resolved merge conflict in AndroidManifest

Jami Cogswell · Jami Cogswell · commit 084b9830bccf · 2022-08-22T12:41:22.000-04:00
diff --git a/java/ql/lib/semmle/code/xml/AndroidManifest.qll b/java/ql/lib/semmle/code/xml/AndroidManifest.qll
@@ -68,8 +68,10 @@ class AndroidApplicationXmlElement extends XmlElement {
     )
   }
 
-  /** Holds if this component element has an attribute with the name `permission`. */
-  predicate hasPermissionAttribute() { exists(this.getAttribute("permission")) }
+  /**
+   * Holds if this application element has explicitly set a value for its `android:permission` attribute.
+   */
+  predicate requiresPermissions() { this.getAnAttribute().(AndroidPermissionXmlAttribute).isFull() }
 }
 
 /**
@@ -234,14 +236,13 @@ class AndroidComponentXmlElement extends XmlElement {
    */
   predicate hasExportedAttribute() { this.hasAttribute("exported") }
 
-  /** Holds if this component element has an attribute with the name `permission`. */
-  predicate hasPermissionAttribute() { exists(this.getAttribute("permission")) }
-
+  // /** Holds if this component element has an attribute with the name `permission`. */
+  // predicate hasPermissionAttribute() { exists(this.getAttribute("permission")) }
   predicate isImplicitlyExported() {
     not this.hasExportedAttribute() and
     this.hasAnIntentFilterElement() and // Note: did not use getAnIntentFilterElement since don't need a return value
-    not this.hasPermissionAttribute() and
-    not this.getParent().(AndroidApplicationXmlElement).hasPermissionAttribute() and
+    not this.hasAttribute("permission") and // not seeing how isFull() is any better than this..., this seems to more directly check what I want...
+    not this.getParent().(AndroidApplicationXmlElement).hasAttribute("permission") and
     not this.getAnIntentFilterElement().hasLauncherCategoryElement() and
     not this.getFile().(AndroidManifestXmlFile).isInBuildDirectory()
   }
diff --git a/java/ql/src/Security/CWE/CWE-926/ImplicitlyExportedAndroidComponent.ql b/java/ql/src/Security/CWE/CWE-926/ImplicitlyExportedAndroidComponent.ql
@@ -7,7 +7,7 @@
  * @id java/android/implicitly-exported-component
  * @tags security
  *       external/cwe/cwe-926
- * @precision high
+ * @precision medium
  */
 
 import java
