diff --git a/java/ql/lib/semmle/code/java/frameworks/android/SQLite.qll b/java/ql/lib/semmle/code/java/frameworks/android/SQLite.qll index 5c1a9d6e600..684df41ac56 100644 --- a/java/ql/lib/semmle/code/java/frameworks/android/SQLite.qll +++ b/java/ql/lib/semmle/code/java/frameworks/android/SQLite.qll @@ -1,3 +1,5 @@ +/** Provides classes and predicates for working with SQLite databases. */ + import java import Android import semmle.code.java.dataflow.FlowSteps @@ -24,10 +26,16 @@ class TypeDatabaseUtils extends Class { TypeDatabaseUtils() { hasQualifiedName("android.database", "DatabaseUtils") } } +/** + * The class `android.database.sqlite.SQLiteOpenHelper`. + */ class TypeSQLiteOpenHelper extends Class { TypeSQLiteOpenHelper() { this.hasQualifiedName("android.database.sqlite", "SQLiteOpenHelper") } } +/** + * The class `android.database.sqlite.SQLiteStatement`. + */ class TypeSQLiteStatement extends Class { TypeSQLiteStatement() { this.hasQualifiedName("android.database.sqlite", "SQLiteStatement") } } diff --git a/java/ql/lib/semmle/code/java/frameworks/android/Widget.qll b/java/ql/lib/semmle/code/java/frameworks/android/Widget.qll index f075e758b31..961c63a4069 100644 --- a/java/ql/lib/semmle/code/java/frameworks/android/Widget.qll +++ b/java/ql/lib/semmle/code/java/frameworks/android/Widget.qll @@ -1,3 +1,5 @@ +/** Provides classes and predicates for working with Android widgets. */ + import java import semmle.code.java.dataflow.ExternalFlow import semmle.code.java.dataflow.FlowSources diff --git a/java/ql/src/Security/CWE/CWE-312/CleartextStorageAndroidDatabase.java b/java/ql/src/Security/CWE/CWE-312/CleartextStorageAndroidDatabase.java index c421e7f3de5..0145125448f 100644 --- a/java/ql/src/Security/CWE/CWE-312/CleartextStorageAndroidDatabase.java +++ b/java/ql/src/Security/CWE/CWE-312/CleartextStorageAndroidDatabase.java @@ -16,3 +16,12 @@ public void sqlCipherStorageSafe(String name, String password, String databasePa net.sqlcipher.database.SQLiteDatabase.openOrCreateDatabase("test", databasePassword, null); db.execSQL("INSERT INTO users VALUES (?, ?)", new String[] {name, password}); } + +private static String encrypt(String cleartext) { + // Use an encryption or strong hashing algorithm in the real world. + // The example below just returns a SHA-256 hash. + MessageDigest digest = MessageDigest.getInstance("SHA-256"); + byte[] hash = digest.digest(cleartext.getBytes(StandardCharsets.UTF_8)); + String encoded = Base64.getEncoder().encodeToString(hash); + return encoded; +} \ No newline at end of file