMethod() instanceof StartServiceMethod or
19-
ma.getMethod() instanceof SendBroadcastMethod
20-
|
21-
ma.getArgument(0) = sink.asExpr()
22-
)
16+
override predicate isSink(DataFlow::Node sink) { sink instanceof IntentRedirectSink }
17+
18+
override predicate isSanitizer(DataFlow::Node sanitizer) {
19+
sanitizer instanceof IntentRedirectSanitizer
20+
}
21+
22+
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
23+
any(IntentRedirectAdditionalTaintStep c).step(node1, node2)
2324
}
2425
}

‎java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectTest.expected

Whitespace-only changes.

‎java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectTest.java

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
package com.example.app;
2+
3+
import android.app.Activity;
4+
import android.content.Context;
5+
import android.content.Intent;
6+
import android.os.Bundle;
7+
8+
public class AndroidIntentRedirectTest extends Activity {
9+
AndroidIntentRedirectTest(Context base) {
10+
super(base);
11+
}
12+
13+
public void onCreate(Bundle savedInstanceState) {
14+
{
15+
Intent intent = (Intent) getIntent().getParcelableExtra("forward_intent");
16+
startActivities(new Intent[] {intent}); // $ hasAndroidIntentRedirect
17+
startActivities(new Intent[] {intent}, null); // $ hasAndroidIntentRedirect
18+
startActivity(intent); // $ hasAndroidIntentRedirect
19+
startActivity(intent, null); // $ hasAndroidIntentRedirect
20+
startActivityAsUser(intent, null); // $ hasAndroidIntentRedirect
21+
startActivityAsUser(intent, null, null); // $ hasAndroidIntentRedirect
22+
startActivityAsCaller(intent, null, false, 0); // $ hasAndroidIntentRedirect
23+
startActivityAsUserFromFragment(null, intent, 0, null, null); // $ hasAndroidIntentRedirect
24+
startActivityForResult(intent, 0); // $ hasAndroidIntentRedirect
25+
startActivityForResult(intent, 0, null); // $ hasAndroidIntentRedirect
26+
startActivityForResult(null, intent, 0, null); // $ hasAndroidIntentRedirect
27+
startActivityForResultAsUser(intent, null, 0, null, null); // $ hasAndroidIntentRedirect
28+
startActivityForResultAsUser(intent, 0, null, null); // $ hasAndroidIntentRedirect
29+
startActivityForResultAsUser(intent, 0, null); // $ hasAndroidIntentRedirect
30+
}
31+
{
32+
Intent intent = (Intent) getIntent().getParcelableExtra("forward_intent");
33+
startService(intent); // $ hasAndroidIntentRedirect
34+
startServiceAsUser(intent, null); // $ hasAndroidIntentRedirect
35+
}
36+
{
37+
Intent intent = (Intent) getIntent().getParcelableExtra("forward_intent");
38+
sendBroadcast(intent); // $ hasAndroidIntentRedirect
39+
sendBroadcast(intent, null); // $ hasAndroidIntentRedirect
40+
sendBroadcast(intent, null, null); // $ hasAndroidIntentRedirect
41+
sendBroadcast(intent, null, 0); // $ hasAndroidIntentRedirect
42+
sendBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirect
43+
sendBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirect
44+
sendBroadcastAsUser(intent, null, null, null); // $ hasAndroidIntentRedirect
45+
sendBroadcastAsUser(intent, null, null, 0); // $ hasAndroidIntentRedirect
46+
sendBroadcastAsUserMultiplePermissions(intent, null, null); // $ hasAndroidIntentRedirect
47+
sendStickyBroadcast(intent); // $ hasAndroidIntentRedirect
48+
sendStickyBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirect
49+
sendStickyBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirect
50+
sendStickyOrderedBroadcast(intent, null, null, 0, null, null); // $ hasAndroidIntentRedirect
51+
sendStickyOrderedBroadcastAsUser(intent, null, null, null, 0, null, null); // $ hasAndroidIntentRedirect
52+
}
53+
54+
}
55+
}

‎java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectTest.ql

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import java
2+
import semmle.code.java.security.AndroidIntentRedirectQuery
3+
import TestUtilities.InlineExpectationsTest
4+
5+
class HasAndroidIntentRedirectTest extends InlineExpectationsTest {
6+
HasAndroidIntentRedirectTest() { this = "HasAndroidIntentRedirectTest" }
7+
8+
override string getARelevantTag() { result = "hasAndroidIntentRedirect" }
9+
10+
override predicate hasActualResult(Location location, string element, string tag, string value) {
11+
tag = "hasAndroidIntentRedirect" and
12+
exists(DataFlow::Node src, DataFlow::Node sink, IntentRedirectConfiguration conf |
13+
conf.hasFlow(src, sink)
14+
|
15+
sink.getLocation() = location and
16+
element = sink.toString() and
17+
value = ""
18+
)
19+
}
20+
}

‎java/ql/test/query-tests/security/CWE-940/AndroidManifest.xml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
2+
package="com.example.app"
3+
android:installLocation="auto"
4+
android:versionCode="1"
5+
android:versionName="0.1" >
6+
7+
<application
8+
android:icon="@drawable/ic_launcher"
9+
android:label="@string/app_name"
10+
android:theme="@style/AppTheme" >
11+
<activity
12+
android:name=".AndroidIntentRedirectTest"
13+
android:icon="@drawable/ic_launcher"
14+
android:label="@string/app_name">
15+
<intent-filter>
16+
<action android:name="android.intent.action.MAIN" />
17+
<category android:name="android.intent.category.LAUNCHER" />
18+
</intent-filter>
19+
</activity>
20+
21+
<activity android:name=".SafeActivity" />
22+
</application>
23+
24+
</manifest>

‎java/ql/test/query-tests/security/CWE-940/options

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
// semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/google-android-9.0.0

‎java/ql/test/stubs/google-android-9.0.0/android/annotation/NonNull.java

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/google-android-9.0.0/android/annotation/RequiresPermission.java

Lines changed: 42 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)