hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add more sinks

Browse Source 
Also, fix things after rebase
This commit is contained in:
Tony Torralba
2021-10-18 12:00:07 +02:00
parent 28ae4c211f
commit d1d2d61d7e
8 changed files with 68 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.java
View File

@@ -17,7 +17,6 @@ public class AndroidIntentRedirectionTest extends Activity {
startActivity(intent); // $ hasAndroidIntentRedirection
startActivity(intent, null); // $ hasAndroidIntentRedirection
startActivityAsUser(intent, null); // $ hasAndroidIntentRedirection
startActivityAsUser(intent, null, null); // $ hasAndroidIntentRedirection
startActivityAsCaller(intent, null, false, 0); // $ hasAndroidIntentRedirection
startActivityForResult(intent, 0); // $ hasAndroidIntentRedirection
startActivityForResult(intent, 0, null); // $ hasAndroidIntentRedirection
@@ -25,20 +24,18 @@ public class AndroidIntentRedirectionTest extends Activity {
startActivityForResultAsUser(intent, null, 0, null, null); // $ hasAndroidIntentRedirection
startActivityForResultAsUser(intent, 0, null, null); // $ hasAndroidIntentRedirection
startActivityForResultAsUser(intent, 0, null); // $ hasAndroidIntentRedirection
bindService(intent, null, 0);
bindServiceAsUser(intent, null, 0, null);
startService(intent); // $ hasAndroidIntentRedirection
startServiceAsUser(intent, null); // $ hasAndroidIntentRedirection
startForegroundService(intent); // $ hasAndroidIntentRedirection
sendBroadcast(intent); // $ hasAndroidIntentRedirection
sendBroadcast(intent, null); // $ hasAndroidIntentRedirection
sendBroadcast(intent, null, null); // $ hasAndroidIntentRedirection
sendBroadcast(intent, null, 0); // $ hasAndroidIntentRedirection
sendBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirection
sendBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirection
sendBroadcastAsUser(intent, null, null, null); // $ hasAndroidIntentRedirection
sendBroadcastAsUser(intent, null, null, 0); // $ hasAndroidIntentRedirection
sendBroadcastWithMultiplePermissions(intent, null); // $ hasAndroidIntentRedirection
sendStickyBroadcast(intent); // $ hasAndroidIntentRedirection
sendStickyBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirection
sendStickyBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirection
sendStickyOrderedBroadcast(intent, null, null, 0, null, null); // $ hasAndroidIntentRedirection
sendStickyOrderedBroadcastAsUser(intent, null, null, null, 0, null, null); // $ hasAndroidIntentRedirection
// @formatter:on
@@ -63,56 +60,56 @@ public class AndroidIntentRedirectionTest extends Activity {
}
{
Intent fwdIntent = new Intent();
fwdIntent.setClassName((Context) null, (String) intent.getExtra("className"));
fwdIntent.setClassName((Context) null, intent.getStringExtra("className"));
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
fwdIntent.setClassName((String) intent.getExtra("packageName"), null);
fwdIntent.setClassName(intent.getStringExtra("packageName"), null);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
fwdIntent.setClassName((String) intent.getExtra("packageName"),
(String) intent.getExtra("className"));
fwdIntent.setClassName(intent.getStringExtra("packageName"),
intent.getStringExtra("className"));
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
fwdIntent.setClass(null, Class.forName((String) intent.getExtra("className")));
fwdIntent.setClass(null, Class.forName(intent.getStringExtra("className")));
// needs taint step for Class.forName
startActivity(fwdIntent); // $ MISSING: $hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
fwdIntent.setPackage((String) intent.getExtra("packageName"));
fwdIntent.setPackage(intent.getStringExtra("packageName"));
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
ComponentName component =
new ComponentName((String) intent.getExtra("packageName"), null);
new ComponentName(intent.getStringExtra("packageName"), null);
fwdIntent.setComponent(component);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
ComponentName component =
new ComponentName("", (String) intent.getExtra("className"));
new ComponentName("", intent.getStringExtra("className"));
fwdIntent.setComponent(component);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
ComponentName component =
new ComponentName((Context) null, (String) intent.getExtra("className"));
new ComponentName((Context) null, intent.getStringExtra("className"));
fwdIntent.setComponent(component);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
ComponentName component = new ComponentName((Context) null,
Class.forName((String) intent.getExtra("className")));
Class.forName(intent.getStringExtra("className")));
fwdIntent.setComponent(component);
// needs taint step for Class.forName
startActivity(fwdIntent); // $ MISSING: $hasAndroidIntentRedirection
@@ -120,21 +117,21 @@ public class AndroidIntentRedirectionTest extends Activity {
{
Intent fwdIntent = new Intent();
ComponentName component =
ComponentName.createRelative("", (String) intent.getExtra("className"));
ComponentName.createRelative("", intent.getStringExtra("className"));
fwdIntent.setComponent(component);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
ComponentName component =
ComponentName.createRelative((String) intent.getExtra("packageName"), "");
ComponentName.createRelative(intent.getStringExtra("packageName"), "");
fwdIntent.setComponent(component);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}
{
Intent fwdIntent = new Intent();
ComponentName component = ComponentName.createRelative((Context) null,
(String) intent.getExtra("className"));
intent.getStringExtra("className"));
fwdIntent.setComponent(component);
startActivity(fwdIntent); // $ hasAndroidIntentRedirection
}

