Skip to content

Commit 9c12c5f

Browse files
atorralbaatorralba
committed
Remove duplicated models
1 parent f963887 commit 9c12c5f

File tree

3 files changed

+4
-124
lines changed

3 files changed

+4
-124
lines changed

‎java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll

Lines changed: 0 additions & 122 deletions
Original file line numberDiff line numberDiff line change
@@ -39,125 +39,3 @@ private class PendingIntentSentSinkModels extends SinkModelCsv {
3939
]
4040
}
4141
}
42-
43-
// TODO: Remove when https://github.com/github/codeql/pull/6823 gets merged
44-
private class NotificationBuildersSummaryModels extends SummaryModelCsv {
45-
override predicate row(string row) {
46-
row =
47-
[
48-
"android.app;Notification$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
49-
"android.app;Notification$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
50-
"android.app;Notification$Action$Builder;true;Builder;(Icon,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
51-
"android.app;Notification$Action$Builder;true;Builder;(Action);;SyntheticField[android.app.Notification.action] of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
52-
"android.app;Notification$Action$Builder;true;addExtras;;;MapKey of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
53-
"android.app;Notification$Action$Builder;true;addExtras;;;MapValue of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
54-
"android.app;Notification$Action$Builder;true;build;;;SyntheticField[android.app.Notification.action] of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint",
55-
"android.app;Notification$Action$Builder;true;getExtras;;;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
56-
"android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
57-
"android.app;Notification$Builder;true;addAction;(Action);;SyntheticField[android.app.Notification.action] of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
58-
"android.app;Notification$Builder;true;addExtras;;;MapKey of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
59-
"android.app;Notification$Builder;true;addExtras;;;MapValue of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
60-
"android.app;Notification$Builder;true;build;;;SyntheticField[android.app.Notification.action] of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint",
61-
"android.app;Notification$Builder;true;setContentIntent;;;Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
62-
"android.app;Notification$Builder;true;getExtras;;;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
63-
"android.app;Notification$Builder;true;recoverBuilder;;;SyntheticField[android.app.Notification.action] of Argument[1];SyntheticField[android.app.Notification.action] of ReturnValue;taint",
64-
"android.app;Notification$Builder;true;setActions;;;SyntheticField[android.app.Notification.action] of ArrayElement of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
65-
"android.app;Notification$Builder;true;setExtras;;;Argument[0];SyntheticField[android.content.Intent.extras] of Argument[-1];value",
66-
"android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
67-
"android.app;Notification$Builder;true;setPublicVersion;;;SyntheticField[android.app.Notification.action] of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
68-
// Fluent models
69-
"android.app;Notification$Action$Builder;true;" +
70-
[
71-
"addExtras", "addRemoteInput", "extend", "setAllowGeneratedReplies",
72-
"setAuthenticationRequired", "setContextual", "setSemanticAction"
73-
] + ";;;Argument[-1];ReturnValue;value",
74-
"android.app;Notification$Builder;true;" +
75-
[
76-
"addAction", "addExtras", "addPerson", "extend", "setActions", "setAutoCancel",
77-
"setBadgeIconType", "setBubbleMetadata", "setCategory", "setChannelId",
78-
"setChronometerCountDown", "setColor", "setColorized", "setContent", "setContentInfo",
79-
"setContentIntent", "setContentText", "setContentTitle", "setCustomBigContentView",
80-
"setCustomHeadsUpContentView", "setDefaults", "setDeleteIntent", "setExtras", "setFlag",
81-
"setForegroundServiceBehavior", "setFullScreenIntent", "setGroup",
82-
"setGroupAlertBehavior", "setGroupSummary", "setLargeIcon", "setLights", "setLocalOnly",
83-
"setLocusId", "setNumber", "setOngoing", "setOnlyAlertOnce", "setPriority",
84-
"setProgress", "setPublicVersion", "setRemoteInputHistory", "setSettingsText",
85-
"setShortcutId", "setShowWhen", "setSmallIcon", "setSortKey", "setSound", "setStyle",
86-
"setSubText", "setTicker", "setTimeoutAfter", "setUsesChronometer", "setVibrate",
87-
"setVisibility", "setWhen"
88-
] + ";;;Argument[-1];ReturnValue;value"
89-
]
90-
}
91-
}
92-
93-
// TODO: Remove when https://github.com/github/codeql/pull/6801 gets merged
94-
private class SliceBuildersSummaryModels extends SummaryModelCsv {
95-
override predicate row(string row) {
96-
row =
97-
[
98-
"androidx.slice.builders;ListBuilder;true;addAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
99-
"androidx.slice.builders;ListBuilder;true;addGridRow;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
100-
"androidx.slice.builders;ListBuilder;true;addInputRange;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
101-
"androidx.slice.builders;ListBuilder;true;addRange;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
102-
"androidx.slice.builders;ListBuilder;true;addRating;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
103-
"androidx.slice.builders;ListBuilder;true;addRow;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
104-
"androidx.slice.builders;ListBuilder;true;addSelection;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
105-
"androidx.slice.builders;ListBuilder;true;setHeader;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
106-
"androidx.slice.builders;ListBuilder;true;setSeeMoreAction;(PendingIntent);;Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
107-
"androidx.slice.builders;ListBuilder;true;setSeeMoreRow;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
108-
"androidx.slice.builders;ListBuilder;true;build;;;SyntheticField[androidx.slice.Slice.action] of Argument[-1];SyntheticField[androidx.slice.Slice.action] of ReturnValue;taint",
109-
"androidx.slice.builders;ListBuilder$HeaderBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
110-
"androidx.slice.builders;ListBuilder$InputRangeBuilder;true;addEndItem;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
111-
"androidx.slice.builders;ListBuilder$InputRangeBuilder;true;setInputAction;(PendingIntent);;Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
112-
"androidx.slice.builders;ListBuilder$InputRangeBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
113-
"androidx.slice.builders;ListBuilder$RangeBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
114-
"androidx.slice.builders;ListBuilder$RatingBuilder;true;setInputAction;(PendingIntent);;Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
115-
"androidx.slice.builders;ListBuilder$RatingBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
116-
"androidx.slice.builders;ListBuilder$RowBuilder;true;addEndItem;(SliceAction,boolean);;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
117-
"androidx.slice.builders;ListBuilder$RowBuilder;true;addEndItem;(SliceAction);;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
118-
"androidx.slice.builders;ListBuilder$RowBuilder;true;setPrimaryAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
119-
"androidx.slice.builders;ListBuilder$RowBuilder;true;setTitleItem;(SliceAction,boolean);;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
120-
"androidx.slice.builders;ListBuilder$RowBuilder;true;setTitleItem;(SliceAction);;SyntheticField[androidx.slice.Slice.action] of Argument[0];SyntheticField[androidx.slice.Slice.action] of Argument[-1];taint",
121-
"androidx.slice.builders;SliceAction;true;create;(PendingIntent,IconCompat,int,CharSequence);;Argument[0];SyntheticField[androidx.slice.Slice.action] of ReturnValue;taint",
122-
"androidx.slice.builders;SliceAction;true;createDeeplink;(PendingIntent,IconCompat,int,CharSequence);;Argument[0];SyntheticField[androidx.slice.Slice.action] of ReturnValue;taint",
123-
"androidx.slice.builders;SliceAction;true;createToggle;(PendingIntent,CharSequence,boolean);;Argument[0];SyntheticField[androidx.slice.Slice.action] of ReturnValue;taint",
124-
"androidx.slice.builders;SliceAction;true;getAction;;;SyntheticField[androidx.slice.Slice.action] of Argument[-1];ReturnValue;taint",
125-
// Fluent models
126-
"androidx.slice.builders;ListBuilder;true;" +
127-
[
128-
"addAction", "addGridRow", "addInputRange", "addRange", "addRating", "addRow",
129-
"addSelection", "setAccentColor", "setHeader", "setHostExtras", "setIsError",
130-
"setKeywords", "setLayoutDirection", "setSeeMoreAction", "setSeeMoreRow"
131-
] + ";;;Argument[-1];ReturnValue;value",
132-
"androidx.slice.builders;ListBuilder$HeaderBuilder;true;" +
133-
[
134-
"setContentDescription", "setLayoutDirection", "setPrimaryAction", "setSubtitle",
135-
"setSummary", "setTitle"
136-
] + ";;;Argument[-1];ReturnValue;value",
137-
"androidx.slice.builders;ListBuilder$InputRangeBuilder;true;" +
138-
[
139-
"addEndItem", "setContentDescription", "setInputAction", "setLayoutDirection", "setMax",
140-
"setMin", "setPrimaryAction", "setSubtitle", "setThumb", "setTitle", "setTitleItem",
141-
"setValue"
142-
] + ";;;Argument[-1];ReturnValue;value",
143-
"androidx.slice.builders;ListBuilder$RangeBuilder;true;" +
144-
[
145-
"setContentDescription", "setMax", "setMode", "setPrimaryAction", "setSubtitle",
146-
"setTitle", "setTitleItem", "setValue"
147-
] + ";;;Argument[-1];ReturnValue;value",
148-
"androidx.slice.builders;ListBuilder$RatingBuilder;true;" +
149-
[
150-
"setContentDescription", "setInputAction", "setMax", "setMin", "setPrimaryAction",
151-
"setSubtitle", "setTitle", "setTitleItem", "setValue"
152-
] + ";;;Argument[-1];ReturnValue;value",
153-
"androidx.slice.builders;ListBuilder$RowBuilder;true;" +
154-
[
155-
"addEndItem", "setContentDescription", "setEndOfSection", "setLayoutDirection",
156-
"setPrimaryAction", "setSubtitle", "setTitle", "setTitleItem"
157-
] + ";;;Argument[-1];ReturnValue;value",
158-
"androidx.slice.builders;SliceAction;true;" +
159-
["setChecked", "setContentDescription", "setPriority"] +
160-
";;;Argument[-1];ReturnValue;value"
161-
]
162-
}
163-
}

