hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use CSV models

Browse Source
This commit is contained in:
Tony Torralba
2021-08-10 10:22:03 +02:00
parent 9604f88ae0
commit 21b70a009e
2 changed files with 2 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
java/ql/src/semmle/code/java/security/AndroidIntentRedirection.qll
View File

@@ -2,6 +2,7 @@
import java import java
private import semmle.code.java.dataflow.DataFlow private import semmle.code.java.dataflow.DataFlow
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.frameworks.android.Intent private import semmle.code.java.frameworks.android.Intent
/** /**
@@ -28,19 +29,5 @@ class IntentRedirectionAdditionalTaintStep extends Unit {
/** Default sink for Intent redirection vulnerabilities. */ /** Default sink for Intent redirection vulnerabilities. */
private class DefaultIntentRedirectionSink extends IntentRedirectionSink { private class DefaultIntentRedirectionSink extends IntentRedirectionSink {
DefaultIntentRedirectionSink() { DefaultIntentRedirectionSink() { sinkNode(this, "intent-start") }
exists(MethodAccess ma, Method m |
ma.getMethod() = m and
this.asExpr() = ma.getAnArgument() and
(
this.asExpr().getType() instanceof TypeIntent
or
this.asExpr().getType().(Array).getComponentType() instanceof TypeIntent
)
|
m instanceof StartActivityMethod or
m instanceof StartServiceMethod or
m instanceof SendBroadcastMethod
)
}
} }

1
java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.java
View File

@@ -18,7 +18,6 @@ public class AndroidIntentRedirectionTest extends Activity {
startActivityAsUser(intent, null); // $ hasAndroidIntentRedirection startActivityAsUser(intent, null); // $ hasAndroidIntentRedirection
startActivityAsUser(intent, null, null); // $ hasAndroidIntentRedirection startActivityAsUser(intent, null, null); // $ hasAndroidIntentRedirection
startActivityAsCaller(intent, null, false, 0); // $ hasAndroidIntentRedirection startActivityAsCaller(intent, null, false, 0); // $ hasAndroidIntentRedirection
startActivityAsUserFromFragment(null, intent, 0, null, null); // $ hasAndroidIntentRedirection
startActivityForResult(intent, 0); // $ hasAndroidIntentRedirection startActivityForResult(intent, 0); // $ hasAndroidIntentRedirection
startActivityForResult(intent, 0, null); // $ hasAndroidIntentRedirection startActivityForResult(intent, 0, null); // $ hasAndroidIntentRedirection
startActivityForResult(null, intent, 0, null); // $ hasAndroidIntentRedirection startActivityForResult(null, intent, 0, null); // $ hasAndroidIntentRedirection