7
java/ql/test/stubs/google-android-9.0.0/android/app/Activity.java generated
View File

@@ -51,11 +51,6 @@ public class Activity extends ContextWrapper {
public void onStateNotSaved() {}
@Override
public int getNextAutofillId() {
return 0;
}
public boolean isVoiceInteraction() {
return false;
}
@@ -373,7 +368,7 @@ public class Activity extends ContextWrapper {
}
@Override
public Object getSystemService(@ServiceName @NonNull String name) {
public Object getSystemService(@NonNull String name) {
return null;
}

4
java/ql/test/stubs/google-android-9.0.0/android/app/Fragment.java generated
View File

@@ -28,6 +28,10 @@ public class Fragment {
@Override
public void writeToParcel(Parcel dest, int flags) {}
@Override
public int describeContents() {
return 0;
}
}
static public class InstantiationException {

3
java/ql/test/stubs/google-android-9.0.0/android/content/Context.java generated
View File

@@ -36,6 +36,7 @@ abstract public class Context
public abstract ClassLoader getClassLoader();
public abstract ComponentName startForegroundService(Intent p0);
public abstract ComponentName startService(Intent p0);
public abstract ComponentName startServiceAsUser(Intent p0, UserHandle p1);
public abstract ContentResolver getContentResolver();
public abstract Context createConfigurationContext(Configuration p0);
public abstract Context createContextForSplit(String p0);
@@ -81,6 +82,7 @@ abstract public class Context
public abstract String[] databaseList();
public abstract String[] fileList();
public abstract boolean bindService(Intent p0, ServiceConnection p1, int p2);
public abstract boolean bindServiceAsUser(Intent p0, ServiceConnection p1, int p2, UserHandle p3);
public abstract boolean deleteDatabase(String p0);
public abstract boolean deleteFile(String p0);
public abstract boolean deleteSharedPreferences(String p0);
@@ -132,6 +134,7 @@ abstract public class Context
public abstract void startActivities(Intent[] p0, Bundle p1);
public abstract void startActivity(Intent p0);
public abstract void startActivity(Intent p0, Bundle p1);
public abstract void startActivityAsUser(Intent intent, UserHandle user);
public abstract void startIntentSender(IntentSender p0, Intent p1, int p2, int p3, int p4);
public abstract void startIntentSender(IntentSender p0, Intent p1, int p2, int p3, int p4, Bundle p5);
public abstract void unbindService(ServiceConnection p0);

3
java/ql/test/stubs/google-android-9.0.0/android/content/ContextWrapper.java generated
View File

@@ -71,6 +71,7 @@ public class ContextWrapper extends Context {
@Override public ClassLoader getClassLoader() { return null; }
@Override public ComponentName startForegroundService(Intent p0) { return null; }
@Override public ComponentName startService(Intent p0) { return null; }
@Override public ComponentName startServiceAsUser(Intent p0, UserHandle p1) { return null; }
@Override public ContentResolver getContentResolver() { return null; }
@Override public Context createConfigurationContext(Configuration p0) { return null; }
@Override public Context createContextForSplit(String p0) { return null; }
@@ -116,6 +117,7 @@ public class ContextWrapper extends Context {
@Override public String[] databaseList() { return null; }
@Override public String[] fileList() { return null; }
@Override public boolean bindService(Intent p0, ServiceConnection p1, int p2) { return false; }
@Override public boolean bindServiceAsUser(Intent p0, ServiceConnection p1, int p2, UserHandle p3) { return false; }
@Override public boolean deleteDatabase(String p0) { return false; }
@Override public boolean deleteFile(String p0) { return false; }
@Override public boolean deleteSharedPreferences(String p0) { return false; }
@@ -167,6 +169,7 @@ public class ContextWrapper extends Context {
@Override public void startActivities(Intent[] p0, Bundle p1) { }
@Override public void startActivity(Intent p0) { }
@Override public void startActivity(Intent p0, Bundle p1) { }
@Override public void startActivityAsUser(Intent p0, UserHandle p1) { }
@Override public void startIntentSender(IntentSender p0, Intent p1, int p2, int p3, int p4) { }
@Override public void startIntentSender(IntentSender p0, Intent p1, int p2, int p3, int p4, Bundle p5) { }
@Override public void unbindService(ServiceConnection p0) { }