hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

resolved merge conflict in AndroidManifest

Browse Source
This commit is contained in:
Jami Cogswell
2022-08-17 14:29:15 -04:00
parent 825df218a3
commit 58d3d89b2e
3 changed files with 26 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
java/ql/lib/semmle/code/java/security/ImplicitlyExportedAndroidComponent.qll Normal file
View File

@@ -0,0 +1,15 @@
/** Provides a class to reason about Android implicitly exported components. */
private import semmle.code.xml.AndroidManifest
class ImplicitlyExportedAndroidComponent extends AndroidComponentXmlElement {
//ImplicitlyExportedAndroidComponent() { }
predicate isImplicitlyExported() {
not this.hasExportedAttribute() and
this.hasAnIntentFilterElement() and
not this.requiresPermissions() and
not this.getParent().(AndroidApplicationXmlElement).hasAttribute("permission") and
not this.getAnIntentFilterElement().hasLauncherCategoryElement() and
not this.getFile().(AndroidManifestXmlFile).isInBuildDirectory()
}
}

20
java/ql/lib/semmle/code/xml/AndroidManifest.qll
View File

@@ -113,7 +113,7 @@ class AndroidProviderXmlElement extends AndroidComponentXmlElement {
* `android:permission` attribute or its `android:readPermission` and `android:writePermission` * `android:permission` attribute or its `android:readPermission` and `android:writePermission`
* attributes. * attributes.
*/ */
predicate requiresPermissions() { override predicate requiresPermissions() {
this.getAnAttribute().(AndroidPermissionXmlAttribute).isFull() this.getAnAttribute().(AndroidPermissionXmlAttribute).isFull()
or or
this.getAnAttribute().(AndroidPermissionXmlAttribute).isWrite() and this.getAnAttribute().(AndroidPermissionXmlAttribute).isWrite() and
@@ -236,16 +236,10 @@ class AndroidComponentXmlElement extends XmlElement {
*/ */
predicate hasExportedAttribute() { this.hasAttribute("exported") } predicate hasExportedAttribute() { this.hasAttribute("exported") }
// /** Holds if this component element has an attribute with the name `permission`. */ /**
// predicate hasPermissionAttribute() { exists(this.getAttribute("permission")) } * Holds if this component element has explicitly set a value for its `android:permission` attribute.
predicate isImplicitlyExported() { */
not this.hasExportedAttribute() and predicate requiresPermissions() { this.getAnAttribute().(AndroidPermissionXmlAttribute).isFull() }
this.hasAnIntentFilterElement() and // Note: did not use getAnIntentFilterElement since don't need a return value
not this.hasAttribute("permission") and // not seeing how isFull() is any better than this..., this seems to more directly check what I want...
not this.getParent().(AndroidApplicationXmlElement).hasAttribute("permission") and
not this.getAnIntentFilterElement().hasLauncherCategoryElement() and
not this.getFile().(AndroidManifestXmlFile).isInBuildDirectory()
}
} }
/** /**
@@ -268,10 +262,10 @@ class AndroidIntentFilterXmlElement extends XmlElement {
/** /**
* Holds if this `<intent-filter>` element has a `<category>` child element * Holds if this `<intent-filter>` element has a `<category>` child element
* named "android.intent.category.LAUNCHER". * named `android.intent.category.LAUNCHER`.
*/ */
predicate hasLauncherCategoryElement() { predicate hasLauncherCategoryElement() {
this.getACategoryElement().getAttributeValue("name") = "android.intent.category.LAUNCHER" this.getACategoryElement().getCategoryName() = "android.intent.category.LAUNCHER"
} }
} }

8
java/ql/src/Security/CWE/CWE-926/ImplicitlyExportedAndroidComponent.ql
View File

@@ -11,8 +11,8 @@
*/ */
import java import java
import semmle.code.xml.AndroidManifest import semmle.code.java.security.ImplicitlyExportedAndroidComponent
from AndroidComponentXmlElement compElement from ImplicitlyExportedAndroidComponent impExpAndroidComp
where compElement.isImplicitlyExported() where impExpAndroidComp.isImplicitlyExported()
select compElement, "This component is implicitly exported." select impExpAndroidComp, "This component is implicitly exported."