Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 28c9657

Browse files
aibaarsaibaars
committed
Move query sinks into SQLite.qll
1 parent b3aae27 commit 28c9657

2 files changed

Lines changed: 165 additions & 130 deletions

File tree

‎java/ql/src/semmle/code/java/frameworks/android/SQLite.qll‎

Lines changed: 162 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import java
2+
import Android
23

34
/**
45
* The class `android.database.sqlite.SQLiteDatabase`.
@@ -28,7 +29,10 @@ abstract class SQLiteRunner extends Method {
2829
class ExecSqlMethod extends SQLiteRunner {
2930
ExecSqlMethod() {
3031
this.getDeclaringType() instanceof TypeSQLiteDatabase and
31-
this.getName() = "execSql"
32+
// execPerConnectionSQL(String sql, Object[] bindArgs)
33+
// execSQL(String sql)
34+
// execSQL(String sql, Object[] bindArgs)
35+
this.hasName(["execPerConnectionSQL", "execSQL"])
3236
}
3337

3438
override int sqlIndex() { result = 0 }
@@ -37,26 +41,179 @@ class ExecSqlMethod extends SQLiteRunner {
3741
class QueryMethod extends SQLiteRunner {
3842
QueryMethod() {
3943
this.getDeclaringType() instanceof TypeSQLiteDatabase and
40-
this.getName().matches("rawQuery%")
44+
this.hasName(["query", "queryWithFactory"])
4145
}
4246

4347
override int sqlIndex() {
48+
// query(boolean distinct, String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit)
49+
// query(boolean distinct, String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit, CancellationSignal cancellationSignal)
50+
// query(String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit)
51+
// query(String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy)
4452
this.getName() = "query" and
45-
(if this.getParameter(0).getType() instanceof TypeString then result = 2 else result = 3)
53+
(
54+
if this.getParameter(0).getType() instanceof TypeString
55+
then result = [2, 4, 5, 6, 7]
56+
else result = [3, 5, 6, 7, 8]
57+
)
4658
or
47-
this.getName() = "queryWithFactory" and result = 4
59+
// queryWithFactory(SQLiteDatabase.CursorFactory cursorFactory, boolean distinct, String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit, CancellationSignal cancellationSignal)
60+
// queryWithFactory(SQLiteDatabase.CursorFactory cursorFactory, boolean distinct, String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit)
61+
this.getName() = "queryWithFactory" and result = [4, 6, 7, 8, 9]
4862
}
4963
}
5064

5165
class RawQueryMethod extends SQLiteRunner {
5266
RawQueryMethod() {
5367
this.getDeclaringType() instanceof TypeSQLiteDatabase and
54-
this.getName().matches("rawQuery%")
68+
this.hasName(["rawQuery", "rawQueryWithFactory"])
5569
}
5670

