hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Remove PendingIntentAsField step and add SliceProviderLifecycle step

Browse Source
This commit is contained in:
Tony Torralba
2022-01-20 14:39:55 +01:00
parent fede7dd238
commit 6fe0b78978
2 changed files with 31 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
java/ql/lib/semmle/code/java/frameworks/android/Slice.qll
View File

@@ -5,6 +5,36 @@ private import semmle.code.java.dataflow.DataFlow
private import semmle.code.java.dataflow.FlowSteps
private import semmle.code.java.dataflow.ExternalFlow
/** The class `androidx.slice.SliceProvider`. */
class SliceProvider extends Class {
SliceProvider() { this.hasQualifiedName("androidx.slice", "SliceProvider") }
}
/**
* An additional value step for modeling the lifecycle of a `SliceProvider`.
* It connects the `PostUpdateNode` of any update done to the provider object in
* `onCreateSliceProvider` to the instance parameter of `onBindSlice`.
*/
private class SliceProviderLifecycleStep extends AdditionalValueStep {
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
exists(Method onCreate, Method onBind, RefType declaringClass |
declaringClass.getASupertype*() instanceof SliceProvider and
onCreate.getDeclaringType() = declaringClass and
onCreate.hasName("onCreateSliceProvider") and
onBind.getDeclaringType() = declaringClass and
onBind.hasName("onBindSlice")
|
node1
.(DataFlow::PostUpdateNode)
.getPreUpdateNode()
.(DataFlow::InstanceAccessNode)
.isOwnInstanceAccess() and
node1.getEnclosingCallable() = onCreate and
node2.(DataFlow::InstanceParameterNode).getEnclosingCallable() = onBind
)
}
}
private class SliceActionsInheritTaint extends DataFlow::SyntheticFieldContent,
TaintInheritingContent {
SliceActionsInheritTaint() { this.getField().matches("androidx.slice.Slice.action") }

16
java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll
View File

@@ -68,21 +68,7 @@ private class SendPendingIntent extends ImplicitPendingIntentSink {
override predicate hasState(DataFlow::FlowState state) { state = "MutablePendingIntent" }
}
/**
* Propagates taint from any tainted object to reads from its `PendingIntent`-typed fields.
*/
private class PendingIntentAsFieldAdditionalTaintStep extends ImplicitPendingIntentAdditionalTaintStep {
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
exists(Field f |
f.getType() instanceof PendingIntent and
node1.(DataFlow::PostUpdateNode).getPreUpdateNode() =
DataFlow::getFieldQualifier(f.getAnAccess().(FieldWrite)) and
node2.asExpr().(FieldRead).getField() = f
)
}
}
private class MutablePendingIntentFlowStep extends PendingIntentAsFieldAdditionalTaintStep {
private class MutablePendingIntentFlowStep extends ImplicitPendingIntentAdditionalTaintStep {
override predicate step(
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
DataFlow::FlowState state2