Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9a537f9

Browse files
atorralbaatorralba
committed
Add guard sanitizer for component name checks
1 parent 21b70a0 commit 9a537f9

2 files changed

Lines changed: 56 additions & 36 deletions

File tree

‎java/ql/src/semmle/code/java/security/AndroidIntentRedirection.qll‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
/** Provides classes to reason about Android Intent redirect vulnerabilities. */
22

33
import java
4+
private import semmle.code.java.controlflow.Guards
45
private import semmle.code.java.dataflow.DataFlow
56
private import semmle.code.java.dataflow.ExternalFlow
67
private import semmle.code.java.frameworks.android.Intent
@@ -31,3 +32,18 @@ class IntentRedirectionAdditionalTaintStep extends Unit {
3132
private class DefaultIntentRedirectionSink extends IntentRedirectionSink {
3233
DefaultIntentRedirectionSink() { sinkNode(this, "intent-start") }
3334
}
35+
36+
/**
37+
* A default sanitizer for nodes dominated by calls to `ComponentName.getPackageName`
38+
* or `ComponentName.getClassName`. These are used to check whether the origin or destination
39+
* components are trusted.
40+
*/
41+
private class DefaultIntentRedirectionSanitizer extends IntentRedirectionSanitizer {
42+
DefaultIntentRedirectionSanitizer() {
43+
exists(MethodAccess ma, Method m |
44+
ma.getMethod() = m and
45+
m.hasQualifiedName("android.content", "ComponentName", ["getPackageName", "getClassName"]) and
46+
ma.getBasicBlock().(ConditionBlock).controls(this.asExpr().getBasicBlock(), true)
47+
)
48+
}
49+
}

‎java/ql/test/query-tests/security/CWE-940/AndroidIntentRedirectionTest.java‎

Lines changed: 40 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -8,45 +8,49 @@
88
public class AndroidIntentRedirectionTest extends Activity {
99

