mirror of
https://github.com/github/codeql.git
synced 2025-12-22 03:36:30 +01:00
Add Improper Intent Verification query
This commit is contained in:
@@ -0,0 +1,18 @@
|
||||
/**
|
||||
* @name Improper Verification of Intent by Broadcast Reciever
|
||||
* @description The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
|
||||
* @kind problem
|
||||
* @problem.severity warning
|
||||
* @precision high
|
||||
* @id java/improper-intent-verification
|
||||
* @tags security
|
||||
* external/cwe/cwe-925
|
||||
*/
|
||||
|
||||
import java
|
||||
import semmle.code.java.security.ImproperIntentVerificationQuery
|
||||
|
||||
from Top reg, Method orm, SystemActionName sa
|
||||
where unverifiedSystemReciever(reg, orm, sa)
|
||||
select orm, "This reciever doesn't verify intents it recieves, and is registered $@ to recieve $@.",
|
||||
reg, "here", sa, "the system action " + sa.getName()
|
||||
Reference in New Issue
Block a user