hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add intent creation from a URI as a taint step

Browse Source
This commit is contained in:
Tony Torralba
2021-10-18 12:18:07 +02:00
parent d1d2d61d7e
commit 392e2eebeb
2 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/ql/lib/semmle/code/java/frameworks/android/Intent.qll
View File

@@ -249,6 +249,9 @@ private class IntentComponentTaintSteps extends SummaryModelCsv {
"android.content;Intent;true;Intent;(Intent);;Argument[0];Argument[-1];taint",
"android.content;Intent;true;Intent;(Context,Class);;Argument[1];Argument[-1];taint",
"android.content;Intent;true;Intent;(String,Uri,Context,Class);;Argument[3];Argument[-1];taint",
"android.content;Intent;true;getIntent;(String);;Argument[0];ReturnValue;taint",
"android.content;Intent;true;getIntentOld;(String);;Argument[0];ReturnValue;taint",
"android.content;Intent;true;parseUri;(String,int);;Argument[0];ReturnValue;taint",
"android.content;Intent;true;setPackage;;;Argument[0];Argument[-1];taint",
"android.content;Intent;true;setPackage;;;Argument[-1];ReturnValue;taint",
"android.content;Intent;true;setClass;;;Argument[1];Argument[-1];taint",

12
java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.java
View File

@@ -179,6 +179,18 @@ public class AndroidIntentRedirectionTest extends Activity {
// Conditionally tainted sinks aren't supported currently
startActivity(fwdIntent); // $ MISSING: $hasAndroidIntentRedirection
}
{
Intent fwdIntent = Intent.parseUri(getIntent().getStringExtra("uri"), 0);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = Intent.getIntent(getIntent().getStringExtra("uri"));
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = Intent.getIntentOld(getIntent().getStringExtra("uri"));
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
} catch (Exception e) {
}
}