hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Move things around

Browse Source
This commit is contained in:
Tony Torralba
2022-03-25 11:00:05 +01:00
parent d68311e26d
commit b678467e9d
2 changed files with 31 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
java/ql/lib/semmle/code/java/frameworks/android/WebView.qll
View File

@@ -77,35 +77,6 @@ class ShouldOverrideUrlLoading extends Method {
}
}
/**
* Holds if `webview` is a `WebView` and its option `setJavascriptEnabled`
* has been set to `true` via a `WebSettings` object obtained from it.
*/
predicate isJSEnabled(DataFlow::Node webview) {
webview.getType().(RefType).getASupertype*() instanceof TypeWebView and
exists(MethodAccess allowJs, MethodAccess settings |
allowJs.getMethod() instanceof AllowJavaScriptMethod and
allowJs.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true and
settings.getMethod() instanceof WebViewGetSettingsMethod and
DataFlow::localExprFlow(settings, allowJs.getQualifier()) and
DataFlow::localFlow(webview, DataFlow::getInstanceArgument(settings))
)
}
/**
* Holds if `webview` is a `WebView` and its options `setAllowUniversalAccessFromFileURLs` or
* `setAllowFileAccessFromFileURLs` have been set to `true`.
*/
predicate isAllowFileAccessEnabled(DataFlow::Node webview) {
exists(MethodAccess allowFileAccess, MethodAccess settings |
allowFileAccess.getMethod() instanceof CrossOriginAccessMethod and
allowFileAccess.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true and
settings.getMethod() instanceof WebViewGetSettingsMethod and
DataFlow::localExprFlow(settings, allowFileAccess.getQualifier()) and
DataFlow::localFlow(webview, DataFlow::getInstanceArgument(settings))
)
}
private class WebkitSourceModels extends SourceModelCsv {
override predicate row(string row) {
row =

33
java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll
View File

@@ -43,8 +43,8 @@ private class CrossOriginUrlResourceSink extends JavaScriptEnabledUrlResourceSin
private class JavaScriptEnabledUrlResourceSink extends UrlResourceSink {
JavaScriptEnabledUrlResourceSink() {
exists(WebViewRef webview |
isJSEnabled(webview.getAnAccess()) and
webViewLoadUrl(this.asExpr(), webview.getAnAccess())
webViewLoadUrl(this.asExpr(), webview.getAnAccess()) and
isJSEnabled(webview.getAnAccess())
)
}
@@ -102,6 +102,35 @@ private predicate webViewLoadUrl(Argument urlArg, DataFlow::Node webview) {
)
}
/**
* Holds if `webview` is a `WebView` and its option `setJavascriptEnabled`
* has been set to `true` via a `WebSettings` object obtained from it.
*/
private predicate isJSEnabled(DataFlow::Node webview) {
webview.getType().(RefType).getASupertype*() instanceof TypeWebView and
exists(MethodAccess allowJs, MethodAccess settings |
allowJs.getMethod() instanceof AllowJavaScriptMethod and
allowJs.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true and
settings.getMethod() instanceof WebViewGetSettingsMethod and
DataFlow::localExprFlow(settings, allowJs.getQualifier()) and
DataFlow::localFlow(webview, DataFlow::getInstanceArgument(settings))
)
}
/**
* Holds if `webview` is a `WebView` and its options `setAllowUniversalAccessFromFileURLs` or
* `setAllowFileAccessFromFileURLs` have been set to `true`.
*/
private predicate isAllowFileAccessEnabled(DataFlow::Node webview) {
exists(MethodAccess allowFileAccess, MethodAccess settings |
allowFileAccess.getMethod() instanceof CrossOriginAccessMethod and
allowFileAccess.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true and
settings.getMethod() instanceof WebViewGetSettingsMethod and
DataFlow::localExprFlow(settings, allowFileAccess.getQualifier()) and
DataFlow::localFlow(webview, DataFlow::getInstanceArgument(settings))
)
}
/** A method of the class `WebViewClient` that handles an event. */
private class WebViewClientEventMethod extends Method {
WebViewClientEventMethod() {