hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

QLDoc improvements from code review

Browse Source 
Co-authored-by: Felicity Chapman <felicitymay@github.com>
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
This commit is contained in:
Tony Torralba
2021-07-29 16:34:21 +02:00
committed by GitHub
parent 4622d8590b
commit bdf0f582a4
4 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/change-notes/2021-05-06-unsafe-android-access-query.md
View File

@@ -1,2 +1,2 @@
lgtm,codescanning
* The query "Unsafe resource fetching in Android webview" (`java/android/unsafe-android-webview-fetch`) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @luchua-bc](https://github.com/github/codeql/pull/3706).
* The query "Unsafe resource fetching in Android WebView" (`java/android/unsafe-android-webview-fetch`) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @luchua-bc](https://github.com/github/codeql/pull/3706).

8
java/ql/src/Security/CWE/CWE-749/UnsafeAndroidAccess.ql
View File

@@ -1,7 +1,7 @@
/**
* @name Unsafe resource fetching in Android webview
* @description JavaScript rendered inside WebViews can access any protected
* application file and web resource from any origin
* @name Unsafe resource fetching in Android WebView
* @description JavaScript rendered inside WebViews can access protected
* application files and web resources from any origin exposing them to attack.
* @kind path-problem
* @problem.severity warning
* @precision medium
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink, FetchUntrustedResourceConfiguration conf
where conf.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Unsafe resource fetching in Android webview due to $@.",
select sink.getNode(), source, sink, "Unsafe resource fetching in Android WebView due to $@.",
source.getNode(), sink.getNode().(UrlResourceSink).getSinkType()

12
java/ql/src/semmle/code/java/security/UnsafeAndroidAccess.qll
View File

@@ -14,15 +14,15 @@ private import semmle.code.java.dataflow.ExternalFlow
*/
abstract class UrlResourceSink extends DataFlow::Node {
/**
* Returns a description of this vulnerability,
* Gets a description of this vulnerability.
*/
abstract string getSinkType();
}
/**
* Cross-origin access enabled resource fetch.
* A cross-origin access enabled resource fetch.
*
* It requires JavaScript to be enabled too to be considered a valid sink.
* Only considered a valid sink when JavaScript is also enabled.
*/
private class CrossOriginUrlResourceSink extends JavaScriptEnabledUrlResourceSink {
CrossOriginUrlResourceSink() {
@@ -61,7 +61,7 @@ private class JavaScriptEnabledUrlResourceSink extends UrlResourceSink {
}
/**
* Methods allowing any-local-file and cross-origin access in the WebSettings class
* A method allowing any-local-file and cross-origin access in the WebSettings class.
*/
private class CrossOriginAccessMethod extends Method {
CrossOriginAccessMethod() {
@@ -71,7 +71,7 @@ private class CrossOriginAccessMethod extends Method {
}
/**
* `setJavaScriptEnabled` method for the webview
* The `setJavaScriptEnabled` method for the webview.
*/
private class AllowJavaScriptMethod extends Method {
AllowJavaScriptMethod() {
@@ -81,7 +81,7 @@ private class AllowJavaScriptMethod extends Method {
}
/**
* Holds if a call to `v.setJavaScriptEnabled(true)` exists
* Holds if a call to `v.setJavaScriptEnabled(true)` exists.
*/
private predicate isJSEnabled(Variable v) {
exists(MethodAccess jsa |

2
java/ql/src/semmle/code/java/security/UnsafeAndroidAccessQuery.qll
View File

@@ -7,7 +7,7 @@ import semmle.code.java.security.RequestForgery
import semmle.code.java.security.UnsafeAndroidAccess
/**
* Taint configuration tracking flow from untrusted inputs to a resource fetching call.
* A taint configuration tracking flow from untrusted inputs to a resource fetching call.
*/
class FetchUntrustedResourceConfiguration extends TaintTracking::Configuration {
FetchUntrustedResourceConfiguration() { this = "FetchUntrustedResourceConfiguration" }