Remove synthetic fields

atorralba · atorralba · commit c0c40cc05b16 · 2021-12-09T13:34:41.000+01:00
diff --git a/java/ql/lib/semmle/code/java/frameworks/android/Notifications.qll b/java/ql/lib/semmle/code/java/frameworks/android/Notifications.qll
@@ -5,35 +5,30 @@ private import semmle.code.java.dataflow.DataFlow
 private import semmle.code.java.dataflow.ExternalFlow
 private import semmle.code.java.dataflow.FlowSteps
 
-private class NotificationActionsInheritTaint extends DataFlow::SyntheticFieldContent,
-  TaintInheritingContent {
-  NotificationActionsInheritTaint() { this.getField().matches("android.app.Notification.action") }
-}
-
 private class NotificationBuildersSummaryModels extends SummaryModelCsv {
   override predicate row(string row) {
     row =
       [
-        "android.app;Notification$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
-        "android.app;Notification$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
-        "android.app;Notification$Action$Builder;true;Builder;(Icon,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
-        "android.app;Notification$Action$Builder;true;Builder;(Action);;SyntheticField[android.app.Notification.action] of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
+        "android.app;Notification$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint",
+        "android.app;Notification$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint",
+        "android.app;Notification$Action$Builder;true;Builder;(Icon,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint",
+        "android.app;Notification$Action$Builder;true;Builder;(Action);;Argument[0];Argument[-1];taint",
         "android.app;Notification$Action$Builder;true;addExtras;;;MapKey of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
         "android.app;Notification$Action$Builder;true;addExtras;;;MapValue of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
-        "android.app;Notification$Action$Builder;true;build;;;SyntheticField[android.app.Notification.action] of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint",
+        "android.app;Notification$Action$Builder;true;build;;;Argument[-1];ReturnValue;taint",
         "android.app;Notification$Action$Builder;true;getExtras;;;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
-        "android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
-        "android.app;Notification$Builder;true;addAction;(Action);;SyntheticField[android.app.Notification.action] of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
+        "android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint",
+        "android.app;Notification$Builder;true;addAction;(Action);;Argument[0];Argument[-1];taint",
         "android.app;Notification$Builder;true;addExtras;;;MapKey of Argument[0];MapKey of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
         "android.app;Notification$Builder;true;addExtras;;;MapValue of Argument[0];MapValue of SyntheticField[android.content.Intent.extras] of Argument[-1];value",
-        "android.app;Notification$Builder;true;build;;;SyntheticField[android.app.Notification.action] of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint",
-        "android.app;Notification$Builder;true;setContentIntent;;;Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
+        "android.app;Notification$Builder;true;build;;;Argument[-1];ReturnValue;taint",
+        "android.app;Notification$Builder;true;setContentIntent;;;Argument[0];Argument[-1];taint",
         "android.app;Notification$Builder;true;getExtras;;;SyntheticField[android.content.Intent.extras] of Argument[-1];ReturnValue;value",
-        "android.app;Notification$Builder;true;recoverBuilder;;;SyntheticField[android.app.Notification.action] of Argument[1];SyntheticField[android.app.Notification.action] of ReturnValue;taint",
