diff --git a/java/ql/lib/semmle/code/xml/AndroidManifest.qll b/java/ql/lib/semmle/code/xml/AndroidManifest.qll index f795e91163b..c79a5d5c10f 100644 --- a/java/ql/lib/semmle/code/xml/AndroidManifest.qll +++ b/java/ql/lib/semmle/code/xml/AndroidManifest.qll @@ -98,6 +98,16 @@ class AndroidApplicationXmlElement extends XmlElement { attr.getValue() = "true" ) } + + predicate providesMainIntent() { + exists(AndroidActivityXmlElement activity | + activity = this.getAChild() and + exists(AndroidIntentFilterXmlElement intentFilter | + intentFilter = activity.getAChild() and + intentFilter.getAnActionElement().getActionName() = "android.intent.action.MAIN" + ) + ) + } } /** diff --git a/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql b/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql index 6e015c7a237..e8bd3487b00 100644 --- a/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql +++ b/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql @@ -15,6 +15,11 @@ import semmle.code.xml.AndroidManifest from AndroidApplicationXmlElement androidAppElem where - androidAppElem.allowsBackup() and - androidAppElem.getFile().(AndroidManifestXmlFile).isInBuildDirectory() + not androidAppElem.getFile().(AndroidManifestXmlFile).isInBuildDirectory() and + ( + androidAppElem.allowsBackupExplicitly() + or + androidAppElem.providesMainIntent() and + androidAppElem.allowsBackup() + ) select androidAppElem, "The 'android:allowBackup' attribute is enabled."