hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: convert FragmentInjection test to .qlref

Browse Source
This commit is contained in:
Nora Dimitrijević
2025-06-23 17:05:16 +02:00
parent 2b19cbcd7e
commit 192f45ed2b
4 changed files with 83 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
java/ql/test/query-tests/security/CWE-470/MainActivity.java
View File

@@ -11,19 +11,19 @@ public class MainActivity extends FragmentActivity {
public void onCreate(Bundle savedInstance) {
try {
super.onCreate(savedInstance);
final String fname = getIntent().getStringExtra("fname");
final String fname = getIntent().getStringExtra("fname"); // $ Source
FragmentTransaction ft = getSupportFragmentManager().beginTransaction();
Class<Fragment> fClass = (Class<Fragment>) Class.forName(fname);
ft.add(fClass.newInstance(), ""); // $ hasTaintFlow
ft.add(0, Fragment.instantiate(this, fname), null); // $ hasTaintFlow
ft.add(0, Fragment.instantiate(this, fname, null)); // $ hasTaintFlow
ft.add(0, fClass, null, ""); // $ hasTaintFlow
ft.add(0, fClass.newInstance(), ""); // $ hasTaintFlow
ft.attach(fClass.newInstance()); // $ hasTaintFlow
ft.replace(0, fClass, null); // $ hasTaintFlow
ft.replace(0, fClass.newInstance()); // $ hasTaintFlow
ft.replace(0, fClass, null, ""); // $ hasTaintFlow
ft.replace(0, fClass.newInstance(), ""); // $ hasTaintFlow
ft.add(fClass.newInstance(), ""); // $ Alert
ft.add(0, Fragment.instantiate(this, fname), null); // $ Alert
ft.add(0, Fragment.instantiate(this, fname, null)); // $ Alert
ft.add(0, fClass, null, ""); // $ Alert
ft.add(0, fClass.newInstance(), ""); // $ Alert
ft.attach(fClass.newInstance()); // $ Alert
ft.replace(0, fClass, null); // $ Alert
ft.replace(0, fClass.newInstance()); // $ Alert
ft.replace(0, fClass, null, ""); // $ Alert
ft.replace(0, fClass.newInstance(), ""); // $ Alert
ft.add(Fragment.class.newInstance(), ""); // Safe
ft.attach(Fragment.class.newInstance()); // Safe