Add ComponentName tests to existing Intent tests

This commit is contained in:
Tony Torralba
2021-10-18 15:13:09 +02:00
parent 392e2eebeb
commit a5749a5eb1
8 changed files with 165 additions and 280 deletions

View File

@@ -6,10 +6,6 @@ public class IntentSources extends Activity {
private static void sink(Object o) {}
public IntentSources(Context base) {
super(base);
}
public void test() throws java.io.IOException {
String trouble = this.getIntent().getStringExtra("key");

View File

@@ -1,5 +1,6 @@
package generatedtest;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.IntentSender;
@@ -1597,6 +1598,167 @@ public class Test {
out.readFromParcel(in);
sink(getMapValue(out)); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;ComponentName;(Context,Class);;Argument[1];Argument[-1];taint"
ComponentName out = null;
Class in = (Class) source();
out = new ComponentName((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;ComponentName;(Context,String);;Argument[1];Argument[-1];taint"
ComponentName out = null;
String in = (String) source();
out = new ComponentName((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;ComponentName;(Parcel);;Argument[0];Argument[-1];taint"
ComponentName out = null;
Parcel in = (Parcel) source();
out = new ComponentName(in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;ComponentName;(String,String);;Argument[0..1];Argument[-1];taint"
ComponentName out = null;
String in = (String) source();
out = new ComponentName(in, (String) null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;ComponentName;(String,String);;Argument[0..1];Argument[-1];taint"
ComponentName out = null;
String in = (String) source();
out = new ComponentName((String) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;createRelative;(Context,String);;Argument[1];ReturnValue;taint"
ComponentName out = null;
String in = (String) source();
out = ComponentName.createRelative((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;createRelative;(String,String);;Argument[0..1];ReturnValue;taint"
ComponentName out = null;
String in = (String) source();
out = ComponentName.createRelative(in, (String) null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;createRelative;(String,String);;Argument[0..1];ReturnValue;taint"
ComponentName out = null;
String in = (String) source();
out = ComponentName.createRelative((String) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;flattenToShortString;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.flattenToShortString();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;flattenToString;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.flattenToString();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;getClassName;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.getClassName();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;getPackageName;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.getPackageName();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;getShortClassName;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.getShortClassName();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;unflattenFromString;;;Argument[0];ReturnValue;taint"
ComponentName out = null;
String in = (String) source();
out = ComponentName.unflattenFromString(in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;Intent;(Context,Class);;Argument[1];Argument[-1];taint"
Intent out = null;
Class in = (Class) source();
out = new Intent((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;Intent;(Intent);;Argument[0];Argument[-1];taint"
Intent out = null;
Intent in = (Intent) source();
out = new Intent(in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;Intent;(String,Uri,Context,Class);;Argument[3];Argument[-1];taint"
Intent out = null;
Class in = (Class) source();
out = new Intent(null, null, null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClass;;;Argument[1];Argument[-1];taint"
Intent out = null;
Class in = (Class) source();
out.setClass(null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClassName;(Context,String);;Argument[1];Argument[-1];taint"
Intent out = null;
String in = (String) source();
out.setClassName((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClassName;(String,String);;Argument[0..1];Argument[-1];taint"
Intent out = null;
String in = (String) source();
out.setClassName(in, (String) null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClassName;(String,String);;Argument[0..1];Argument[-1];taint"
Intent out = null;
String in = (String) source();
out.setClassName((String) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setComponent;;;Argument[0];Argument[-1];taint"
Intent out = null;
ComponentName in = (ComponentName) source();
out.setComponent(in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setPackage;;;Argument[0];Argument[-1];taint"
Intent out = null;
String in = (String) source();
out.setPackage(in);
sink(out); // $ hasTaintFlow
}
}