5771
override int sqlIndex() {
72+
// rawQuery(String sql, String[] selectionArgs, CancellationSignal cancellationSignal)
73+
// rawQuery(String sql, String[] selectionArgs)
5874
this.getName() = "rawQuery" and result = 0
5975
or
76+
// rawQueryWithFactory(SQLiteDatabase.CursorFactory cursorFactory, String sql, String[] selectionArgs, String editTable, CancellationSignal cancellationSignal)
77+
// rawQueryWithFactory(SQLiteDatabase.CursorFactory cursorFactory, String sql, String[] selectionArgs, String editTable)
6078
this.getName() = "rawQueryWithFactory" and result = 1
6179
}
6280
}
81+
82+
class CompileStatementMethod extends SQLiteRunner {
83+
CompileStatementMethod() {
84+
this.getDeclaringType() instanceof TypeSQLiteDatabase and
85+
// compileStatement(String sql)
86+
this.hasName("compileStatement")
87+
}
88+
89+
override int sqlIndex() { result = 0 }
90+
}
91+
92+
class DeleteMethod extends SQLiteRunner {
93+
DeleteMethod() {
94+
this.getDeclaringType() instanceof TypeSQLiteDatabase and
95+
// delete(String table, String whereClause, String[] whereArgs)
96+
this.hasName("delete")
97+
}
98+
99+
override int sqlIndex() { result = 1 }
100+
}
101+
102+
class UpdateMethod extends SQLiteRunner {
103+
UpdateMethod() {
104+
this.getDeclaringType() instanceof TypeSQLiteDatabase and
105+
// update(String table, ContentValues values, String whereClause, String[] whereArgs)
106+
// updateWithOnConflict(String table, ContentValues values, String whereClause, String[] whereArgs, int conflictAlgorithm)
107+
this.hasName(["update", "updateWithOnConflict"])
108+
}
109+
110+
override int sqlIndex() { result = 2 }
111+
}
112+
113+
class ForQueryMethod extends SQLiteRunner {
114+
ForQueryMethod() {
115+
// (blobFileDescriptor|long|string)ForQuery(SQLiteDatabase db, String query, String[] selectionArgs)
116+
this.getDeclaringType() instanceof TypeDatabaseUtils and
117+
this.hasName(["blobFileDescriptorForQuery", "longForQuery", "stringForQuery"]) and
118+
this.getNumberOfParameters() = 3
119+
}
120+
121+
override int sqlIndex() { result = 1 }
122+
}
123+
124+
class CreateDbFromSqlStatementsMethod extends SQLiteRunner {
125+
CreateDbFromSqlStatementsMethod() {
126+
// createDbFromSqlStatements(Context context, String dbName, int dbVersion, String sqlStatements)
127+
this.getDeclaringType() instanceof TypeDatabaseUtils and
128+
this.hasName("createDbFromSqlStatements")
129+
}
130+
131+
override int sqlIndex() { result = 3 }
132+
}
133+
134+
class QueryNumEntriesMethod extends SQLiteRunner {
135+
QueryNumEntriesMethod() {
136+
// queryNumEntries(SQLiteDatabase db, String table, String selection)
137+
// queryNumEntries(SQLiteDatabase db, String table, String selection, String[] selectionArgs)
138+
this.getDeclaringType() instanceof TypeDatabaseUtils and
139+
this.hasName("queryNumEntries")
140+
}
141+
142+
override int sqlIndex() { result = 2 }
143+
}
144+
145+
class QueryBuilderDeleteMethod extends SQLiteRunner {
146+
QueryBuilderDeleteMethod() {
147+
// delete(SQLiteDatabase db, String selection, String[] selectionArgs)
148+
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
149+
this.hasName("delete")
150+
}
151+
152+
override int sqlIndex() { result = [-1, 1] }
153+
}
154+
155+
class QueryBuilderInsertMethod extends SQLiteRunner {
156+
QueryBuilderInsertMethod() {
157+
// insert(SQLiteDatabase db, ContentValues values)
158+
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
159+
this.hasName("insert")
160+
}
161+
162+
override int sqlIndex() { result = -1 }
163+
}
164+
165+
class QueryBuilderQueryMethod extends SQLiteRunner {
166+
QueryBuilderQueryMethod() {
167+
// query(SQLiteDatabase db, String[] projectionIn, String selection, String[] selectionArgs, String groupBy, String having, String sortOrder)
168+
// query(SQLiteDatabase db, String[] projectionIn, String selection, String[] selectionArgs, String groupBy, String having, String sortOrder, String limit)
169+
// query(SQLiteDatabase db, String[] projectionIn, String selection, String[] selectionArgs, String groupBy, String having, String sortOrder, String limit, CancellationSignal cancellationSignal)
170+
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
171+
this.hasName("query")
172+
}
173+
174+
override int sqlIndex() { result = [-1, 3, 5, 6, 7, 8] }
175+
}
176+
177+
class QueryBuilderUpdateMethod extends SQLiteRunner {
178+
QueryBuilderUpdateMethod() {
179+
// update(SQLiteDatabase db, ContentValues values, String selection, String[] selectionArgs)
180+
this.getDeclaringType().getASourceSupertype*() instanceof TypeSQLiteQueryBuilder and
181+
this.hasName("update")
182+
}
183+
184+
override int sqlIndex() { result = [-1, 2] }
185+
}
186+
187+
class ContentProviderDeleteMethod extends SQLiteRunner {
188+
ContentProviderDeleteMethod() {
189+
// delete(Uri uri, String selection, String[] selectionArgs)
190+
this.getDeclaringType() instanceof AndroidContentProvider and
191+
this.hasName("delete") and
192+
this.getNumberOfParameters() = 3
193+
}
194+
195+
override int sqlIndex() { result = 1 }
196+
}
197+
198+
class ContentProviderQueryMethod extends SQLiteRunner {
199+
ContentProviderQueryMethod() {
200+
// query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder, CancellationSignal cancellationSignal)
201+
// query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder)
202+
this.getDeclaringType() instanceof AndroidContentProvider and
203+
this.hasName("query") and
204+
this.getNumberOfParameters() = [5, 6]
205+
}
206+
207+
override int sqlIndex() { result = 2 }
208+
}
209+
210+
class ContentProviderUpdateMethod extends SQLiteRunner {
211+
ContentProviderUpdateMethod() {
212+
// update(Uri uri, ContentValues values, String selection, String[] selectionArgs)
213+
this.getDeclaringType() instanceof AndroidContentProvider and
214+
this.hasName("update") and
215+
this.getNumberOfParameters() = 4
216+
}
217+
218+
override int sqlIndex() { result = 2 }
219+
}

