Skip to content

Commit d1d2d61

Browse files
atorralbaatorralba
committed
Add more sinks
Also, fix things after rebase
1 parent 28ae4c2 commit d1d2d61

File tree

8 files changed

+68
-25
lines changed

8 files changed

+68
-25
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ private module Frameworks {
104104
private import semmle.code.java.frameworks.spring.SpringBeans
105105
private import semmle.code.java.frameworks.spring.SpringWebMultipart
106106
private import semmle.code.java.frameworks.spring.SpringWebUtil
107+
private import semmle.code.java.security.AndroidIntentRedirection
107108
private import semmle.code.java.security.ResponseSplitting
108109
private import semmle.code.java.security.InformationLeak
109110
private import semmle.code.java.security.GroovyInjection

‎java/ql/lib/semmle/code/java/frameworks/android/Intent.qll

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@ class TypeIntent extends Class {
1010
TypeIntent() { hasQualifiedName("android.content", "Intent") }
1111
}
1212

13+
/** The class `android.content.ComponentName`. */
14+
class TypeComponentName extends Class {
15+
TypeComponentName() { this.hasQualifiedName("android.content", "ComponentName") }
16+
}
17+
1318
/**
1419
* The class `android.app.Activity`.
1520
*/
@@ -236,3 +241,35 @@ private class IntentBundleFlowSteps extends SummaryModelCsv {
236241
]
237242
}
238243
}
244+
245+
private class IntentComponentTaintSteps extends SummaryModelCsv {
246+
override predicate row(string s) {
247+
s =
248+
[
249+
"android.content;Intent;true;Intent;(Intent);;Argument[0];Argument[-1];taint",
250+
"android.content;Intent;true;Intent;(Context,Class);;Argument[1];Argument[-1];taint",
251+
"android.content;Intent;true;Intent;(String,Uri,Context,Class);;Argument[3];Argument[-1];taint",
252+
"android.content;Intent;true;setPackage;;;Argument[0];Argument[-1];taint",
253+
"android.content;Intent;true;setPackage;;;Argument[-1];ReturnValue;taint",
254+
"android.content;Intent;true;setClass;;;Argument[1];Argument[-1];taint",
255+
"android.content;Intent;true;setClass;;;Argument[-1];ReturnValue;taint",
256+
"android.content;Intent;true;setClassName;(Context,String);;Argument[1];Argument[-1];taint",
257+
"android.content;Intent;true;setClassName;(String,String);;Argument[0..1];Argument[-1];taint",
258+
"android.content;Intent;true;setClassName;;;Argument[-1];ReturnValue;taint",
259+
"android.content;Intent;true;setComponent;;;Argument[0];Argument[-1];taint",
260+
"android.content;Intent;true;setComponent;;;Argument[-1];ReturnValue;taint",
261+
"android.content;ComponentName;false;ComponentName;(String,String);;Argument[0..1];Argument[-1];taint",
262+
"android.content;ComponentName;false;ComponentName;(Context,String);;Argument[1];Argument[-1];taint",
263+
"android.content;ComponentName;false;ComponentName;(Context,Class);;Argument[1];Argument[-1];taint",
264+
"android.content;ComponentName;false;ComponentName;(Parcel);;Argument[0];Argument[-1];taint",
265+
"android.content;ComponentName;false;createRelative;(String,String);;Argument[0..1];ReturnValue;taint",
266+
"android.content;ComponentName;false;createRelative;(Context,String);;Argument[1];ReturnValue;taint",
267+
"android.content;ComponentName;false;flattenToShortString;;;Argument[-1];ReturnValue;taint",
268+
"android.content;ComponentName;false;flattenToString;;;Argument[-1];ReturnValue;taint",
269+
"android.content;ComponentName;false;getClassName;;;Argument[-1];ReturnValue;taint",
270+
"android.content;ComponentName;false;getPackageName;;;Argument[-1];ReturnValue;taint",
271+
"android.content;ComponentName;false;getShortClassName;;;Argument[-1];ReturnValue;taint",
272+
"android.content;ComponentName;false;unflattenFromString;;;Argument[0];ReturnValue;taint"
273+
]
274+
}
275+
}

