Merge pull request #6685 from smowton/smowton/admin/android-uri-model

Java: Add models for android.net.Uri[.Builder]

java/change-notes/2021-09-13-android-uri.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added taint-propagating models for Android's Uri class and its nested Builder class. This means that new data-flow alerts may be raised where those classes are involved.

java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

@@ -110,6 +110,7 @@ private module Frameworks {
   private import semmle.code.java.security.MvelInjection
   private import semmle.code.java.security.OgnlInjection
   private import semmle.code.java.security.XPath
+  private import semmle.code.java.frameworks.android.Android
   private import semmle.code.java.frameworks.android.SQLite
   private import semmle.code.java.frameworks.Jdbc
   private import semmle.code.java.frameworks.SpringJdbc

java/ql/lib/semmle/code/java/frameworks/android/Android.qll

@@ -3,6 +3,7 @@
  */
 
 import java
+import semmle.code.java.dataflow.ExternalFlow
 import semmle.code.xml.AndroidManifest
 
 /**
@@ -79,3 +80,71 @@ class AndroidContentResolver extends AndroidComponent {
     this.getASupertype*().hasQualifiedName("android.content", "ContentResolver")
   }
 }
+
+private class UriModel extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "android.net;Uri;true;buildUpon;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;false;decode;;;Argument[0];ReturnValue;taint",
+        "android.net;Uri;false;encode;;;Argument[0];ReturnValue;taint",
+        "android.net;Uri;false;fromFile;;;Argument[0];ReturnValue;taint",
+        "android.net;Uri;false;fromParts;;;Argument[0..2];ReturnValue;taint",
+        "android.net;Uri;true;getAuthority;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getEncodedAuthority;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getEncodedFragment;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getEncodedPath;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getEncodedQuery;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getEncodedSchemeSpecificPart;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getEncodedUserInfo;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getFragment;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getHost;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getLastPathSegment;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getPath;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getPathSegments;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getQuery;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getQueryParameter;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getQueryParameterNames;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getQueryParameters;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getScheme;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getSchemeSpecificPart;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;getUserInfo;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;true;normalizeScheme;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;false;parse;;;Argument[0];ReturnValue;taint",
+        "android.net;Uri;true;toString;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri;false;withAppendedPath;;;Argument[0..1];ReturnValue;taint",
+        "android.net;Uri;false;writeToParcel;;;Argument[1];Argument[0];taint",
+        "android.net;Uri$Builder;false;appendEncodedPath;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;appendEncodedPath;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;appendPath;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;appendPath;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;appendQueryParameter;;;Argument[0..1];Argument[-1];taint",
+        "android.net;Uri$Builder;false;appendQueryParameter;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;authority;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;authority;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;build;;;Argument[-1];ReturnValue;taint",
+        "android.net;Uri$Builder;false;clearQuery;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;encodedAuthority;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;encodedAuthority;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;encodedFragment;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;encodedFragment;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;encodedOpaquePart;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;encodedOpaquePart;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;encodedPath;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;encodedPath;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;encodedQuery;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;encodedQuery;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;fragment;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;fragment;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;opaquePart;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;opaquePart;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;path;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;path;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;query;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;query;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;scheme;;;Argument[0];Argument[-1];taint",
+        "android.net;Uri$Builder;false;scheme;;;Argument[-1];ReturnValue;value",
+        "android.net;Uri$Builder;false;toString;;;Argument[-1];ReturnValue;taint"
+      ]
+  }
+}

