diff --git a/java/ql/lib/semmle/code/java/security/AndroidIntentRedirection.qll b/java/ql/lib/semmle/code/java/security/AndroidIntentRedirection.qll index 641c3489c04..4a89b59f8c9 100644 --- a/java/ql/lib/semmle/code/java/security/AndroidIntentRedirection.qll +++ b/java/ql/lib/semmle/code/java/security/AndroidIntentRedirection.qll @@ -71,11 +71,12 @@ private class DefaultIntentRedirectionSink extends IntentRedirectionSink { */ private class DefaultIntentRedirectionSanitizer extends IntentRedirectionSanitizer { DefaultIntentRedirectionSanitizer() { - exists(MethodAccess ma, Method m | + exists(MethodAccess ma, Method m, Guard g, boolean branch | ma.getMethod() = m and m.getDeclaringType() instanceof TypeComponentName and m.hasName(["getPackageName", "getClassName"]) and - ma.getBasicBlock().(ConditionBlock).controls(this.asExpr().getBasicBlock(), true) + g.isEquality(ma, _, branch) and + g.controls(this.asExpr().getBasicBlock(), branch) ) } } diff --git a/java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirectionSample.java b/java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirectionSample.java index ee2d72bfec5..1c29a48b9cf 100644 --- a/java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirectionSample.java +++ b/java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirectionSample.java @@ -13,6 +13,6 @@ if (destinationComponent.getPackageName().equals("safe.package") && // GOOD: The component that sent the Intent is checked before launching the destination component Intent forwardIntent = (Intent) getIntent().getParcelableExtra("forward_intent"); ComponentName originComponent = getCallingActivity(); -if (originComponent.getPackageName().equals("trusted.package") && originComponent.getClassName("TrustedClass")) { +if (originComponent.getPackageName().equals("trusted.package") && originComponent.getClassName().equals("TrustedClass")) { startActivity(forwardIntent); }