‎java/ql/src/semmle/code/java/security/QueryInjection.qll‎

Lines changed: 3 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@ private class SqlInjectionSink extends QueryInjectionSink {
3434
or
3535
exists(MethodAccess ma, Method m, int index |
3636
ma.getMethod() = m and
37-
ma.getArgument(index) = this.asExpr()
37+
if index = -1
38+
then this.asExpr() = ma.getQualifier()
39+
else ma.getArgument(index) = this.asExpr()
3840
|
3941
index = m.(SQLiteRunner).sqlIndex()
4042
or
@@ -90,127 +92,3 @@ private class MongoJsonStep extends AdditionalQueryInjectionTaintStep {
9092
)
9193
}
9294
}
93-
94-
/** A sink for Android database injection vulnerabilities. */
95-
private class AndroidDatabaseUtils extends QueryInjectionSink {
96-
AndroidDatabaseUtils() {
97-
exists(MethodAccess call, Method method |
98-
method = call.getMethod() and
99-
method.getDeclaringType().hasQualifiedName("android.database", "DatabaseUtils") and
100-
(
101-
// (blobFileDescriptor|long|string)ForQuery(SQLiteDatabase db, String query, String[] selectionArgs)
102-
method.hasName(["blobFileDescriptorForQuery", "longForQuery", "stringForQuery"]) and
103-
method.getNumberOfParameters() = 3 and
104-
this.asExpr() = call.getArgument(1)
105-
or
106-
// createDbFromSqlStatements(Context context, String dbName, int dbVersion, String sqlStatements)
107-
method.hasName("createDbFromSqlStatements") and
108-
this.asExpr() = call.getArgument(3)
109-
or
110-
// queryNumEntries(SQLiteDatabase db, String table, String selection)
111-
// queryNumEntries(SQLiteDatabase db, String table, String selection, String[] selectionArgs)
112-
method.hasName("queryNumEntries") and
113-
this.asExpr() = call.getArgument(2)
114-
)
115-
or
116-
method
117-
.getDeclaringType()
118-
.getASourceSupertype*()
119-
.hasQualifiedName("android.database.sqlite", "SQLiteDatabase") and
120-
(
121-
// compileStatement(String sql)
122-
method.hasName("compileStatement") and
123-
this.asExpr() = call.getArgument(0)
124-
or
125-
// delete(String table, String whereClause, String[] whereArgs)
126-
method.hasName("delete") and
127-
this.asExpr() = call.getArgument(1)
128-
or
129-
// execPerConnectionSQL(String sql, Object[] bindArgs)
130-
// execSQL(String sql)
131-
// execSQL(String sql, Object[] bindArgs)
132-
method.hasName(["execPerConnectionSQL", "execSQL"]) and
133-
this.asExpr() = call.getArgument(0)
134-
or
135-
// query(boolean distinct, String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit)
136-
// query(boolean distinct, String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit, CancellationSignal cancellationSignal)
137-
// query(String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit)
138-
// query(String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy)
139-
method.hasName("query") and
140-
(
141-
this.asExpr() = call.getArgument([3, 5, 6, 7, 8]) and
142-
method.getNumberOfParameters() = [9, 10]
143-
or
144-
this.asExpr() = call.getArgument([2, 4, 5, 6, 7]) and
145-
method.getNumberOfParameters() = [7, 8]
146-
)
147-
or
148-
// queryWithFactory(SQLiteDatabase.CursorFactory cursorFactory, boolean distinct, String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit, CancellationSignal cancellationSignal)
149-
// queryWithFactory(SQLiteDatabase.CursorFactory cursorFactory, boolean distinct, String table, String[] columns, String selection, String[] selectionArgs, String groupBy, String having, String orderBy, String limit)