‎java/ql/lib/semmle/code/java/security/AndroidIntentRedirection.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ private class DefaultIntentRedirectionSinkModel extends SinkModelCsv {
3232
override predicate row(string row) {
3333
row =
3434
[
35+
"android.app;Activity;true;bindService;;;Argument[0];intent-start",
36+
"android.app;Activity;true;bindServiceAsUser;;;Argument[0];intent-start",
3537
"android.app;Activity;true;startActivityAsCaller;;;Argument[0];intent-start",
3638
"android.app;Activity;true;startActivityForResult;(Intent,int);;Argument[0];intent-start",
3739
"android.app;Activity;true;startActivityForResult;(Intent,int,Bundle);;Argument[0];intent-start",
@@ -43,6 +45,7 @@ private class DefaultIntentRedirectionSinkModel extends SinkModelCsv {
4345
"android.content;Context;true;startActivityFromChild;;;Argument[1];intent-start",
4446
"android.content;Context;true;startActivityFromFragment;;;Argument[1];intent-start",
4547
"android.content;Context;true;startActivityIfNeeded;;;Argument[0];intent-start",
48+
"android.content;Context;true;startForegroundService;;;Argument[0];intent-start",
4649
"android.content;Context;true;startService;;;Argument[0];intent-start",
4750
"android.content;Context;true;startServiceAsUser;;;Argument[0];intent-start",
4851
"android.content;Context;true;sendBroadcast;;;Argument[0];intent-start",

