Allow arbitrary read steps at the sink

joefarebrother · joefarebrother · commit 4012866c6f5a · 2021-10-20T17:09:57.000+01:00
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -84,6 +84,7 @@ private module Frameworks {
   private import semmle.code.java.frameworks.apache.Collections
   private import semmle.code.java.frameworks.apache.Lang
   private import semmle.code.java.frameworks.Flexjson
+  private import semmle.code.java.frameworks.android.Intent
   private import semmle.code.java.frameworks.guava.Guava
   private import semmle.code.java.frameworks.jackson.JacksonSerializability
   private import semmle.code.java.frameworks.javaee.jsf.JSFRenderer
diff --git a/java/ql/src/semmle/code/java/security/AndroidSensitiveBroadcastQuery.qll b/java/ql/src/semmle/code/java/security/AndroidSensitiveBroadcastQuery.qll
@@ -119,4 +119,10 @@ class SensitiveBroadcastConfig extends TaintTracking::Configuration {
       setReceiverMa.getQualifier().(VarAccess).getVariable().getAnAccess() = node.asExpr()
     )
   }
+
+  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
+    super.allowImplicitRead(node, c)
+    or
+    this.isSink(node)
+  }
 }

Original file line number	Diff line number	Diff line change
`@@ -119,4 +119,10 @@ class SensitiveBroadcastConfig extends TaintTracking::Configuration {`
`119`	`119`	`setReceiverMa.getQualifier().(VarAccess).getVariable().getAnAccess() = node.asExpr()`
`120`	`120`	`)`
`121`	`121`	`}`
	`122`	`+`
	`123`	`+ override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {`
	`124`	`+ super.allowImplicitRead(node, c)`
	`125`	`+ or`
	`126`	`+ this.isSink(node)`
	`127`	`+ }`
`122`	`128`	`}`