Added severity

Removed duplicated code
This commit is contained in:
Tony Torralba
2021-10-27 14:00:10 +02:00
parent ec8ffeed07
commit e1d30ebc09
2 changed files with 1 additions and 3 deletions

View File

@@ -51,9 +51,6 @@ private class IntentFlagsOrDataChangedSanitizer extends IntentUriPermissionManip
TaintTracking::localExprTaint(any(GrantWriteUriPermissionFlag f).getAnAccess(),
ma.getArgument(0))
or
ma.getMethod() = m and
m.getDeclaringType() instanceof TypeIntent and
this.asExpr() = ma.getQualifier() and
m.hasName("setFlags") and
not TaintTracking::localExprTaint(any(GrantUriPermissionFlag f).getAnAccess(),
ma.getArgument(0))

View File

@@ -5,6 +5,7 @@
* arbitrary Content Providers that are accessible by the vulnerable application.
* @kind path-problem
* @problem.severity error
* @security-severity 7.8
* @precision high
* @id java/android/intent-uri-permission-manipulation
* @tags security