hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Felicity Chapman <felicitymay@github.com>
This commit is contained in:
Tony Torralba
2022-10-17 10:12:56 +02:00
committed by GitHub
parent ceae5eef28
commit c909b8824c
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-441/UnsafeContentUriResolution.java
View File

@@ -10,7 +10,7 @@ public class Example extends Activity {
InputStream is = contentResolver.openInputStream(uri);
copyToExternalCache(is);
}
// BAD: input Uri is not normalized, and check can be bypassed with ".." characters
// BAD: input URI is not normalized, and check can be bypassed with ".." characters
{
ContentResolver contentResolver = getContentResolver();
Uri uri = (Uri) getIntent().getParcelableExtra("URI_EXTRA");
@@ -20,7 +20,7 @@ public class Example extends Activity {
InputStream is = contentResolver.openInputStream(uri);
copyToExternalCache(is);
}
// GOOD: URI gets properly validated to avoid access to internal files
// GOOD: URI is properly validated to block access to internal files
{
ContentResolver contentResolver = getContentResolver();
Uri uri = (Uri) getIntent().getParcelableExtra("URI_EXTRA");

2
java/ql/src/Security/CWE/CWE-441/UnsafeContentUriResolution.qhelp
View File

@@ -30,7 +30,7 @@
<example>
<p>
This example shows two ways of opening a file using a <code>ContentResolver</code>. In the first case, externally-provided
data coming from an intent is directly used in the file-reading operation, allowing an attacker to provide a URI
data from an intent is used directly in the file-reading operation. This allows an attacker to provide a URI
of the form <code>/data/data/(vulnerable app package)/(private file)</code> to trick the application into reading it and
copying it to the external storage. In the second case, the URI is validated before being used, making sure it does not reference
any internal application files.