Add Improper Intent Verification query

This commit is contained in:
Joe Farebrother
2022-03-29 10:44:11 +01:00
parent ff55efff99
commit 1959f49165
2 changed files with 172 additions and 0 deletions

View File

@@ -0,0 +1,18 @@
/**
* @name Improper Verification of Intent by Broadcast Reciever
* @description The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
* @kind problem
* @problem.severity warning
* @precision high
* @id java/improper-intent-verification
* @tags security
* external/cwe/cwe-925
*/
import java
import semmle.code.java.security.ImproperIntentVerificationQuery
from Top reg, Method orm, SystemActionName sa
where unverifiedSystemReciever(reg, orm, sa)
select orm, "This reciever doesn't verify intents it recieves, and is registered $@ to recieve $@.",
reg, "here", sa, "the system action " + sa.getName()