hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Introduce TaintInheritingContent instead of using parts of DataFlowPrivate

Browse Source
This commit is contained in:
Chris Smowton
2021-10-07 11:20:19 +01:00
parent f88c8a64a1
commit b7448d55ed
4 changed files with 30 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
java/ql/src/experimental/Security/CWE/CWE-200/SensitiveAndroidFileLeak.ql
View File

@@ -14,8 +14,6 @@ import semmle.code.java.controlflow.Guards
import AndroidFileIntentSink
import AndroidFileIntentSource
import DataFlow::PathGraph
// For readStep, to implement `isAdditionalTaintStep`
private import semmle.code.java.dataflow.internal.DataFlowPrivate
private class StartsWithSanitizer extends DataFlow::BarrierGuard {
StartsWithSanitizer() { this.(MethodAccess).getMethod().hasName("startsWith") }
@@ -73,11 +71,6 @@ class AndroidFileLeakConfig extends TaintTracking::Configuration {
prev.asExpr() = csma.getArgument(0) and
succ.asParameter() = ssm.getParameter(0) // public int onStartCommand(Intent intent, int flags, int startId) {...} in FileUploader
)
or
// When a whole Intent is tainted (e.g., due to this Configuration's source), treat its fields as tainted
readStep(prev,
any(DataFlow::SyntheticFieldContent c | c.getField().matches("android.content.Intent.%")),
succ)
}
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {