hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-20 14:34:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #15869 from egregius313/egregius313/java/fix/parcelfiledescriptor-open-sink

Browse Source 
Java: Add path-injection sink for `ParcelFileDescriptor::open`
This commit is contained in:
Edward Minnix III
2024-03-12 16:39:20 -04:00
committed by GitHub
parent 863e3f79e5 76aeee2820
commit d54489931c
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/change-notes/2024-03-11-add-parcelfiledescriptor-open-model.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added a `path-injection` sink for the `open` methods of the `android.os.ParcelFileDescriptor` class.

5
java/ql/lib/ext/android.os.model.yml
View File

@@ -132,3 +132,8 @@ extensions:
- ["android.os", "Parcel", False, "readTypedList", "", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- ["android.os", "Parcel", False, "readTypedObject", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
- ["android.os", "Parcel", False, "readValue", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
- addsTo:
pack: codeql/java-all
extensible: sinkModel
data:
- ["android.os", "ParcelFileDescriptor", False, "open", "", "", "Argument[0]", "path-injection", "manual"]