View File

@@ -1,218 +0,0 @@
package generatedtest;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.os.Parcel;
// Test case generated by GenerateFlowTestCase.ql
public class Test {
Object source() {
return null;
}
void sink(Object o) {}
public void test() throws Exception {
{
// "android.content;ComponentName;false;ComponentName;(Context,Class);;Argument[1];Argument[-1];taint"
ComponentName out = null;
Class in = (Class) source();
out = new ComponentName((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;ComponentName;(Context,String);;Argument[1];Argument[-1];taint"
ComponentName out = null;
String in = (String) source();
out = new ComponentName((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;ComponentName;(Parcel);;Argument[0];Argument[-1];taint"
ComponentName out = null;
Parcel in = (Parcel) source();
out = new ComponentName(in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;ComponentName;(String,String);;Argument[0..1];Argument[-1];taint"
ComponentName out = null;
String in = (String) source();
out = new ComponentName(in, (String) null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;ComponentName;(String,String);;Argument[0..1];Argument[-1];taint"
ComponentName out = null;
String in = (String) source();
out = new ComponentName((String) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;createRelative;(Context,String);;Argument[1];ReturnValue;taint"
ComponentName out = null;
String in = (String) source();
out = ComponentName.createRelative((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;createRelative;(String,String);;Argument[0..1];ReturnValue;taint"
ComponentName out = null;
String in = (String) source();
out = ComponentName.createRelative(in, (String) null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;createRelative;(String,String);;Argument[0..1];ReturnValue;taint"
ComponentName out = null;
String in = (String) source();
out = ComponentName.createRelative((String) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;flattenToShortString;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.flattenToShortString();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;flattenToString;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.flattenToString();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;getClassName;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.getClassName();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;getPackageName;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.getPackageName();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;getShortClassName;;;Argument[-1];ReturnValue;taint"
String out = null;
ComponentName in = (ComponentName) source();
out = in.getShortClassName();
sink(out); // $ hasTaintFlow
}
{
// "android.content;ComponentName;false;unflattenFromString;;;Argument[0];ReturnValue;taint"
ComponentName out = null;
String in = (String) source();
out = ComponentName.unflattenFromString(in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;Intent;(Context,Class);;Argument[1];Argument[-1];taint"
Intent out = null;
Class in = (Class) source();
out = new Intent((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;Intent;(Intent);;Argument[0];Argument[-1];taint"
Intent out = null;
Intent in = (Intent) source();
out = new Intent(in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;Intent;(String,Uri,Context,Class);;Argument[3];Argument[-1];taint"
Intent out = null;
Class in = (Class) source();
out = new Intent(null, null, null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClass;;;Argument[-1];ReturnValue;taint"
Intent out = null;
Intent in = (Intent) source();
out = in.setClass(null, null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClass;;;Argument[1];Argument[-1];taint"
Intent out = null;
Class in = (Class) source();
out.setClass(null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClassName;(Context,String);;Argument[1];Argument[-1];taint"
Intent out = null;
String in = (String) source();
out.setClassName((Context) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClassName;(String,String);;Argument[0..1];Argument[-1];taint"
Intent out = null;
String in = (String) source();
out.setClassName(in, (String) null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClassName;(String,String);;Argument[0..1];Argument[-1];taint"
Intent out = null;
String in = (String) source();
out.setClassName((String) null, in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClassName;;;Argument[-1];ReturnValue;taint"
Intent out = null;
Intent in = (Intent) source();
out = in.setClassName((String) null, (String) null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setClassName;;;Argument[-1];ReturnValue;taint"
Intent out = null;
Intent in = (Intent) source();
out = in.setClassName((Context) null, (String) null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setComponent;;;Argument[-1];ReturnValue;taint"
Intent out = null;
Intent in = (Intent) source();
out = in.setComponent(null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setComponent;;;Argument[0];Argument[-1];taint"
Intent out = null;
ComponentName in = (ComponentName) source();
out.setComponent(in);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setPackage;;;Argument[-1];ReturnValue;taint"
Intent out = null;
Intent in = (Intent) source();
out = in.setPackage(null);
sink(out); // $ hasTaintFlow
}
{
// "android.content;Intent;true;setPackage;;;Argument[0];Argument[-1];taint"
Intent out = null;
String in = (String) source();
out.setPackage(in);
sink(out); // $ hasTaintFlow
}
}
}

View File

@@ -1 +0,0 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/google-android-9.0.0

View File

@@ -1,53 +0,0 @@
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.ExternalFlow
import semmle.code.java.dataflow.TaintTracking
import TestUtilities.InlineExpectationsTest
class ValueFlowConf extends DataFlow::Configuration {
ValueFlowConf() { this = "qltest:valueFlowConf" }
override predicate isSource(DataFlow::Node n) {
n.asExpr().(MethodAccess).getMethod().hasName("source")
}
override predicate isSink(DataFlow::Node n) {
n.asExpr().(Argument).getCall().getCallee().hasName("sink")
}
}
class TaintFlowConf extends TaintTracking::Configuration {
TaintFlowConf() { this = "qltest:taintFlowConf" }
override predicate isSource(DataFlow::Node n) {
n.asExpr().(MethodAccess).getMethod().hasName("source")
}
override predicate isSink(DataFlow::Node n) {
n.asExpr().(Argument).getCall().getCallee().hasName("sink")
}
}
class HasFlowTest extends InlineExpectationsTest {
HasFlowTest() { this = "HasFlowTest" }
override string getARelevantTag() { result = ["hasValueFlow", "hasTaintFlow"] }
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasValueFlow" and
exists(DataFlow::Node src, DataFlow::Node sink, ValueFlowConf conf | conf.hasFlow(src, sink) |
sink.getLocation() = location and
element = sink.toString() and
value = ""
)
or
tag = "hasTaintFlow" and
exists(DataFlow::Node src, DataFlow::Node sink, TaintFlowConf conf |
conf.hasFlow(src, sink) and not any(ValueFlowConf c).hasFlow(src, sink)
|
sink.getLocation() = location and
element = sink.toString() and
value = ""
)
}
}

View File

@@ -28,6 +28,7 @@ import android.os.UserHandle;
import android.view.View;
public class Activity extends ContextWrapper {
public static final int RESULT_OK = -1;
public void onCreate(Bundle savedInstanceState) {}
@@ -347,6 +348,8 @@ public class Activity extends ContextWrapper {
public void onActivityReenter(int resultCode, Intent data) {}
protected void onActivityResult(int requestCode, int resultCode, Intent data) {}
public int getRequestedOrientation() {
return 0;
}