hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix Intent Redirection sanitizer

Browse Source
This commit is contained in:
Tony Torralba
2022-04-29 11:29:44 +02:00
parent 4553a0913f
commit 12320aa5d2
3 changed files with 29 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
java/ql/lib/change-notes/2022-04-29-intent-redirection-sanitizer-fix.md Normal file
View File

@@ -0,0 +1,5 @@
---
category: minorAnalysis
---
Fixed a sanitizer of the query `java/android/intent-redirection`. Now, for an intent to be considered
safe against intent redirection, both its package name and class name must be checked.

14
java/ql/lib/semmle/code/java/security/AndroidIntentRedirection.qll
View File

@@ -65,16 +65,24 @@ private class DefaultIntentRedirectionSink extends IntentRedirectionSink {
}
/**
* A default sanitizer for nodes dominated by calls to `ComponentName.getPackageName`
* or `ComponentName.getClassName`. These are used to check whether the origin or destination
* A default sanitizer for `Intent` nodes dominated by calls to `ComponentName.getPackageName`
* and `ComponentName.getClassName`. These are used to check whether the origin or destination
* components are trusted.
*/
private class DefaultIntentRedirectionSanitizer extends IntentRedirectionSanitizer {
DefaultIntentRedirectionSanitizer() {
this.getType() instanceof TypeIntent and
exists(MethodAccess ma, Method m, Guard g, boolean branch |
ma.getMethod() = m and
m.getDeclaringType() instanceof TypeComponentName and
m.hasName(["getPackageName", "getClassName"]) and
m.hasName("getPackageName") and
g.isEquality(ma, _, branch) and
g.controls(this.asExpr().getBasicBlock(), branch)
) and
exists(MethodAccess ma, Method m, Guard g, boolean branch |
ma.getMethod() = m and
m.getDeclaringType() instanceof TypeComponentName and
m.hasName("getClassName") and
g.isEquality(ma, _, branch) and
g.controls(this.asExpr().getBasicBlock(), branch)
)

17
java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.java
View File

@@ -40,13 +40,23 @@ public class AndroidIntentRedirectionTest extends Activity {
sendStickyOrderedBroadcastAsUser(intent, null, null, null, 0, null, null); // $ hasAndroidIntentRedirection
// @formatter:on
// Sanitizing only the package or the class still allows redirecting
// to non-exported activities in the same package
// or activities with the same name in other packages, respectively.
if (intent.getComponent().getPackageName().equals("something")) {
startActivity(intent); // Safe - sanitized
startActivity(intent); // $ hasAndroidIntentRedirection
} else {
startActivity(intent); // $ hasAndroidIntentRedirection
}
if (intent.getComponent().getClassName().equals("something")) {
startActivity(intent); // Safe - sanitized
startActivity(intent); // $ hasAndroidIntentRedirection
} else {
startActivity(intent); // $ hasAndroidIntentRedirection
}
if (intent.getComponent().getPackageName().equals("something")
&& intent.getComponent().getClassName().equals("something")) {
startActivity(intent); // Safe
} else {
startActivity(intent); // $ hasAndroidIntentRedirection
}
@@ -94,8 +104,7 @@ public class AndroidIntentRedirectionTest extends Activity {
}
{
Intent fwdIntent = new Intent();
ComponentName component =
new ComponentName("", intent.getStringExtra("className"));
ComponentName component = new ComponentName("", intent.getStringExtra("className"));
fwdIntent.setComponent(component);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}