‎java/ql/src/Security/CWE/CWE-927/ImplicitPendingIntents.qhelp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
receiving application if they were not previously set. This means that a mutable <code>PendingIntent</code> that has
1313
not defined a destination component (that is, an implicit <code>PendingIntent</code>) can be altered to execute an
1414
arbitrary action with the privileges of the application that created it.</p>
15-
<p>If an implicit PendingIntent is obtainable by a malicious application by any of the following means:</p>
15+
<p>If an implicit <code>PendingIntent</code> is obtainable by a malicious application by any of the following means:</p>
1616
<ul>
1717
<li>It is wrapped and sent as an extra of another implicit Intent</li>
1818
<li>It is sent as the action of a Slide</li>

‎java/ql/src/Security/CWE/CWE-927/ImplicitPendingIntents.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,6 @@ import DataFlow::PathGraph
1919

2020
from DataFlow::PathNode source, DataFlow::PathNode sink
2121
where any(ImplicitPendingIntentStartConf conf).hasFlowPath(source, sink)
22-
select sink.getNode(), source, sink, "something"
22+
select sink.getNode(), source, sink,
23+
"An implicit and mutable pending Intent is created $@ and sent to an unspecified third party.",
24+
source.getNode(), "here"

0 commit comments

Comments
 (0)