Skip to content

Commit b736e37

Browse files
d10cd10c
committed
Java: convert IntentUriPermissionManipulation test to .qlref
1 parent c77875d commit b736e37

File tree

4 files changed

+64
-21
lines changed

4 files changed

+64
-21
lines changed

‎java/ql/test/query-tests/security/CWE-266/IntentUriPermissionManipulationTest.expected

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#select
2+
| MainActivity.java:13:34:13:39 | intent | MainActivity.java:12:29:12:39 | getIntent(...) : Intent | MainActivity.java:13:34:13:39 | intent | This Intent can be set with arbitrary flags from a $@, and used to give access to internal content providers. | MainActivity.java:12:29:12:39 | getIntent(...) | user-provided value |
3+
| MainActivity.java:17:34:17:44 | extraIntent | MainActivity.java:16:43:16:53 | getIntent(...) : Intent | MainActivity.java:17:34:17:44 | extraIntent | This Intent can be set with arbitrary flags from a $@, and used to give access to internal content providers. | MainActivity.java:16:43:16:53 | getIntent(...) | user-provided value |
4+
| MainActivity.java:33:34:33:39 | intent | MainActivity.java:30:29:30:39 | getIntent(...) : Intent | MainActivity.java:33:34:33:39 | intent | This Intent can be set with arbitrary flags from a $@, and used to give access to internal content providers. | MainActivity.java:30:29:30:39 | getIntent(...) | user-provided value |
5+
| MainActivity.java:46:34:46:39 | intent | MainActivity.java:42:29:42:39 | getIntent(...) : Intent | MainActivity.java:46:34:46:39 | intent | This Intent can be set with arbitrary flags from a $@, and used to give access to internal content providers. | MainActivity.java:42:29:42:39 | getIntent(...) | user-provided value |
6+
| MainActivity.java:52:34:52:39 | intent | MainActivity.java:49:29:49:39 | getIntent(...) : Intent | MainActivity.java:52:34:52:39 | intent | This Intent can be set with arbitrary flags from a $@, and used to give access to internal content providers. | MainActivity.java:49:29:49:39 | getIntent(...) | user-provided value |
7+
| MainActivity.java:60:38:60:43 | intent | MainActivity.java:55:29:55:39 | getIntent(...) : Intent | MainActivity.java:60:38:60:43 | intent | This Intent can be set with arbitrary flags from a $@, and used to give access to internal content providers. | MainActivity.java:55:29:55:39 | getIntent(...) | user-provided value |
8+
| MainActivity.java:71:38:71:43 | intent | MainActivity.java:64:29:64:39 | getIntent(...) : Intent | MainActivity.java:71:38:71:43 | intent | This Intent can be set with arbitrary flags from a $@, and used to give access to internal content providers. | MainActivity.java:64:29:64:39 | getIntent(...) | user-provided value |
9+
| MainActivity.java:81:38:81:43 | intent | MainActivity.java:75:29:75:39 | getIntent(...) : Intent | MainActivity.java:81:38:81:43 | intent | This Intent can be set with arbitrary flags from a $@, and used to give access to internal content providers. | MainActivity.java:75:29:75:39 | getIntent(...) | user-provided value |
10+
edges
11+
| MainActivity.java:12:29:12:39 | getIntent(...) : Intent | MainActivity.java:13:34:13:39 | intent | provenance | Sink:MaD:1 |
12+
| MainActivity.java:16:34:16:87 | (...)... : Intent | MainActivity.java:17:34:17:44 | extraIntent | provenance | Sink:MaD:1 |
13+
| MainActivity.java:16:43:16:53 | getIntent(...) : Intent | MainActivity.java:16:43:16:87 | getParcelableExtra(...) : Parcelable | provenance | MaD:2 |
14+
| MainActivity.java:16:43:16:87 | getParcelableExtra(...) : Parcelable | MainActivity.java:16:34:16:87 | (...)... : Intent | provenance | |
15+
| MainActivity.java:30:29:30:39 | getIntent(...) : Intent | MainActivity.java:33:34:33:39 | intent | provenance | Sink:MaD:1 |
16+
| MainActivity.java:42:29:42:39 | getIntent(...) : Intent | MainActivity.java:46:34:46:39 | intent | provenance | Sink:MaD:1 |
17+
| MainActivity.java:49:29:49:39 | getIntent(...) : Intent | MainActivity.java:52:34:52:39 | intent | provenance | Sink:MaD:1 |
18+
| MainActivity.java:55:29:55:39 | getIntent(...) : Intent | MainActivity.java:60:38:60:43 | intent | provenance | Sink:MaD:1 |
19+
| MainActivity.java:64:29:64:39 | getIntent(...) : Intent | MainActivity.java:71:38:71:43 | intent | provenance | Sink:MaD:1 |
20+
| MainActivity.java:75:29:75:39 | getIntent(...) : Intent | MainActivity.java:81:38:81:43 | intent | provenance | Sink:MaD:1 |
21+
models
22+
| 1 | Sink: android.app; Activity; true; setResult; (int,Intent); ; Argument[1]; pending-intents; manual |
23+
| 2 | Summary: android.content; Intent; true; getParcelableExtra; (String); ; Argument[this].SyntheticField[android.content.Intent.extras].MapValue; ReturnValue; value; manual |
24+
nodes
25+
| MainActivity.java:12:29:12:39 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
26+
| MainActivity.java:13:34:13:39 | intent | semmle.label | intent |
27+
| MainActivity.java:16:34:16:87 | (...)... : Intent | semmle.label | (...)... : Intent |
28+
| MainActivity.java:16:43:16:53 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
29+
| MainActivity.java:16:43:16:87 | getParcelableExtra(...) : Parcelable | semmle.label | getParcelableExtra(...) : Parcelable |
30+
| MainActivity.java:17:34:17:44 | extraIntent | semmle.label | extraIntent |
31+
| MainActivity.java:30:29:30:39 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
32+
| MainActivity.java:33:34:33:39 | intent | semmle.label | intent |
33+
| MainActivity.java:42:29:42:39 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
34+
| MainActivity.java:46:34:46:39 | intent | semmle.label | intent |
35+
| MainActivity.java:49:29:49:39 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
36+
| MainActivity.java:52:34:52:39 | intent | semmle.label | intent |
37+
| MainActivity.java:55:29:55:39 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
38+
| MainActivity.java:60:38:60:43 | intent | semmle.label | intent |
39+
| MainActivity.java:64:29:64:39 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
40+
| MainActivity.java:71:38:71:43 | intent | semmle.label | intent |
41+
| MainActivity.java:75:29:75:39 | getIntent(...) : Intent | semmle.label | getIntent(...) : Intent |
42+
| MainActivity.java:81:38:81:43 | intent | semmle.label | intent |
43+
subpaths