1010
public void onCreate(Bundle savedInstanceState) {
11-
// @formatter:off
12-
{
13-
Intent intent = (Intent) getIntent().getParcelableExtra("forward_intent");
14-
startActivities(new Intent[] {intent}); // $ hasAndroidIntentRedirection
15-
startActivities(new Intent[] {intent}, null); // $ hasAndroidIntentRedirection
11+
Intent intent = (Intent) getIntent().getParcelableExtra("forward_intent");
12+
13+
if (intent.getComponent().getPackageName().equals("something")) {
14+
startActivity(intent); // Safe - sanitized
15+
} else {
1616
startActivity(intent); // $ hasAndroidIntentRedirection
17-
startActivity(intent, null); // $ hasAndroidIntentRedirection
18-
startActivityAsUser(intent, null); // $ hasAndroidIntentRedirection
19-
startActivityAsUser(intent, null, null); // $ hasAndroidIntentRedirection
20-
startActivityAsCaller(intent, null, false, 0); // $ hasAndroidIntentRedirection
21-
startActivityForResult(intent, 0); // $ hasAndroidIntentRedirection
22-
startActivityForResult(intent, 0, null); // $ hasAndroidIntentRedirection
23-
startActivityForResult(null, intent, 0, null); // $ hasAndroidIntentRedirection
24-
startActivityForResultAsUser(intent, null, 0, null, null); // $ hasAndroidIntentRedirection
25-
startActivityForResultAsUser(intent, 0, null, null); // $ hasAndroidIntentRedirection
26-
startActivityForResultAsUser(intent, 0, null); // $ hasAndroidIntentRedirection
27-
}
28-
{
29-
Intent intent = (Intent) getIntent().getParcelableExtra("forward_intent");
30-
startService(intent); // $ hasAndroidIntentRedirection
31-
startServiceAsUser(intent, null); // $ hasAndroidIntentRedirection
3217
}
33-
{
34-
Intent intent = (Intent) getIntent().getParcelableExtra("forward_intent");
35-
sendBroadcast(intent); // $ hasAndroidIntentRedirection
36-
sendBroadcast(intent, null); // $ hasAndroidIntentRedirection
37-
sendBroadcast(intent, null, null); // $ hasAndroidIntentRedirection
38-
sendBroadcast(intent, null, 0); // $ hasAndroidIntentRedirection
39-
sendBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirection
40-
sendBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirection
41-
sendBroadcastAsUser(intent, null, null, null); // $ hasAndroidIntentRedirection
42-
sendBroadcastAsUser(intent, null, null, 0); // $ hasAndroidIntentRedirection
43-
sendBroadcastWithMultiplePermissions(intent, null); // $ hasAndroidIntentRedirection
44-
sendStickyBroadcast(intent); // $ hasAndroidIntentRedirection
45-
sendStickyBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirection
46-
sendStickyBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirection
47-
sendStickyOrderedBroadcast(intent, null, null, 0, null, null); // $ hasAndroidIntentRedirection
48-
sendStickyOrderedBroadcastAsUser(intent, null, null, null, 0, null, null); // $ hasAndroidIntentRedirection
18+
if (intent.getComponent().getClassName().equals("something")) {
19+
startActivity(intent); // Safe - sanitized
20+
} else {
21+
startActivity(intent); // $ hasAndroidIntentRedirection
4922
}
23+
24+
// @formatter:off
25+
startActivities(new Intent[] {intent}); // $ hasAndroidIntentRedirection
26+
startActivities(new Intent[] {intent}, null); // $ hasAndroidIntentRedirection
27+
startActivity(intent); // $ hasAndroidIntentRedirection
28+
startActivity(intent, null); // $ hasAndroidIntentRedirection
29+
startActivityAsUser(intent, null); // $ hasAndroidIntentRedirection
30+
startActivityAsUser(intent, null, null); // $ hasAndroidIntentRedirection
31+
startActivityAsCaller(intent, null, false, 0); // $ hasAndroidIntentRedirection
32+
startActivityForResult(intent, 0); // $ hasAndroidIntentRedirection
33+
startActivityForResult(intent, 0, null); // $ hasAndroidIntentRedirection
34+
startActivityForResult(null, intent, 0, null); // $ hasAndroidIntentRedirection
35+
startActivityForResultAsUser(intent, null, 0, null, null); // $ hasAndroidIntentRedirection
36+
startActivityForResultAsUser(intent, 0, null, null); // $ hasAndroidIntentRedirection
37+
startActivityForResultAsUser(intent, 0, null); // $ hasAndroidIntentRedirection
38+
startService(intent); // $ hasAndroidIntentRedirection
39+
startServiceAsUser(intent, null); // $ hasAndroidIntentRedirection
40+
sendBroadcast(intent); // $ hasAndroidIntentRedirection
41+
sendBroadcast(intent, null); // $ hasAndroidIntentRedirection
42+
sendBroadcast(intent, null, null); // $ hasAndroidIntentRedirection
43+
sendBroadcast(intent, null, 0); // $ hasAndroidIntentRedirection
44+
sendBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirection
45+
sendBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirection
46+
sendBroadcastAsUser(intent, null, null, null); // $ hasAndroidIntentRedirection
47+
sendBroadcastAsUser(intent, null, null, 0); // $ hasAndroidIntentRedirection
48+
sendBroadcastWithMultiplePermissions(intent, null); // $ hasAndroidIntentRedirection
49+
sendStickyBroadcast(intent); // $ hasAndroidIntentRedirection
50+
sendStickyBroadcastAsUser(intent, null); // $ hasAndroidIntentRedirection
51+
sendStickyBroadcastAsUser(intent, null, null); // $ hasAndroidIntentRedirection
52+
sendStickyOrderedBroadcast(intent, null, null, 0, null, null); // $ hasAndroidIntentRedirection
53+
sendStickyOrderedBroadcastAsUser(intent, null, null, null, 0, null, null); // $ hasAndroidIntentRedirection
5054
// @formatter:on
5155
}
5256
}

0 commit comments

Comments
 (0)