hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add full path reconstruction from RemoteFlowSource to sink

Browse Source
This commit is contained in:
Tony Torralba
2021-08-24 14:54:20 +02:00
parent 445da1e71e
commit 14963103aa
4 changed files with 65 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.java
View File

@@ -11,19 +11,6 @@ public class AndroidIntentRedirectionTest extends Activity {
public void onCreate(Bundle savedInstanceState) {
Intent intent = (Intent) getIntent().getParcelableExtra("forward_intent");
if (intent.getComponent().getPackageName().equals("something")) {
startActivity(intent); // Safe - sanitized
} else {
startActivity(intent); // $ hasAndroidIntentRedirection
}
if (intent.getComponent().getClassName().equals("something")) {
startActivity(intent); // Safe - sanitized
} else {
startActivity(intent); // $ hasAndroidIntentRedirection
}
startActivity(getIntent()); // Safe - not an intent obtained from the Extras
// @formatter:off
startActivities(new Intent[] {intent}); // $ hasAndroidIntentRedirection
startActivities(new Intent[] {intent}, null); // $ hasAndroidIntentRedirection
@@ -56,6 +43,17 @@ public class AndroidIntentRedirectionTest extends Activity {
sendStickyOrderedBroadcastAsUser(intent, null, null, null, 0, null, null); // $ hasAndroidIntentRedirection
// @formatter:on
if (intent.getComponent().getPackageName().equals("something")) {
startActivity(intent); // Safe - sanitized
} else {
startActivity(intent); // $ hasAndroidIntentRedirection
}
if (intent.getComponent().getClassName().equals("something")) {
startActivity(intent); // Safe - sanitized
} else {
startActivity(intent); // $ hasAndroidIntentRedirection
}
try {
{
Intent fwdIntent = new Intent();
@@ -134,6 +132,25 @@ public class AndroidIntentRedirectionTest extends Activity {
fwdIntent.setComponent(component);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent originalIntent = getIntent();
Intent fwdIntent = (Intent) originalIntent.getParcelableExtra("forward_intent");
startActivity(originalIntent); // Safe - not an Intent obtained from the Extras
}
{
Intent originalIntent = getIntent();
ComponentName cp = new ComponentName(originalIntent.getStringExtra("packageName"),
originalIntent.getStringExtra("className"));
Intent anotherIntent = new Intent();
anotherIntent.setComponent(cp);
startActivity(originalIntent); // Safe - not a tainted Intent
}
{
// Delayed cast
Object obj = getIntent().getParcelableExtra("forward_intent");
Intent fwdIntent = (Intent) obj;
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
} catch (Exception e) {
}
}

6
java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.ql
View File

@@ -9,10 +9,10 @@ class HasAndroidIntentRedirectionTest extends InlineExpectationsTest {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasAndroidIntentRedirection" and
exists(DataFlow::Node src, DataFlow::Node sink, IntentRedirectionConfiguration conf |
conf.hasFlow(src, sink)
exists(DataFlow::PathNode src, DataFlow::PathNode sink |
hasIntentRedirectionFlowPath(src, sink)
|
sink.getLocation() = location and
sink.getNode().getLocation() = location and
element = sink.toString() and
value = ""
)