Revert "Android ContentProvider.openFile does not check mode initital commit"

This reverts commit e37f62bb5e.

The MisconfiguedContentProviderUse.ql file provided a sample query which
will be useful in future checks for CVE-2021-41166, but is not needed
for the current manifest-focused check
This commit is contained in:
Ed Minnix
2022-09-29 14:43:18 -04:00
parent e72963986f
commit f2bda1525a

View File

@@ -1,27 +0,0 @@
/**
* @name Misconfigured ContentProvider use
* @description ContentProvider#openFile override which does not use `mode` argument.
* @kind problem
* @id java/android/misconfigured-content-provider
* @problem.severity warning
* @security-severity 7.8
* @tags security external/cwe/cwe-276
* @precision medium
*/
import java
class ContentProviderOpenFileMethod extends Method {
ContentProviderOpenFileMethod() {
this.hasName("openFile") and
this.getDeclaringType().getASupertype*().hasQualifiedName("android.content", "ContentProvider")
}
predicate doesNotCheckMode() {
exists(Parameter p | p = this.getParameter(1) | not exists(p.getAnAccess()))
}
}
from ContentProviderOpenFileMethod ofm
where ofm.doesNotCheckMode()
select ofm, "Open file"