-        "android.app;Notification$Builder;true;setActions;;;SyntheticField[android.app.Notification.action] of ArrayElement of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
+        "android.app;Notification$Builder;true;recoverBuilder;;;Argument[1];ReturnValue;taint",
+        "android.app;Notification$Builder;true;setActions;;;ArrayElement of Argument[0];Argument[-1];taint",
         "android.app;Notification$Builder;true;setExtras;;;Argument[0];SyntheticField[android.content.Intent.extras] of Argument[-1];value",
-        "android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
-        "android.app;Notification$Builder;true;setPublicVersion;;;SyntheticField[android.app.Notification.action] of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint",
+        "android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];Argument[-1];taint",
+        "android.app;Notification$Builder;true;setPublicVersion;;;Argument[0];Argument[-1];taint",
         // Fluent models
         "android.app;Notification$Action$Builder;true;" +
           [
diff --git a/java/ql/test/library-tests/frameworks/android/notification/Test.java b/java/ql/test/library-tests/frameworks/android/notification/Test.java
@@ -42,24 +42,21 @@ void sink(Object o) {}
 	public void test() throws Exception {
 
 		{
-			// "android.app;Notification$Action$Builder;true;Builder;(Action);;SyntheticField[android.app.Notification.action]
-			// of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint"
+			// "android.app;Notification$Action$Builder;true;Builder;(Action);;Argument[0];Argument[-1];taint"
 			Notification.Action.Builder out = null;
 			Notification.Action in = (Notification.Action) source();
 			out = new Notification.Action.Builder(in);
 			sink(out); // $ hasTaintFlow
 		}
 		{
-			// "android.app;Notification$Action$Builder;true;Builder;(Icon,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action]
-			// of Argument[-1];taint"
+			// "android.app;Notification$Action$Builder;true;Builder;(Icon,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint"
 			Notification.Action.Builder out = null;
 			PendingIntent in = (PendingIntent) source();
 			out = new Notification.Action.Builder((Icon) null, (CharSequence) null, in);
 			sink(out); // $ hasTaintFlow
 		}
 		{
-			// "android.app;Notification$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action]
-			// of Argument[-1];taint"
+			// "android.app;Notification$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint"
 			Notification.Action.Builder out = null;
 			PendingIntent in = (PendingIntent) source();
 			out = new Notification.Action.Builder(0, (CharSequence) null, in);
@@ -98,8 +95,7 @@ public void test() throws Exception {
 			sink(out); // $ hasValueFlow
 		}
 		{
-			// "android.app;Notification$Action$Builder;true;build;;;SyntheticField[android.app.Notification.action]
-			// of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint"
+			// "android.app;Notification$Action$Builder;true;build;;;Argument[-1];ReturnValue;taint"
 			Notification.Action out = null;
 			Notification.Action.Builder in = (Notification.Action.Builder) source();
 			out = in.build();
@@ -149,24 +145,21 @@ public void test() throws Exception {
 			sink(out); // $ hasValueFlow
 		}
 		{
-			// "android.app;Notification$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action]
-			// of Argument[-1];taint"
+			// "android.app;Notification$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint"
 			Notification.Action out = null;
 			PendingIntent in = (PendingIntent) source();
 			out = new Notification.Action(0, null, in);
 			sink(out); // $ hasTaintFlow
 		}
 		{
-			// "android.app;Notification$Builder;true;addAction;(Action);;SyntheticField[android.app.Notification.action]
-			// of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint"
+			// "android.app;Notification$Builder;true;addAction;(Action);;Argument[0];Argument[-1];taint"
 			Notification.Builder out = null;
