Skip to content

Commit e0b3a2c

Browse files
committed
Java: convert ArbitraryApkInstallation test to .qlref
1 parent ae36f94 commit e0b3a2c

File tree

6 files changed

+27
-25
lines changed

6 files changed

+27
-25
lines changed

java/ql/test/query-tests/security/CWE-094/ApkInstallationTest.expected

Whitespace-only changes.

java/ql/test/query-tests/security/CWE-094/ApkInstallationTest.ql

Lines changed: 0 additions & 19 deletions
This file was deleted.

java/ql/test/query-tests/security/CWE-094/ApkInstallation.java renamed to java/ql/test/query-tests/security/CWE-094/ApkInstallationTest/ApkInstallation.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,46 +11,46 @@ public class ApkInstallation extends Activity {
1111
public void installAPK(String path) {
1212
// BAD: the path is not checked
1313
Intent intent = new Intent(Intent.ACTION_VIEW);
14-
intent.setDataAndType(Uri.fromFile(new File(path)), "application/vnd.android.package-archive"); // $ hasApkInstallation
14+
intent.setDataAndType(Uri.fromFile(new File(path)), "application/vnd.android.package-archive"); // $ Alert
1515
startActivity(intent);
1616
}
1717

1818
public void installAPK3(String path) {
1919
Intent intent = new Intent(Intent.ACTION_VIEW);
2020
intent.setType(APK_MIMETYPE);
2121
// BAD: the path is not checked
22-
intent.setData(Uri.fromFile(new File(path))); // $ hasApkInstallation
22+
intent.setData(Uri.fromFile(new File(path))); // $ Alert
2323
startActivity(intent);
2424
}
2525

2626
public void installAPKFromExternalStorage(String path) {
2727
// BAD: file is from external storage
2828
File file = new File(Environment.getExternalStorageDirectory(), path);
2929
Intent intent = new Intent(Intent.ACTION_VIEW);
30-
intent.setDataAndType(Uri.fromFile(file), APK_MIMETYPE); // $ hasApkInstallation
30+
intent.setDataAndType(Uri.fromFile(file), APK_MIMETYPE); // $ Alert
3131
startActivity(intent);
3232
}
3333

3434
public void installAPKFromExternalStorageWithActionInstallPackage(String path) {
3535
// BAD: file is from external storage
3636
File file = new File(Environment.getExternalStorageDirectory(), path);
3737
Intent intent = new Intent(Intent.ACTION_INSTALL_PACKAGE);
38-
intent.setData(Uri.fromFile(file)); // $ hasApkInstallation
38+
intent.setData(Uri.fromFile(file)); // $ Alert
3939
startActivity(intent);
4040
}
4141

4242
public void installAPKInstallPackageLiteral(String path) {
4343
File file = new File(Environment.getExternalStorageDirectory(), path);
4444
Intent intent = new Intent("android.intent.action.INSTALL_PACKAGE");
45-
intent.setData(Uri.fromFile(file)); // $ hasApkInstallation
45+
intent.setData(Uri.fromFile(file)); // $ Alert
4646
startActivity(intent);
4747
}
4848

4949
public void otherIntent(File file) {
5050
Intent intent = new Intent(this, OtherActivity.class);
5151
intent.setAction(Intent.ACTION_VIEW);
5252
// BAD: the file is from unknown source
53-
intent.setData(Uri.fromFile(file)); // $ hasApkInstallation
53+
intent.setData(Uri.fromFile(file)); // $ Alert
5454
}
5555
}
5656

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#select
2+
| ApkInstallation.java:14:31:14:58 | fromFile(...) | ApkInstallation.java:14:31:14:58 | fromFile(...) | ApkInstallation.java:14:31:14:58 | fromFile(...) | Arbitrary Android APK installation. |
3+
| ApkInstallation.java:22:24:22:51 | fromFile(...) | ApkInstallation.java:22:24:22:51 | fromFile(...) | ApkInstallation.java:22:24:22:51 | fromFile(...) | Arbitrary Android APK installation. |
4+
| ApkInstallation.java:30:31:30:48 | fromFile(...) | ApkInstallation.java:30:31:30:48 | fromFile(...) | ApkInstallation.java:30:31:30:48 | fromFile(...) | Arbitrary Android APK installation. |
5+
| ApkInstallation.java:38:24:38:41 | fromFile(...) | ApkInstallation.java:38:24:38:41 | fromFile(...) | ApkInstallation.java:38:24:38:41 | fromFile(...) | Arbitrary Android APK installation. |
6+
| ApkInstallation.java:45:24:45:41 | fromFile(...) | ApkInstallation.java:45:24:45:41 | fromFile(...) | ApkInstallation.java:45:24:45:41 | fromFile(...) | Arbitrary Android APK installation. |
7+
| ApkInstallation.java:53:24:53:41 | fromFile(...) | ApkInstallation.java:53:24:53:41 | fromFile(...) | ApkInstallation.java:53:24:53:41 | fromFile(...) | Arbitrary Android APK installation. |
8+
edges
9+
nodes
10+
| ApkInstallation.java:14:31:14:58 | fromFile(...) | semmle.label | fromFile(...) |
11+
| ApkInstallation.java:22:24:22:51 | fromFile(...) | semmle.label | fromFile(...) |
12+
| ApkInstallation.java:30:31:30:48 | fromFile(...) | semmle.label | fromFile(...) |
13+
| ApkInstallation.java:38:24:38:41 | fromFile(...) | semmle.label | fromFile(...) |
14+
| ApkInstallation.java:45:24:45:41 | fromFile(...) | semmle.label | fromFile(...) |
15+
| ApkInstallation.java:53:24:53:41 | fromFile(...) | semmle.label | fromFile(...) |
16+
subpaths
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
query: Security/CWE/CWE-094/ArbitraryApkInstallation.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/validation-api-2.0.1.Final:${testdir}/../../../../stubs/springframework-5.8.x:${testdir}/../../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../../stubs/apache-commons-logging-1.2:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/groovy-all-3.0.7:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/scriptengine:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/apache-freemarker-2.3.31:${testdir}/../../../../stubs/jinjava-2.6.0:${testdir}/../../../../stubs/pebble-3.1.5:${testdir}/../../../../stubs/thymeleaf-3.0.14:${testdir}/../../../../stubs/apache-velocity-2.3:${testdir}/../../../..//stubs/google-android-9.0.0

0 commit comments

Comments
 (0)