hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9319 from atorralba/atorralba/add-editable-valueof-step

Browse Source 
Kotlin: Add taint step for String.valueOf(Editable)
This commit is contained in:
Tony Torralba
2022-06-22 13:50:30 +02:00
committed by GitHub
parent c0e115700d b373c435f6
commit cc354caa1f
7 changed files with 47 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/change-notes/2022-05-25-string-valueof-editable-step.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
Added a flow step for `String.valueOf` calls on tainted `android.text.Editable` objects.

20
java/ql/lib/semmle/code/java/frameworks/android/Widget.qll
View File

@@ -18,12 +18,20 @@ private class DefaultAndroidWidgetSources extends RemoteFlowSource {
private class EditableToStringStep extends AdditionalTaintStep {
override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
exists(MethodAccess toString |
toString.getMethod().hasName("toString") and
toString.getReceiverType().hasQualifiedName("android.text", "Editable")
|
n1.asExpr() = toString.getQualifier() and
n2.asExpr() = toString
exists(MethodAccess ma |
ma.getMethod().hasName("toString") and
ma.getReceiverType().getASourceSupertype*().hasQualifiedName("android.text", "Editable") and
n1.asExpr() = ma.getQualifier() and
n2.asExpr() = ma
or
ma.getMethod().hasQualifiedName("java.lang", "String", "valueOf") and
ma.getArgument(0)
.getType()
.(RefType)
.getASourceSupertype*()
.hasQualifiedName("android.text", "Editable") and
n1.asExpr() = ma.getArgument(0) and
n2.asExpr() = ma
)
}
}