Java: add setAllowFileAccess to CrossOriginAccessMethod in WebView.qll

egregius313 · egregius313 · commit 73d6360eee6a · 2022-11-14T15:07:46.000-05:00
Local file access is enabled using the `WebSettings#setAllowFileAccess`
method.
diff --git a/java/ql/lib/semmle/code/java/frameworks/android/WebView.qll b/java/ql/lib/semmle/code/java/frameworks/android/WebView.qll
@@ -45,7 +45,10 @@ class WebViewGetUrlMethod extends Method {
 class CrossOriginAccessMethod extends Method {
   CrossOriginAccessMethod() {
     this.getDeclaringType() instanceof TypeWebSettings and
-    this.hasName(["setAllowUniversalAccessFromFileURLs", "setAllowFileAccessFromFileURLs"])
+    this.hasName([
+        "setAllowFileAccess", "setAllowUniversalAccessFromFileURLs",
+        "setAllowFileAccessFromFileURLs"
+      ])
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,10 @@ class WebViewGetUrlMethod extends Method {`
`45`	`45`	`class CrossOriginAccessMethod extends Method {`
`46`	`46`	`CrossOriginAccessMethod() {`
`47`	`47`	`this.getDeclaringType() instanceof TypeWebSettings and`
`48`		`- this.hasName(["setAllowUniversalAccessFromFileURLs", "setAllowFileAccessFromFileURLs"])`
	`48`	`+ this.hasName([`
	`49`	`+ "setAllowFileAccess", "setAllowUniversalAccessFromFileURLs",`
	`50`	`+ "setAllowFileAccessFromFileURLs"`
	`51`	`+ ])`
`49`	`52`	`}`
`50`	`53`	`}`
`51`	`54`