hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Chris Smowton <smowton@github.com>
This commit is contained in:
Tony Torralba
2022-03-25 10:51:26 +01:00
parent b9859fe165
commit 51dfebf4c9
2 changed files with 9 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
java/ql/lib/semmle/code/java/frameworks/android/WebView.qll
View File

@@ -83,14 +83,12 @@ class ShouldOverrideUrlLoading extends Method {
*/
predicate isJSEnabled(Expr webview) {
webview.getType().(RefType).getASupertype*() instanceof TypeWebView and
exists(MethodAccess allowJs |
exists(MethodAccess allowJs, MethodAccess settings |
allowJs.getMethod() instanceof AllowJavaScriptMethod and
allowJs.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true and
exists(MethodAccess settings |
settings.getMethod() instanceof WebViewGetSettingsMethod and
DataFlow::localExprFlow(settings, allowJs.getQualifier()) and
DataFlow::localExprFlow(webview, settings.getQualifier())
)
settings.getMethod() instanceof WebViewGetSettingsMethod and
DataFlow::localExprFlow(settings, allowJs.getQualifier()) and
DataFlow::localExprFlow(webview, settings.getQualifier())
)
}
@@ -99,14 +97,12 @@ predicate isJSEnabled(Expr webview) {
* `setAllowFileAccessFromFileURLs` have been set to `true`.
*/
predicate isAllowFileAccessEnabled(Expr webview) {
exists(MethodAccess allowFileAccess |
exists(MethodAccess allowFileAccess, MethodAccess settings |
allowFileAccess.getMethod() instanceof CrossOriginAccessMethod and
allowFileAccess.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true and
exists(MethodAccess settings |
settings.getMethod() instanceof WebViewGetSettingsMethod and
DataFlow::localExprFlow(settings, allowFileAccess.getQualifier()) and
DataFlow::localExprFlow(webview, settings.getQualifier())
)
settings.getMethod() instanceof WebViewGetSettingsMethod and
DataFlow::localExprFlow(settings, allowFileAccess.getQualifier()) and
DataFlow::localExprFlow(webview, settings.getQualifier())
)
}

2
java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll
View File

@@ -77,7 +77,7 @@ private Expr getUnderlyingExpr(Expr e) {
}
/**
* Holds if `WebViewLoadUrlMethod` is called on `webview`
* Holds if a `WebViewLoadUrlMethod` is called on `webview`
* with `urlArg` as its first argument.
*/
private predicate webViewLoadUrl(Argument urlArg, Expr webview) {