 			Notification.Action in = (Notification.Action) source();
 			out.addAction(in);
 			sink(out); // $ hasTaintFlow
 		}
 		{
-			// "android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action]
-			// of Argument[-1];taint"
+			// "android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint"
 			Notification.Builder out = null;
 			PendingIntent in = (PendingIntent) source();
 			out.addAction(0, null, in);
@@ -224,8 +217,7 @@ public void test() throws Exception {
 			sink(out); // $ hasValueFlow
 		}
 		{
-			// "android.app;Notification$Builder;true;build;;;SyntheticField[android.app.Notification.action]
-			// of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint"
+			// "android.app;Notification$Builder;true;build;;;Argument[-1];ReturnValue;taint"
 			Notification out = null;
 			Notification.Builder in = (Notification.Builder) source();
 			out = in.build();
@@ -247,8 +239,7 @@ public void test() throws Exception {
 			sink(out); // $ hasTaintFlow
 		}
 		{
-			// "android.app;Notification$Builder;true;recoverBuilder;;;SyntheticField[android.app.Notification.action]
-			// of Argument[1];SyntheticField[android.app.Notification.action] of ReturnValue;taint"
+			// "android.app;Notification$Builder;true;recoverBuilder;;;Argument[1];ReturnValue;taint"
 			Notification.Builder out = null;
 			Notification in = (Notification) source();
 			out = Notification.Builder.recoverBuilder(null, in);
@@ -262,8 +253,8 @@ public void test() throws Exception {
 			sink(out); // $ hasValueFlow
 		}
 		{
-			// "android.app;Notification$Builder;true;setActions;;;SyntheticField[android.app.Notification.action]
-			// of ArrayElement of Argument[0];SyntheticField[android.app.Notification.action] of
+			// "android.app;Notification$Builder;true;setActions;;;ArrayElement of
+			// Argument[0];SyntheticField[android.app.Notification.action] of
 			// Argument[-1];taint"
 			Notification.Builder out = null;
 			Notification.Action[] in = (Notification.Action[]) new Notification.Action[] {
@@ -349,8 +340,7 @@ public void test() throws Exception {
 			sink(out); // $ hasValueFlow
 		}
 		{
-			// "android.app;Notification$Builder;true;setContentIntent;;;Argument[0];SyntheticField[android.app.Notification.action]
-			// of Argument[-1];taint"
+			// "android.app;Notification$Builder;true;setContentIntent;;;Argument[0];Argument[-1];taint"
 			Notification.Builder out = null;
 			PendingIntent in = (PendingIntent) source();
 			out.setContentIntent(in);
@@ -399,8 +389,7 @@ public void test() throws Exception {
 			sink(out); // $ hasValueFlow
 		}
 		{
-			// "android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];SyntheticField[android.app.Notification.action]
-			// of Argument[-1];taint"
+			// "android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];Argument[-1];taint"
 			Notification.Builder out = null;
 			PendingIntent in = (PendingIntent) source();
 			out.setDeleteIntent(in);
@@ -541,8 +530,7 @@ public void test() throws Exception {
 			sink(out); // $ hasValueFlow
 		}
 		{
-			// "android.app;Notification$Builder;true;setPublicVersion;;;SyntheticField[android.app.Notification.action]
-			// of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint"
+			// "android.app;Notification$Builder;true;setPublicVersion;;;Argument[0];Argument[-1];taint"
 			Notification.Builder out = null;
 			Notification in = (Notification) source();
 			out.setPublicVersion(in);
diff --git a/java/ql/test/library-tests/frameworks/android/notification/test.ql b/java/ql/test/library-tests/frameworks/android/notification/test.ql
@@ -16,9 +16,6 @@ class NotificationsTaintFlowConf extends DefaultTaintFlowConf {
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
     super.allowImplicitRead(node, c)
     or
-    isSink(node) and
-    c.(DataFlow::SyntheticFieldContent).getField() = "android.app.Notification.action"
-    or
     allowIntentExtrasImplicitRead(node, c)
