hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Modify getAndroidComponentXmlElement to handle activity-alias

Browse Source 
Since aliases have both the `name` and `targetActivity` attributes, we
should check all identifying attributes in order to add
`<activity-alias>` elements as dataflow sources.
This commit is contained in:
Ed Minnix
2022-10-27 13:24:34 -04:00
parent 4620db0fe9
commit 2255b0d96a
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
java/ql/lib/semmle/code/java/frameworks/android/Android.qll
View File

@@ -26,7 +26,12 @@ class AndroidComponent extends Class {
/** The XML element corresponding to this Android component. */
AndroidComponentXmlElement getAndroidComponentXmlElement() {
result.getResolvedComponentName() = this.getQualifiedName()
// Find an element with an identifier matching the qualified name of the component.
// Aliases have two identifiers (name and target), so check both identifiers (if present).
exists(AndroidIdentifierXmlAttribute identifier |
identifier = result.getAnAttribute() and
result.getResolvedIdentifier(identifier) = this.getQualifiedName()
)
}
/** Holds if this Android component is configured as `exported` in an `AndroidManifest.xml` file. */