hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Format the source code and update qldoc

Browse Source
This commit is contained in:
luchua-bc
2020-11-17 21:20:53 +00:00
parent 0bd6255c41
commit 85434ca410
4 changed files with 39 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
java/ql/src/Security/CWE/CWE-312/ClearTextStorageSharedPrefs.java
View File

@@ -1,7 +1,7 @@
public void testSetSharedPrefs(Context context, String name, String password)
public void testSetSharedPrefs(Context context, String name, String password)
{
{
// BAD - save sensitive information in cleartext
{
// BAD - save sensitive information in cleartext
SharedPreferences sharedPrefs = context.getSharedPreferences("user_prefs", Context.MODE_PRIVATE);
Editor editor = sharedPrefs.edit();
editor.putString("name", name);
@@ -9,8 +9,8 @@ public void testSetSharedPrefs(Context context, String name, String password)
editor.commit();
}
{
// GOOD - save sensitive information in encrypted format
{
// GOOD - save sensitive information in encrypted format
SharedPreferences sharedPrefs = context.getSharedPreferences("user_prefs", Context.MODE_PRIVATE);
Editor editor = sharedPrefs.edit();
editor.putString("name", encrypt(name));
@@ -18,20 +18,20 @@ public void testSetSharedPrefs(Context context, String name, String password)
editor.commit();
}
{
// GOOD - save sensitive information using the built-in `EncryptedSharedPreferences` class in androidx.
MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
.build();
{
// GOOD - save sensitive information using the built-in `EncryptedSharedPreferences` class in androidx.
MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
.build();
SharedPreferences sharedPreferences = EncryptedSharedPreferences.create(
context,
"secret_shared_prefs",
masterKey,
EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM);
SharedPreferences.Editor editor = sharedPreferences.edit();
SharedPreferences sharedPreferences = EncryptedSharedPreferences.create(
context,
"secret_shared_prefs",
masterKey,
EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM);
SharedPreferences.Editor editor = sharedPreferences.edit();
editor.putString("name", name);
editor.putString("password", password);
editor.commit();

4
java/ql/src/Security/CWE/CWE-312/ClearTextStorageSharedPrefs.qhelp
View File

@@ -18,7 +18,7 @@
</p>
<p>
In the second and third examples, the code encrypts sensitive information before saving to the device.
In the second and third examples, the code encrypts sensitive information before saving it to the device.
</p>
<sample src="ClearTextStorageSharedPrefs.java" />
</example>
@@ -33,7 +33,7 @@
<a href="https://developer.android.com/topic/security/data">Work with data more securely</a>
</li>
<li>
PRO ANDROID DEV:
ProAndroidDev:
<a href="https://proandroiddev.com/encrypted-preferences-in-android-af57a89af7c8">Encrypted Preferences in Android</a>
</li>
</references>

2
java/ql/src/Security/CWE/CWE-312/ClearTextStorageSharedPrefs.ql
View File

@@ -1,6 +1,6 @@
/**
* @name Cleartext storage of sensitive information using `SharedPreferences` on Android
* @description Cleartext Storage of Sensitive Information using SharedPreferences on Android allows user with root privileges to access or unexpected exposure from chained vulnerabilities.
* @description Cleartext Storage of Sensitive Information using SharedPreferences on Android allows access for users with root privileges or unexpected exposure from chained vulnerabilities.
* @kind problem
* @id java/android/cleartext-storage-shared-prefs
* @tags security

37
java/ql/test/experimental/query-tests/security/CWE-312/ClearTextStorageSharedPrefs.java
View File

@@ -25,30 +25,29 @@ public class ClearTextStorageSharedPrefs extends Activity {
editor.commit();
}
private static String encrypt(String cleartext) {
//Use an encryption or hashing algorithm in real world. The demo below just returns an arbitrary value.
String cipher = "whatever_encrypted";
return cipher;
}
private static String encrypt(String cleartext) {
//Use an encryption or hashing algorithm in real world. The demo below just returns an arbitrary value.
String cipher = "whatever_encrypted";
return cipher;
}
// GOOD - save sensitive information using the built-in `EncryptedSharedPreferences` class in androidx.
public void testSetSharedPrefs3(Context context, String name, String password) {
MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
.build();
MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
.build();
SharedPreferences sharedPreferences = EncryptedSharedPreferences.create(
context,
"secret_shared_prefs",
masterKey,
EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM);
// Use the shared preferences and editor as you normally would
SharedPreferences.Editor editor = sharedPreferences.edit();
SharedPreferences sharedPreferences = EncryptedSharedPreferences.create(
context,
"secret_shared_prefs",
masterKey,
EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM);
// Use the shared preferences and editor as you normally would
SharedPreferences.Editor editor = sharedPreferences.edit();
editor.putString("name", name);
editor.putString("password", password);
editor.commit();
}
}
}