java/ql/test/library-tests/frameworks/android/uri/Test.java

@@ -0,0 +1,475 @@
+package generatedtest;
+
+import android.net.Uri;
+import android.os.Parcel;
+import java.io.File;
+import java.util.List;
+import java.util.Set;
+
+// Test case generated by GenerateFlowTestCase.ql
+public class Test {
+
+	Object source() { return null; }
+	void sink(Object o) { }
+
+	public void test() throws Exception {
+
+		{
+			// "android.net;Uri$Builder;true;appendEncodedPath;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.appendEncodedPath(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;appendEncodedPath;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.appendEncodedPath(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;appendPath;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.appendPath(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;appendPath;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.appendPath(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;appendQueryParameter;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.appendQueryParameter(null, null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;appendQueryParameter;;;Argument[0..1];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.appendQueryParameter(null, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;appendQueryParameter;;;Argument[0..1];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.appendQueryParameter(in, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;authority;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.authority(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;authority;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.authority(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;build;;;Argument[-1];ReturnValue;taint"
+			Uri out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.build();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;clearQuery;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.clearQuery();
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedAuthority;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.encodedAuthority(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedAuthority;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.encodedAuthority(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedFragment;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.encodedFragment(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedFragment;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.encodedFragment(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedOpaquePart;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.encodedOpaquePart(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedOpaquePart;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.encodedOpaquePart(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedPath;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.encodedPath(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedPath;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.encodedPath(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedQuery;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.encodedQuery(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;encodedQuery;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.encodedQuery(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;fragment;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.fragment(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;fragment;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.fragment(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;opaquePart;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.opaquePart(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;opaquePart;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.opaquePart(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;path;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.path(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;path;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.path(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;query;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.query(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;query;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.query(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;scheme;;;Argument[-1];ReturnValue;value"
+			Uri.Builder out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.scheme(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;scheme;;;Argument[0];Argument[-1];taint"
+			Uri.Builder out = null;
+			String in = (String)source();
+			out.scheme(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri$Builder;true;toString;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri.Builder in = (Uri.Builder)source();
+			out = in.toString();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;decode;;;Argument[0];ReturnValue;taint"
+			String out = null;
+			String in = (String)source();
+			out = Uri.decode(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;encode;;;Argument[0];ReturnValue;taint"
+			String out = null;
+			String in = (String)source();
+			out = Uri.encode(in, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;encode;;;Argument[0];ReturnValue;taint"
+			String out = null;
+			String in = (String)source();
+			out = Uri.encode(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;fromFile;;;Argument[0];ReturnValue;taint"
+			Uri out = null;
+			File in = (File)source();
+			out = Uri.fromFile(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;fromParts;;;Argument[0..2];ReturnValue;taint"
+			Uri out = null;
+			String in = (String)source();
+			out = Uri.fromParts(null, null, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;fromParts;;;Argument[0..2];ReturnValue;taint"
+			Uri out = null;
+			String in = (String)source();
+			out = Uri.fromParts(null, in, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;fromParts;;;Argument[0..2];ReturnValue;taint"
+			Uri out = null;
+			String in = (String)source();
+			out = Uri.fromParts(in, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;parse;;;Argument[0];ReturnValue;taint"
+			Uri out = null;
+			String in = (String)source();
+			out = Uri.parse(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;withAppendedPath;;;Argument[0..1];ReturnValue;taint"
+			Uri out = null;
+			Uri in = (Uri)source();
+			out = Uri.withAppendedPath(in, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;withAppendedPath;;;Argument[0..1];ReturnValue;taint"
+			Uri out = null;
+			String in = (String)source();
+			out = Uri.withAppendedPath(null, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;false;writeToParcel;;;Argument[1];Argument[0];taint"
+			Parcel out = null;
+			Uri in = (Uri)source();
+			Uri.writeToParcel(out, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;buildUpon;;;Argument[-1];ReturnValue;taint"
+			Uri.Builder out = null;
+			Uri in = (Uri)source();
+			out = in.buildUpon();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getAuthority;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getAuthority();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getEncodedAuthority;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getEncodedAuthority();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getEncodedFragment;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getEncodedFragment();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getEncodedPath;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getEncodedPath();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getEncodedQuery;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getEncodedQuery();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getEncodedSchemeSpecificPart;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getEncodedSchemeSpecificPart();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getEncodedUserInfo;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getEncodedUserInfo();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getFragment;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getFragment();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getHost;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getHost();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getLastPathSegment;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getLastPathSegment();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getPath;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getPath();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getPathSegments;;;Argument[-1];ReturnValue;taint"
+			List out = null;
+			Uri in = (Uri)source();
+			out = in.getPathSegments();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getQuery;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getQuery();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getQueryParameter;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getQueryParameter(null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getQueryParameterNames;;;Argument[-1];ReturnValue;taint"
+			Set out = null;
+			Uri in = (Uri)source();
+			out = in.getQueryParameterNames();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getQueryParameters;;;Argument[-1];ReturnValue;taint"
+			List out = null;
+			Uri in = (Uri)source();
+			out = in.getQueryParameters(null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getScheme;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getScheme();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getSchemeSpecificPart;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getSchemeSpecificPart();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;getUserInfo;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.getUserInfo();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;normalizeScheme;;;Argument[-1];ReturnValue;taint"
+			Uri out = null;
+			Uri in = (Uri)source();
+			out = in.normalizeScheme();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.net;Uri;true;toString;;;Argument[-1];ReturnValue;taint"
+			String out = null;
+			Uri in = (Uri)source();
+			out = in.toString();
+			sink(out); // $ hasTaintFlow
+		}
+
+	}
+
+}

