hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Convert dataflow configuration to using new module-configuration

Browse Source
This commit is contained in:
Ed Minnix
2023-03-08 19:19:00 -05:00
parent eeb9a88c3a
commit da43a61506
3 changed files with 23 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
java/ql/lib/semmle/code/java/security/ArbitraryApkInstallationQuery.qll
View File

@@ -10,12 +10,10 @@ private import semmle.code.java.security.ArbitraryApkInstallation
* A dataflow configuration for flow from an external source of an APK to the
* `setData[AndType][AndNormalize]` method of an intent.
*/
class ApkConfiguration extends DataFlow::Configuration {
ApkConfiguration() { this = "ApkConfiguration" }
private module ApkConf implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node instanceof ExternalApkSource }
override predicate isSource(DataFlow::Node node) { node instanceof ExternalApkSource }
override predicate isSink(DataFlow::Node node) {
predicate isSink(DataFlow::Node node) {
exists(MethodAccess ma |
ma.getMethod() instanceof SetDataMethod and
ma.getArgument(0) = node.asExpr() and
@@ -28,6 +26,23 @@ class ApkConfiguration extends DataFlow::Configuration {
}
}
module ApkConfiguration = DataFlow::Make<ApkConf>;
// class ApkConfiguration extends DataFlow::Configuration {
// ApkConfiguration() { this = "ApkConfiguration" }
// override predicate isSource(DataFlow::Node node) { node instanceof ExternalApkSource }
// override predicate isSink(DataFlow::Node node) {
// exists(MethodAccess ma |
// ma.getMethod() instanceof SetDataMethod and
// ma.getArgument(0) = node.asExpr() and
// (
// any(PackageArchiveMimeTypeConfiguration c).hasFlowToExpr(ma.getQualifier())
// or
// any(InstallPackageActionConfiguration c).hasFlowToExpr(ma.getQualifier())
// )
// )
// }
// }
/**
* A dataflow configuration tracking the flow from the `android.content.Intent.ACTION_INSTALL_PACKAGE`
* constant to either the constructor of an intent or the `setAction` method of an intent.

4
java/ql/src/Security/CWE/CWE-094/ArbitraryApkInstallation.ql
View File

@@ -14,6 +14,6 @@ import java
import semmle.code.java.security.ArbitraryApkInstallationQuery
import DataFlow::PathGraph
from DataFlow::PathNode source, DataFlow::PathNode sink, ApkConfiguration config
where config.hasFlowPath(source, sink)
from DataFlow::PathNode source, DataFlow::PathNode sink
where ApkConfiguration::hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Arbitrary Android APK installation."

2
java/ql/test/query-tests/security/CWE-094/ApkInstallationTest.ql
View File

@@ -10,7 +10,7 @@ class HasApkInstallationTest extends InlineExpectationsTest {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasApkInstallation" and
exists(DataFlow::Node sink, ApkConfiguration conf | conf.hasFlowTo(sink) |
exists(DataFlow::Node sink | ApkConfiguration::hasFlowTo(sink) |
sink.getLocation() = location and
element = sink.toString() and
value = ""