Add remote source of Android intent extra

luchua-bc · luchua-bc · commit 65e76ab18fff · 2020-06-25T20:20:18.000Z
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSources.qll b/java/ql/src/semmle/code/java/dataflow/FlowSources.qll
@@ -20,6 +20,7 @@ import semmle.code.java.frameworks.SpringWeb
 import semmle.code.java.frameworks.Guice
 import semmle.code.java.frameworks.struts.StrutsActions
 import semmle.code.java.frameworks.Thrift
+import semmle.code.java.frameworks.android.Android
 
 /** A data flow source of remote user input. */
 abstract class RemoteFlowSource extends DataFlow::Node {
@@ -270,3 +271,36 @@ class AndroidIntentInput extends DataFlow::Node {
     )
   }
 }
+
+/**
+ * Method access to external inputs of `android.content.Intent` object
+ */
+class IntentGetExtraMethodAccess extends MethodAccess {
+  IntentGetExtraMethodAccess() {
+    exists(AndroidComponent ac |
+      this.getEnclosingCallable().getDeclaringType() = ac and ac.isExported()
+    ) and
+    (
+      this.getMethod().getName().regexpMatch("get\\w+Extra") and
+      this.getMethod().getDeclaringType() instanceof TypeIntent
+      or
+      this.getMethod().getName().regexpMatch("get\\w+") and
+      this.getQualifier().(MethodAccess).getMethod().hasName("getExtras") and
+      this.getQualifier().(MethodAccess).getMethod().getDeclaringType() instanceof TypeIntent
+    )
+  }
+}
+
+/**
+ * Android intent extra source
+ */
+private class AndroidIntentExtraSource extends RemoteFlowSource {
+  AndroidIntentExtraSource() {
+    exists(MethodAccess ma |
+      ma instanceof IntentGetExtraMethodAccess and
+      this.asExpr().(VarAccess).getVariable().getAnAssignedValue() = ma
+    )
+  }
+
+  override string getSourceType() { result = "Android intent extra" }
+}
diff --git a/java/ql/src/semmle/code/java/frameworks/android/Android.qll b/java/ql/src/semmle/code/java/frameworks/android/Android.qll
@@ -32,18 +32,39 @@ class AndroidComponent extends Class {
 /** An Android activity. */
 class AndroidActivity extends AndroidComponent {
   AndroidActivity() { this.getASupertype*().hasQualifiedName("android.app", "Activity") }
+
+  /** Holds if this Android component is configured as `exported` or has intent filters configured without `exported` explicitly disabled in an `AndroidManifest.xml` file. */
+  override predicate isExported() {
+    getAndroidComponentXmlElement().isExported()
+    or
+    not getAndroidComponentXmlElement().isNotExported() and hasIntentFilter()
+  }
 }
 
 /** An Android service. */
 class AndroidService extends AndroidComponent {
   AndroidService() { this.getASupertype*().hasQualifiedName("android.app", "Service") }
+
+  /** Holds if this Android component is configured as `exported` or has intent filters configured without `exported` explicitly disabled in an `AndroidManifest.xml` file. */
+  override predicate isExported() {
+    getAndroidComponentXmlElement().isExported()
+    or
+    not getAndroidComponentXmlElement().isNotExported() and hasIntentFilter()
+  }
 }
 
 /** An Android broadcast receiver. */
 class AndroidBroadcastReceiver extends AndroidComponent {
   AndroidBroadcastReceiver() {
     this.getASupertype*().hasQualifiedName("android.content", "BroadcastReceiver")
   }
+
+  /** Holds if this Android component is configured as `exported` or has intent filters configured without `exported` explicitly disabled in an `AndroidManifest.xml` file. */
+  override predicate isExported() {
+    getAndroidComponentXmlElement().isExported()
+    or
+    not getAndroidComponentXmlElement().isNotExported() and hasIntentFilter()
+  }
 }
 
 /** An Android content provider. */
diff --git a/java/ql/src/semmle/code/xml/AndroidManifest.qll b/java/ql/src/semmle/code/xml/AndroidManifest.qll
@@ -137,6 +137,11 @@ class AndroidComponentXmlElement extends XMLElement {
    * Holds if the `android:exported` attribute of this component element is `true`.
    */
   predicate isExported() { getExportedAttributeValue() = "true" }
+
+  /**
+   * Holds if the `android:exported` attribute of this component element is explicitly set to `false`.
+   */
+  predicate isNotExported() { getExportedAttributeValue() = "false" }
 }
 
 /**