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -42,24 +42,21 @@ void sink(Object o) {}`
`42`	`42`	`public void test() throws Exception {`
`43`	`43`
`44`	`44`	`{`
`45`		`- // "android.app;Notification$Action$Builder;true;Builder;(Action);;SyntheticField[android.app.Notification.action]`
`46`		`- // of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint"`
	`45`	`+ // "android.app;Notification$Action$Builder;true;Builder;(Action);;Argument[0];Argument[-1];taint"`
`47`	`46`	`Notification.Action.Builder out = null;`
`48`	`47`	`Notification.Action in = (Notification.Action) source();`
`49`	`48`	`out = new Notification.Action.Builder(in);`
`50`	`49`	`sink(out); // $ hasTaintFlow`
`51`	`50`	`}`
`52`	`51`	`{`
`53`		`- // "android.app;Notification$Action$Builder;true;Builder;(Icon,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action]`
`54`		`- // of Argument[-1];taint"`
	`52`	`+ // "android.app;Notification$Action$Builder;true;Builder;(Icon,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint"`
`55`	`53`	`Notification.Action.Builder out = null;`
`56`	`54`	`PendingIntent in = (PendingIntent) source();`
`57`	`55`	`out = new Notification.Action.Builder((Icon) null, (CharSequence) null, in);`
`58`	`56`	`sink(out); // $ hasTaintFlow`
`59`	`57`	`}`
`60`	`58`	`{`
`61`		`- // "android.app;Notification$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action]`
`62`		`- // of Argument[-1];taint"`
	`59`	`+ // "android.app;Notification$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint"`
`63`	`60`	`Notification.Action.Builder out = null;`
`64`	`61`	`PendingIntent in = (PendingIntent) source();`
`65`	`62`	`out = new Notification.Action.Builder(0, (CharSequence) null, in);`
`@@ -98,8 +95,7 @@ public void test() throws Exception {`
`98`	`95`	`sink(out); // $ hasValueFlow`
`99`	`96`	`}`
`100`	`97`	`{`
`101`		`- // "android.app;Notification$Action$Builder;true;build;;;SyntheticField[android.app.Notification.action]`
`102`		`- // of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint"`
	`98`	`+ // "android.app;Notification$Action$Builder;true;build;;;Argument[-1];ReturnValue;taint"`
`103`	`99`	`Notification.Action out = null;`
`104`	`100`	`Notification.Action.Builder in = (Notification.Action.Builder) source();`
`105`	`101`	`out = in.build();`
`@@ -149,24 +145,21 @@ public void test() throws Exception {`
`149`	`145`	`sink(out); // $ hasValueFlow`
`150`	`146`	`}`
`151`	`147`	`{`
`152`		`- // "android.app;Notification$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action]`
`153`		`- // of Argument[-1];taint"`
	`148`	`+ // "android.app;Notification$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint"`
`154`	`149`	`Notification.Action out = null;`
`155`	`150`	`PendingIntent in = (PendingIntent) source();`
`156`	`151`	`out = new Notification.Action(0, null, in);`
`157`	`152`	`sink(out); // $ hasTaintFlow`
`158`	`153`	`}`
`159`	`154`	`{`
`160`		`- // "android.app;Notification$Builder;true;addAction;(Action);;SyntheticField[android.app.Notification.action]`
`161`		`- // of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint"`
	`155`	`+ // "android.app;Notification$Builder;true;addAction;(Action);;Argument[0];Argument[-1];taint"`
`162`	`156`	`Notification.Builder out = null;`
`163`	`157`	`Notification.Action in = (Notification.Action) source();`
`164`	`158`	`out.addAction(in);`
`165`	`159`	`sink(out); // $ hasTaintFlow`
`166`	`160`	`}`
`167`	`161`	`{`
`168`		`- // "android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];SyntheticField[android.app.Notification.action]`
`169`		`- // of Argument[-1];taint"`
	`162`	`+ // "android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint"`
`170`	`163`	`Notification.Builder out = null;`
`171`	`164`	`PendingIntent in = (PendingIntent) source();`
`172`	`165`	`out.addAction(0, null, in);`
`@@ -224,8 +217,7 @@ public void test() throws Exception {`
`224`	`217`	`sink(out); // $ hasValueFlow`
`225`	`218`	`}`
`226`	`219`	`{`