‎java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.java

Lines changed: 16 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -17,28 +17,25 @@ public void onCreate(Bundle savedInstanceState) {
1717
startActivity(intent); // $ hasAndroidIntentRedirection
1818
startActivity(intent, null); // $ hasAndroidIntentRedirection
1919
startActivityAsUser(intent, null); // $ hasAndroidIntentRedirection
20-
startActivityAsUser(intent, null, null); // $ hasAndroidIntentRedirection
2120
startActivityAsCaller(intent, null, false, 0); // $ hasAndroidIntentRedirection
2221
startActivityForResult(intent, 0); // $ hasAndroidIntentRedirection
2322
startActivityForResult(intent, 0, null); // $ hasAndroidIntentRedirection
2423
startActivityForResult(null, intent, 0, null); // $ hasAndroidIntentRedirection
2524
startActivityForResultAsUser(intent, null, 0, null, null); // $ hasAndroidIntentRedirection
2625
startActivityForResultAsUser(intent, 0, null, null); // $ hasAndroidIntentRedirection
2726
startActivityForResultAsUser(intent, 0, null); // $ hasAndroidIntentRedirection
27+
bindService(intent, null, 0);
28+
bindServiceAsUser(intent, null, 0, null);
2829
startService(intent); // $ hasAndroidIntentRedirection
2930
startServiceAsUser(intent, null); // $ hasAndroidIntentRedirection
31+
startForegroundService(intent); // $ hasAndroidIntentRedirection
3032
sendBroadcast(intent); // $ hasAndroidIntentRedirection
3133
sendBroadcast(intent, null); // $ hasAndroidIntentRedirection
32-
sendBroadcast(intent, null, null); // $ hasAndroidIntentRedirection
33-
sendBroadcast(intent, null, 0); // $ hasAndroidIntentRedirection
3434
sendBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirection
3535
sendBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirection
36-
sendBroadcastAsUser(intent, null, null, null); // $ hasAndroidIntentRedirection
37-
sendBroadcastAsUser(intent, null, null, 0); // $ hasAndroidIntentRedirection
3836
sendBroadcastWithMultiplePermissions(intent, null); // $ hasAndroidIntentRedirection
3937
sendStickyBroadcast(intent); // $ hasAndroidIntentRedirection
4038
sendStickyBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirection
41-
sendStickyBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirection
4239
sendStickyOrderedBroadcast(intent, null, null, 0, null, null); // $ hasAndroidIntentRedirection
4340
sendStickyOrderedBroadcastAsUser(intent, null, null, null, 0, null, null); // $ hasAndroidIntentRedirection
4441
// @formatter:on
@@ -63,78 +60,78 @@ public void onCreate(Bundle savedInstanceState) {
6360
}
6461
{
6562
Intent fwdIntent = new Intent();
66-
fwdIntent.setClassName((Context) null, (String) intent.getExtra("className"));
63+
fwdIntent.setClassName((Context) null, intent.getStringExtra("className"));
6764
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
6865
}
6966
{
7067
Intent fwdIntent = new Intent();
71-
fwdIntent.setClassName((String) intent.getExtra("packageName"), null);
68+
fwdIntent.setClassName(intent.getStringExtra("packageName"), null);
7269
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
7370
}
7471
{
7572
Intent fwdIntent = new Intent();
76-
fwdIntent.setClassName((String) intent.getExtra("packageName"),
77-
(String) intent.getExtra("className"));
73+
fwdIntent.setClassName(intent.getStringExtra("packageName"),
74+
intent.getStringExtra("className"));
7875
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
7976
}
8077
{
8178
Intent fwdIntent = new Intent();
82-
fwdIntent.setClass(null, Class.forName((String) intent.getExtra("className")));
79+
fwdIntent.setClass(null, Class.forName(intent.getStringExtra("className")));
8380
// needs taint step for Class.forName
8481
startActivity(fwdIntent); // $ MISSING: $hasAndroidIntentRedirection
8582
}
8683
{
8784
Intent fwdIntent = new Intent();
88-
fwdIntent.setPackage((String) intent.getExtra("packageName"));
85+
fwdIntent.setPackage(intent.getStringExtra("packageName"));
8986
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
9087
}
9188
{
9289
Intent fwdIntent = new Intent();
9390
ComponentName component =
94-
new ComponentName((String) intent.getExtra("packageName"), null);
91+
new ComponentName(intent.getStringExtra("packageName"), null);
9592
fwdIntent.setComponent(component);
9693
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
9794
}
9895
{
9996
Intent fwdIntent = new Intent();
10097
ComponentName component =
101-
new ComponentName("", (String) intent.getExtra("className"));
98+
new ComponentName("", intent.getStringExtra("className"));
10299
fwdIntent.setComponent(component);
103100
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
104101
}
105102
{
106103
Intent fwdIntent = new Intent();
107104
ComponentName component =
108-
new ComponentName((Context) null, (String) intent.getExtra("className"));
105+
new ComponentName((Context) null, intent.getStringExtra("className"));
109106
fwdIntent.setComponent(component);
110107
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
111108
}
112109
{
113110
Intent fwdIntent = new Intent();
114111
ComponentName component = new ComponentName((Context) null,
115-
Class.forName((String) intent.getExtra("className")));
112+
Class.forName(intent.getStringExtra("className")));
116113
fwdIntent.setComponent(component);
117114
// needs taint step for Class.forName
118115
startActivity(fwdIntent); // $ MISSING: $hasAndroidIntentRedirection
119116
}
120117
{
121118
Intent fwdIntent = new Intent();
122119
ComponentName component =
123-
ComponentName.createRelative("", (String) intent.getExtra("className"));
120+
ComponentName.createRelative("", intent.getStringExtra("className"));
124121
fwdIntent.setComponent(component);
125122
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
126123
}
127124
{
128125
Intent fwdIntent = new Intent();
129126
ComponentName component =
130-
ComponentName.createRelative((String) intent.getExtra("packageName"), "");
127+
ComponentName.createRelative(intent.getStringExtra("packageName"), "");
131128
fwdIntent.setComponent(component);
132129
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
133130
}
134131
{
135132
Intent fwdIntent = new Intent();
136133
ComponentName component = ComponentName.createRelative((Context) null,
137-
(String) intent.getExtra("className"));
134+
intent.getStringExtra("className"));
138135
fwdIntent.setComponent(component);
139136
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
140137
}

‎java/ql/test/stubs/google-android-9.0.0/android/app/Activity.java

Lines changed: 1 addition & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/google-android-9.0.0/android/app/Fragment.java

Lines changed: 4 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/google-android-9.0.0/android/content/Context.java

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/ql/test/stubs/google-android-9.0.0/android/content/ContextWrapper.java

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)