Android ContentProvider.openFile does not check mode initital commit

Initial commit for work on a query finding instances where the `mode`
parameter of an override of the `openFile` method of the
`android.content.ContentProvider` class
This commit is contained in:
Ed Minnix
2022-09-19 10:32:02 -04:00
parent 00891fa455
commit e37f62bb5e

View File

@@ -0,0 +1,27 @@
/**
* @name Misconfigured ContentProvider use
* @description ContentProvider#openFile override which does not use `mode` argument.
* @kind problem
* @id java/android/misconfigured-content-provider
* @problem.severity warning
* @security-severity 7.8
* @tags security external/cwe/cwe-276
* @precision medium
*/
import java
class ContentProviderOpenFileMethod extends Method {
ContentProviderOpenFileMethod() {
this.hasName("openFile") and
this.getDeclaringType().getASupertype*().hasQualifiedName("android.content", "ContentProvider")
}
predicate doesNotCheckMode() {
exists(Parameter p | p = this.getParameter(1) | not exists(p.getAnAccess()))
}
}
from ContentProviderOpenFileMethod ofm
where ofm.doesNotCheckMode()
select ofm, "Open file"