diff --git a/java/ql/lib/semmle/code/java/security/UnsafeContentUriResolution.qll b/java/ql/lib/semmle/code/java/security/UnsafeContentUriResolution.qll index 6acb5ff1d5c..4b85290a917 100644 --- a/java/ql/lib/semmle/code/java/security/UnsafeContentUriResolution.qll +++ b/java/ql/lib/semmle/code/java/security/UnsafeContentUriResolution.qll @@ -3,7 +3,6 @@ import java private import semmle.code.java.dataflow.TaintTracking private import semmle.code.java.frameworks.android.Android -private import semmle.code.java.security.PathSanitizer /** A URI that gets resolved by a `ContentResolver`. */ abstract class ContentUriResolutionSink extends DataFlow::Node { } @@ -50,9 +49,6 @@ private class UninterestingTypeSanitizer extends ContentUriResolutionSanitizer { } } -private class PathSanitizer extends ContentUriResolutionSanitizer instanceof PathInjectionSanitizer { -} - private class FilenameOnlySanitizer extends ContentUriResolutionSanitizer { FilenameOnlySanitizer() { exists(Method m | this.asExpr().(MethodAccess).getMethod() = m | diff --git a/java/ql/test/query-tests/security/CWE-441/Test.java b/java/ql/test/query-tests/security/CWE-441/Test.java index 0bda0933115..c88e0d7a65d 100644 --- a/java/ql/test/query-tests/security/CWE-441/Test.java +++ b/java/ql/test/query-tests/security/CWE-441/Test.java @@ -53,13 +53,13 @@ public class Test extends Activity { Uri uri = (Uri) getIntent().getParcelableExtra("URI_EXTRA"); if (!uri.equals(Uri.parse("content://safe/uri"))) throw new SecurityException(); - contentResolver.openInputStream(uri); // Safe + contentResolver.openInputStream(uri); // $ SPURIOUS: hasTaintFlow } { ContentResolver contentResolver = getContentResolver(); Uri uri = (Uri) getIntent().getParcelableExtra("URI_EXTRA"); validateWithEquals(uri); - contentResolver.openInputStream(uri); // Safe + contentResolver.openInputStream(uri); // $ SPURIOUS: hasTaintFlow } // Allow list checks { @@ -78,13 +78,13 @@ public class Test extends Activity { java.nio.file.FileSystems.getDefault().getPath(path).normalize(); if (!normalized.startsWith("/safe/path")) throw new SecurityException(); - contentResolver.openInputStream(uri); // Safe + contentResolver.openInputStream(uri); // $ SPURIOUS: hasTaintFlow } { ContentResolver contentResolver = getContentResolver(); Uri uri = (Uri) getIntent().getParcelableExtra("URI_EXTRA"); validateWithAllowList(uri); - contentResolver.openInputStream(uri); // Safe + contentResolver.openInputStream(uri);// $ SPURIOUS: hasTaintFlow } // Block list checks { @@ -103,13 +103,13 @@ public class Test extends Activity { java.nio.file.FileSystems.getDefault().getPath(path).normalize(); if (normalized.startsWith("/data")) throw new SecurityException(); - contentResolver.openInputStream(uri); // Safe + contentResolver.openInputStream(uri); // $ SPURIOUS: hasTaintFlow } { ContentResolver contentResolver = getContentResolver(); Uri uri = (Uri) getIntent().getParcelableExtra("URI_EXTRA"); validateWithBlockList(uri); - contentResolver.openInputStream(uri); // Safe + contentResolver.openInputStream(uri); // $ SPURIOUS: hasTaintFlow } } }