java/ql/test/library-tests/frameworks/android/uri/options

@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/google-android-9.0.0

java/ql/test/library-tests/frameworks/android/uri/test.ql

@@ -0,0 +1,2 @@
+import java
+import TestUtilities.InlineFlowTest

java/ql/test/stubs/google-android-9.0.0/android/net/Uri.java

@@ -541,4 +541,152 @@ public abstract class Uri implements Parcelable, Comparable<Uri> {
     public boolean isPathPrefixMatch(Uri prefix) {
         return false;
     }
+
+    public Builder buildUpon() { return null; }
+
+    /**
+     * Helper class for building or manipulating URI references. Not safe for
+     * concurrent use.
+     *
+     * <p>An absolute hierarchical URI reference follows the pattern:
+     * {@code <scheme>://<authority><absolute path>?<query>#<fragment>}
+     *
+     * <p>Relative URI references (which are always hierarchical) follow one
+     * of two patterns: {@code <relative or absolute path>?<query>#<fragment>}
+     * or {@code //<authority><absolute path>?<query>#<fragment>}
+     *
+     * <p>An opaque URI follows this pattern:
+     * {@code <scheme>:<opaque part>#<fragment>}
+     *
+     * <p>Use {@link Uri#buildUpon()} to obtain a builder representing an existing URI.
+     */
+    public static final class Builder {
+        /**
+         * Constructs a new Builder.
+         */
+        public Builder() {}
+        /**
+         * Sets the scheme.
+         *
+         * @param scheme name or {@code null} if this is a relative Uri
+         */
+        public Builder scheme(String scheme) {
+            return null;
+        }
+        /**
+         * Encodes and sets the given opaque scheme-specific-part.
+         *
+         * @param opaquePart decoded opaque part
+         */
+        public Builder opaquePart(String opaquePart) {
+            return null;
+        }
+        /**
+         * Sets the previously encoded opaque scheme-specific-part.
+         *
+         * @param opaquePart encoded opaque part
+         */
+        public Builder encodedOpaquePart(String opaquePart) {
+            return null;
+        }
+        /**
+         * Encodes and sets the authority.
+         */
+        public Builder authority(String authority) {
+            return null;
+        }
+        /**
+         * Sets the previously encoded authority.
+         */
+        public Builder encodedAuthority(String authority) {
+            return null;
+        }
+        /**
+         * Sets the path. Leaves '/' characters intact but encodes others as
+         * necessary.
+         *
+         * <p>If the path is not null and doesn't start with a '/', and if
+         * you specify a scheme and/or authority, the builder will prepend the
+         * given path with a '/'.
+         */
+        public Builder path(String path) {
+            return null;
+        }
+        /**
+         * Sets the previously encoded path.
+         *
+         * <p>If the path is not null and doesn't start with a '/', and if
+         * you specify a scheme and/or authority, the builder will prepend the
+         * given path with a '/'.
+         */
+        public Builder encodedPath(String path) {
+            return null;
+        }
+        /**
+         * Encodes the given segment and appends it to the path.
+         */
+        public Builder appendPath(String newSegment) {
+            return null;
+        }
+        /**
+         * Appends the given segment to the path.
+         */
+        public Builder appendEncodedPath(String newSegment) {
+            return null;
+        }
+        /**
+         * Encodes and sets the query.
+         */
+        public Builder query(String query) {
+            return null;
+        }
+        /**
+         * Sets the previously encoded query.
+         */
+        public Builder encodedQuery(String query) {
+            return null;
+        }
+        /**
+         * Encodes and sets the fragment.
+         */
+        public Builder fragment(String fragment) {
+            return null;
+        }
+        /**
+         * Sets the previously encoded fragment.
+         */
+        public Builder encodedFragment(String fragment) {
+            return null;
+        }
+        /**
+         * Encodes the key and value and then appends the parameter to the
+         * query string.
+         *
+         * @param key which will be encoded
+         * @param value which will be encoded
+         */
+        public Builder appendQueryParameter(String key, String value) {
+            return null;
+        }
+        /**
+         * Clears the the previously set query.
+         */
+        public Builder clearQuery() {
+          return null;
+        }
+        /**
+         * Constructs a Uri with the current attributes.
+         *
+         * @throws UnsupportedOperationException if the URI is opaque and the
+         *  scheme is null
+         */
+        public Uri build() {
+          return null;
+        }
+        @Override
+        public String toString() {
+            return null;
+        }
+    }
+
 }