‎java/ql/test/query-tests/security/CWE-266/IntentUriPermissionManipulationTest.ql

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎java/ql/test/query-tests/security/CWE-266/IntentUriPermissionManipulationTest.qlref

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
query: Security/CWE/CWE-266/IntentUriPermissionManipulation.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎java/ql/test/query-tests/security/CWE-266/MainActivity.java

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,12 @@ public class MainActivity extends Activity {
99

1010
public void onCreate(Bundle savedInstance) {
1111
{
12-
Intent intent = getIntent();
13-
setResult(RESULT_OK, intent); // $ hasTaintFlow
12+
Intent intent = getIntent(); // $ Source
13+
setResult(RESULT_OK, intent); // $ Alert
1414
}
1515
{
16-
Intent extraIntent = (Intent) getIntent().getParcelableExtra("extraIntent");
17-
setResult(RESULT_OK, extraIntent); // $ hasTaintFlow
16+
Intent extraIntent = (Intent) getIntent().getParcelableExtra("extraIntent"); // $ Source
17+
setResult(RESULT_OK, extraIntent); // $ Alert
1818
}
1919
{
2020
Intent intent = getIntent();
@@ -27,10 +27,10 @@ public void onCreate(Bundle savedInstance) {
2727
setResult(RESULT_OK, intent); // Safe
2828
}
2929
{
30-
Intent intent = getIntent();
30+
Intent intent = getIntent(); // $ Source
3131
intent.setFlags( // Not properly sanitized
3232
Intent.FLAG_GRANT_WRITE_URI_PERMISSION | Intent.FLAG_ACTIVITY_CLEAR_TOP);
33-
setResult(RESULT_OK, intent); // $ hasTaintFlow
33+
setResult(RESULT_OK, intent); // $ Alert
3434
}
3535
{
3636
Intent intent = getIntent();
@@ -39,46 +39,46 @@ public void onCreate(Bundle savedInstance) {
3939
setResult(RESULT_OK, intent); // Safe
4040
}
4141
{
42-
Intent intent = getIntent();
42+
Intent intent = getIntent(); // $ Source
4343
// Combined, the following two calls are a sanitizer
4444
intent.removeFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
4545
intent.removeFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
46-
setResult(RESULT_OK, intent); // $ SPURIOUS: $ hasTaintFlow
46+
setResult(RESULT_OK, intent); // $ SPURIOUS: $ Alert
4747
}
4848
{
49-
Intent intent = getIntent();
49+
Intent intent = getIntent(); // $ Source
5050
intent.removeFlags( // Not properly sanitized
5151
Intent.FLAG_GRANT_WRITE_URI_PERMISSION | Intent.FLAG_ACTIVITY_CLEAR_TOP);
52-
setResult(RESULT_OK, intent); // $ hasTaintFlow
52+
setResult(RESULT_OK, intent); // $ Alert
5353
}
5454
{
55-
Intent intent = getIntent();
55+
Intent intent = getIntent(); // $ Source
5656
// Good check
5757
if (intent.getData().equals(Uri.parse("content://safe/uri"))) {
5858
setResult(RESULT_OK, intent); // Safe
5959
} else {
60-
setResult(RESULT_OK, intent); // $ hasTaintFlow
60+
setResult(RESULT_OK, intent); // $ Alert
6161
}
6262
}
6363
{
64-
Intent intent = getIntent();
64+
Intent intent = getIntent(); // $ Source
6565
int flags = intent.getFlags();
6666
// Good check
6767
if ((flags & Intent.FLAG_GRANT_READ_URI_PERMISSION) == 0
6868
&& (flags & Intent.FLAG_GRANT_WRITE_URI_PERMISSION) == 0) {
6969
setResult(RESULT_OK, intent); // Safe
7070
} else {
71-
setResult(RESULT_OK, intent); // $ hasTaintFlow
71+
setResult(RESULT_OK, intent); // $ Alert
7272
}
7373
}
7474
{
75-
Intent intent = getIntent();
75+
Intent intent = getIntent(); // $ Source
7676
int flags = intent.getFlags();
7777
// Insufficient check
7878
if ((flags & Intent.FLAG_GRANT_READ_URI_PERMISSION) == 0) {
79-
setResult(RESULT_OK, intent); // $ MISSING: $ hasTaintFlow
79+
setResult(RESULT_OK, intent); // $ MISSING: $ Alert
8080
} else {
81-
setResult(RESULT_OK, intent); // $ hasTaintFlow
81+
setResult(RESULT_OK, intent); // $ Alert
8282
}
8383
}
8484
}

0 commit comments

Comments
 (0)