hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-03 14:29:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Identify more APIs as supported in the telemetry queries (as QL defined sinks).

Browse Source
This commit is contained in:
Michael Nebel
2024-04-23 13:27:08 +02:00
parent acb2bbb2a3
commit 9db32f4d26
12 changed files with 233 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
java/ql/lib/semmle/code/java/security/WebviewDebuggingEnabledQuery.qll
View File

@@ -44,18 +44,25 @@ deprecated class WebviewDebugEnabledConfig extends DataFlow::Configuration {
}
}
/**
* A class of webview debug sink nodes.
*/
class WebviewDebugSink extends DataFlow::Node {
WebviewDebugSink() {
exists(MethodCall ma |
ma.getMethod().hasQualifiedName("android.webkit", "WebView", "setWebContentsDebuggingEnabled") and
this.asExpr() = ma.getArgument(0)
)
}
}
/** A configuration to find instances of `setWebContentDebuggingEnabled` called with `true` values. */
module WebviewDebugEnabledConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) {
node.asExpr().(BooleanLiteral).getBooleanValue() = true
}
predicate isSink(DataFlow::Node node) {
exists(MethodCall ma |
ma.getMethod().hasQualifiedName("android.webkit", "WebView", "setWebContentsDebuggingEnabled") and
node.asExpr() = ma.getArgument(0)
)
}
predicate isSink(DataFlow::Node node) { node instanceof WebviewDebugSink }
predicate isBarrier(DataFlow::Node node) {
exists(Guard debug | isDebugCheck(debug) and debug.controls(node.asExpr().getBasicBlock(), _))