150-
method.hasName("queryWithFactory") and
151-
this.asExpr() = call.getArgument([4, 6, 7, 8, 9])
152-
or
153-
// rawQuery(String sql, String[] selectionArgs, CancellationSignal cancellationSignal)
154-
// rawQuery(String sql, String[] selectionArgs)
155-
method.hasName("rawQuery") and
156-
this.asExpr() = call.getArgument(0)
157-
or
158-
// rawQueryWithFactory(SQLiteDatabase.CursorFactory cursorFactory, String sql, String[] selectionArgs, String editTable, CancellationSignal cancellationSignal)
159-
// rawQueryWithFactory(SQLiteDatabase.CursorFactory cursorFactory, String sql, String[] selectionArgs, String editTable)
160-
method.hasName("rawQueryWithFactory") and
161-
this.asExpr() = call.getArgument(1)
162-
or
163-
// update(String table, ContentValues values, String whereClause, String[] whereArgs)
164-
// updateWithOnConflict(String table, ContentValues values, String whereClause, String[] whereArgs, int conflictAlgorithm)
165-
method.hasName(["update", "updateWithOnConflict"]) and
166-
this.asExpr() = call.getArgument(2)
167-
)
168-
or
169-
method
170-
.getDeclaringType()
171-
.getASourceSupertype*()
172-
.hasQualifiedName("android.content", "ContentProvider") and
173-
(
174-
// delete(Uri uri, String selection, String[] selectionArgs)
175-
method.hasName("delete") and
176-
this.asExpr() = call.getArgument(1) and
177-
method.getNumberOfParameters() = 3
178-
or
179-
// query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder, CancellationSignal cancellationSignal)
180-
// query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder)
181-
method.hasName("query") and
182-
method.getNumberOfParameters() = [5, 6] and
183-
this.asExpr() = call.getArgument(2)
184-
or
185-
// update(Uri uri, ContentValues values, String selection, String[] selectionArgs)
186-
method.hasName("update") and
187-
this.asExpr() = call.getArgument(2) and
188-
method.getNumberOfParameters() = 4
189-
)
190-
or
191-
method
192-
.getDeclaringType()
193-
.getASourceSupertype*()
194-
.hasQualifiedName("android.database.sqlite", "SQLiteQueryBuilder") and
195-
(
196-
// delete(SQLiteDatabase db, String selection, String[] selectionArgs)
197-
method.hasName("delete") and
198-
(this.asExpr() = call.getArgument(1) or this.asExpr() = call.getQualifier())
199-
or
200-
// insert(SQLiteDatabase db, ContentValues values)
201-
method.hasName("update") and
202-
this.asExpr() = call.getQualifier()
203-
or
204-
// query(SQLiteDatabase db, String[] projectionIn, String selection, String[] selectionArgs, String groupBy, String having, String sortOrder)
205-
// query(SQLiteDatabase db, String[] projectionIn, String selection, String[] selectionArgs, String groupBy, String having, String sortOrder, String limit)
206-
// query(SQLiteDatabase db, String[] projectionIn, String selection, String[] selectionArgs, String groupBy, String having, String sortOrder, String limit, CancellationSignal cancellationSignal)
207-
method.hasName("query") and
208-
(this.asExpr() = call.getArgument([3, 5, 6, 7, 8]) or this.asExpr() = call.getQualifier())
209-
or
210-
// update(SQLiteDatabase db, ContentValues values, String selection, String[] selectionArgs)
211-
method.hasName("update") and
212-
(this.asExpr() = call.getArgument(2) or this.asExpr() = call.getQualifier())
213-
)
214-
)
215-
}
216-
}

0 commit comments

Comments
 (0)