Add sensitive text flow query

This commit is contained in:
Joe Farebrother
2024-01-19 15:44:28 +00:00
parent aeae208dc3
commit 5dd0addfc2
2 changed files with 55 additions and 0 deletions

View File

@@ -0,0 +1,20 @@
/**
* @name Exposure of sensitive information to UI text fields.
* @id java/android/sensitive-text
* @kind path-problem
* @description Sensitive information ... TODO
* @problem.severity warning
* @precision medium
* @security-severity 6.5
* @tags security
* external/cwe/cwe-200
*/
import java
import java
import semmle.code.java.security.SensitiveUiQuery
import TextFieldTracking::PathGraph
from TextFieldTracking::PathNode source, TextFieldTracking::PathNode sink
where NotificationTracking::flowPath(source, sink)
select sink, source, sink, "This $@ is exposed in a text view.", source, "sensitive information"