|
| 1 | +/** Provides classes and predicates to reason about cleartext storage in Android databases. */ |
| 2 | + |
| 3 | +import java |
| 4 | +import semmle.code.java.dataflow.DataFlow |
| 5 | +import semmle.code.java.frameworks.android.ContentProviders |
| 6 | +import semmle.code.java.frameworks.android.Intent |
| 7 | +import semmle.code.java.frameworks.android.SQLite |
| 8 | +import semmle.code.java.security.CleartextStorageQuery |
| 9 | + |
| 10 | +private class LocalDatabaseCleartextStorageSink extends CleartextStorageSink { |
| 11 | + LocalDatabaseCleartextStorageSink() { localDatabaseInput(_, this.asExpr()) } |
| 12 | +} |
| 13 | + |
| 14 | +private class LocalDatabaseCleartextStorageStep extends CleartextStorageAdditionalTaintStep { |
| 15 | + override predicate step(DataFlow::Node n1, DataFlow::Node n2) { |
| 16 | + // EditText.getText() return type is parsed as `Object`, so we need to |
| 17 | + // add a taint step for `Object.toString` to model `editText.getText().toString()` |
| 18 | + exists(MethodAccess ma, Method m | |
| 19 | + ma.getMethod() = m and |
| 20 | + m.getDeclaringType() instanceof TypeObject and |
| 21 | + m.hasName("toString") |
| 22 | + | |
| 23 | + n1.asExpr() = ma.getQualifier() and n2.asExpr() = ma |
| 24 | + ) |
| 25 | + } |
| 26 | +} |
| 27 | + |
| 28 | +/** The creation of an object that can be used to store data in a local database. */ |
| 29 | +class LocalDatabaseOpenMethodAccess extends Storable, Call { |
| 30 | + LocalDatabaseOpenMethodAccess() { |
| 31 | + exists(Method m | this.(MethodAccess).getMethod() = m | |
| 32 | + m.getDeclaringType().getASupertype*() instanceof TypeSQLiteOpenHelper and |
| 33 | + m.hasName("getWritableDatabase") |
| 34 | + or |
| 35 | + m.getDeclaringType() instanceof TypeSQLiteDatabase and |
| 36 | + m.hasName(["create", "openDatabase", "openOrCreateDatabase", "compileStatement"]) |
| 37 | + or |
| 38 | + m.getDeclaringType().getASupertype*() instanceof TypeContext and |
| 39 | + m.hasName("openOrCreateDatabase") |
| 40 | + ) |
| 41 | + or |
| 42 | + this.(ClassInstanceExpr).getConstructedType() instanceof ContentValues |
| 43 | + } |
| 44 | + |
| 45 | + override Expr getAnInput() { |
| 46 | + exists(LocalDatabaseFlowConfig config, DataFlow::Node database | |
| 47 | + localDatabaseInput(database, result) and |
| 48 | + config.hasFlow(DataFlow::exprNode(this), database) |
| 49 | + ) |
| 50 | + } |
| 51 | + |
| 52 | + override Expr getAStore() { |
| 53 | + exists(LocalDatabaseFlowConfig config, DataFlow::Node database | |
| 54 | + localDatabaseStore(database, result) and |
| 55 | + config.hasFlow(DataFlow::exprNode(this), database) |
| 56 | + ) |
| 57 | + } |
| 58 | +} |
| 59 | + |
| 60 | +/** A method that is both a database input and a database store. */ |
| 61 | +private class LocalDatabaseInputStoreMethod extends Method { |
| 62 | + LocalDatabaseInputStoreMethod() { |
| 63 | + this.getDeclaringType() instanceof TypeSQLiteDatabase and |
| 64 | + this.getName().matches("exec%SQL") |
| 65 | + } |
| 66 | +} |
| 67 | + |
| 68 | +/** |
| 69 | + * Holds if `input` is a value being prepared for being stored into the SQLite dataabse `database`. |
| 70 | + * This can be done using prepared statements, using the class `ContentValues`, or directly |
| 71 | + * appending `input` to a SQL query. |
| 72 | + */ |
| 73 | +private predicate localDatabaseInput(DataFlow::Node database, Argument input) { |
| 74 | + exists(Method m | input.getCall().getCallee() = m | |
| 75 | + m instanceof LocalDatabaseInputStoreMethod and |
| 76 | + database.asExpr() = input.getCall().getQualifier() |
| 77 | + or |
| 78 | + m.getDeclaringType() instanceof TypeSQLiteDatabase and |
| 79 | + m.hasName("compileStatement") and |
| 80 | + database.asExpr() = input.getCall() |
| 81 | + or |
| 82 | + m.getDeclaringType() instanceof ContentValues and |
| 83 | + m.hasName("put") and |
| 84 | + input.getPosition() = 1 and |
| 85 | + database.asExpr() = input.getCall().getQualifier() |
| 86 | + ) |
| 87 | +} |
| 88 | + |
| 89 | +/** |
| 90 | + * Holds if `store` is a method call for storing a previously appended input value, |
| 91 | + * either through the use of prepared statements, via the `ContentValues` class, or |
| 92 | + * directly executing a raw SQL query. |
| 93 | + */ |
| 94 | +private predicate localDatabaseStore(DataFlow::Node database, MethodAccess store) { |
| 95 | + exists(Method m | store.getMethod() = m | |
| 96 | + m instanceof LocalDatabaseInputStoreMethod and |
| 97 | + database.asExpr() = store.getQualifier() |
| 98 | + or |
| 99 | + m.getDeclaringType() instanceof TypeSQLiteDatabase and |
| 100 | + m.getName().matches(["insert%", "replace%", "update%"]) and |
| 101 | + database.asExpr() = store.getAnArgument() and |
| 102 | + database.getType() instanceof ContentValues |
| 103 | + or |
| 104 | + m.getDeclaringType() instanceof TypeSQLiteStatement and |
| 105 | + m.hasName(["executeInsert", "executeUpdateDelete"]) and |
| 106 | + database.asExpr() = store.getQualifier() |
| 107 | + ) |
| 108 | +} |
| 109 | + |
| 110 | +private class LocalDatabaseFlowConfig extends DataFlow::Configuration { |
| 111 | + LocalDatabaseFlowConfig() { this = "LocalDatabaseFlowConfig" } |
| 112 | + |
| 113 | + override predicate isSource(DataFlow::Node source) { |
| 114 | + source.asExpr() instanceof LocalDatabaseOpenMethodAccess |
| 115 | + } |
| 116 | + |
| 117 | + override predicate isSink(DataFlow::Node sink) { |
| 118 | + localDatabaseInput(sink, _) or |
| 119 | + localDatabaseStore(sink, _) |
| 120 | + } |
| 121 | + |
| 122 | + override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) { |
| 123 | + // Adds a step for tracking databases through field flow, that is, a database is opened and |
| 124 | + // assigned to a field, and then an input or store method is called on that field elsewhere. |
| 125 | + exists(Field f | |
| 126 | + f.getType() instanceof TypeSQLiteDatabase and |
| 127 | + f.getAnAssignedValue() = n1.asExpr() and |
| 128 | + f = n2.asExpr().(FieldRead).getField() |
| 129 | + ) |
| 130 | + } |
| 131 | +} |
0 commit comments