`227`		`- // "android.app;Notification$Builder;true;build;;;SyntheticField[android.app.Notification.action]`
`228`		`- // of Argument[-1];SyntheticField[android.app.Notification.action] of ReturnValue;taint"`
	`220`	`+ // "android.app;Notification$Builder;true;build;;;Argument[-1];ReturnValue;taint"`
`229`	`221`	`Notification out = null;`
`230`	`222`	`Notification.Builder in = (Notification.Builder) source();`
`231`	`223`	`out = in.build();`
`@@ -247,8 +239,7 @@ public void test() throws Exception {`
`247`	`239`	`sink(out); // $ hasTaintFlow`
`248`	`240`	`}`
`249`	`241`	`{`
`250`		`- // "android.app;Notification$Builder;true;recoverBuilder;;;SyntheticField[android.app.Notification.action]`
`251`		`- // of Argument[1];SyntheticField[android.app.Notification.action] of ReturnValue;taint"`
	`242`	`+ // "android.app;Notification$Builder;true;recoverBuilder;;;Argument[1];ReturnValue;taint"`
`252`	`243`	`Notification.Builder out = null;`
`253`	`244`	`Notification in = (Notification) source();`
`254`	`245`	`out = Notification.Builder.recoverBuilder(null, in);`
`@@ -262,8 +253,8 @@ public void test() throws Exception {`
`262`	`253`	`sink(out); // $ hasValueFlow`
`263`	`254`	`}`
`264`	`255`	`{`
`265`		`- // "android.app;Notification$Builder;true;setActions;;;SyntheticField[android.app.Notification.action]`
`266`		`- // of ArrayElement of Argument[0];SyntheticField[android.app.Notification.action] of`
	`256`	`+ // "android.app;Notification$Builder;true;setActions;;;ArrayElement of`
	`257`	`+ // Argument[0];SyntheticField[android.app.Notification.action] of`
`267`	`258`	`// Argument[-1];taint"`
`268`	`259`	`Notification.Builder out = null;`
`269`	`260`	`Notification.Action[] in = (Notification.Action[]) new Notification.Action[] {`
`@@ -349,8 +340,7 @@ public void test() throws Exception {`
`349`	`340`	`sink(out); // $ hasValueFlow`
`350`	`341`	`}`
`351`	`342`	`{`
`352`		`- // "android.app;Notification$Builder;true;setContentIntent;;;Argument[0];SyntheticField[android.app.Notification.action]`
`353`		`- // of Argument[-1];taint"`
	`343`	`+ // "android.app;Notification$Builder;true;setContentIntent;;;Argument[0];Argument[-1];taint"`
`354`	`344`	`Notification.Builder out = null;`
`355`	`345`	`PendingIntent in = (PendingIntent) source();`
`356`	`346`	`out.setContentIntent(in);`
`@@ -399,8 +389,7 @@ public void test() throws Exception {`
`399`	`389`	`sink(out); // $ hasValueFlow`
`400`	`390`	`}`
`401`	`391`	`{`
`402`		`- // "android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];SyntheticField[android.app.Notification.action]`
`403`		`- // of Argument[-1];taint"`
	`392`	`+ // "android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];Argument[-1];taint"`
`404`	`393`	`Notification.Builder out = null;`
`405`	`394`	`PendingIntent in = (PendingIntent) source();`
`406`	`395`	`out.setDeleteIntent(in);`
`@@ -541,8 +530,7 @@ public void test() throws Exception {`
`541`	`530`	`sink(out); // $ hasValueFlow`
`542`	`531`	`}`
`543`	`532`	`{`
`544`		`- // "android.app;Notification$Builder;true;setPublicVersion;;;SyntheticField[android.app.Notification.action]`
`545`		`- // of Argument[0];SyntheticField[android.app.Notification.action] of Argument[-1];taint"`
	`533`	`+ // "android.app;Notification$Builder;true;setPublicVersion;;;Argument[0];Argument[-1];taint"`
`546`	`534`	`Notification.Builder out = null;`
`547`	`535`	`Notification in = (Notification) source();`
`548`	`536`	`out.setPublicVersion(in);`
Original file line number	Diff line number	Diff line change
`@@ -16,9 +16,6 @@ class NotificationsTaintFlowConf extends DefaultTaintFlowConf {`
`16`	`16`	`override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {`
`17`	`17`	`super.allowImplicitRead(node, c)`
`18`	`18`	`or`
`19`		`- isSink(node) and`
`20`		`- c.(DataFlow::SyntheticFieldContent).getField() = "android.app.Notification.action"`
`21`		`- or`
`22`	`19`	`allowIntentExtrasImplicitRead(node, c)`
`23`	`20`	`}`
`24`	`21`	`}`