Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9e3594f

Browse files
atorralbaatorralba
committed
Added more sinks
1 parent 1e3e481 commit 9e3594f

3 files changed

Lines changed: 35 additions & 3 deletions

File tree

‎java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,12 @@ private class PendingIntentSentSinkModels extends SinkModelCsv {
3030
"android.app;NotificationManager;true;notify;(int,Notification);;Argument[1];pending-intent-sent",
3131
"android.app;NotificationManager;true;notify;(String,int,Notification);;Argument[2];pending-intent-sent",
3232
"android.app;NotificationManager;true;notifyAsPackage;(String,String,int,Notification);;Argument[3];pending-intent-sent",
33-
"android.app;NotificationManager;true;notifyAsUser;(String,int,Notification,UserHandle);;Argument[2];pending-intent-sent"
33+
"android.app;NotificationManager;true;notifyAsUser;(String,int,Notification,UserHandle);;Argument[2];pending-intent-sent",
34+
"android.app;PendingIntent;false;send;(Context,int,Intent,OnFinished,Handler,String,Bundle);;Argument[2];pending-intent-sent",
35+
"android.app;PendingIntent;false;send;(Context,int,Intent,OnFinished,Handler,String);;Argument[2];pending-intent-sent",
36+
"android.app;PendingIntent;false;send;(Context,int,Intent,OnFinished,Handler);;Argument[2];pending-intent-sent",
37+
"android.app;PendingIntent;false;send;(Context,int,Intent);;Argument[2];pending-intent-sent",
38+
"android.app;Activity;true;setResult;(int,Intent);;Argument[1];pending-intent-sent"
3439
]
3540
}
3641
}
@@ -40,6 +45,8 @@ private class DefaultIntentRedirectionSinkModel extends SinkModelCsv {
4045
override predicate row(string row) {
4146
row =
4247
[
48+
"android.app;Activity;true;bindService;;;Argument[0];intent-start",
49+
"android.app;Activity;true;bindServiceAsUser;;;Argument[0];intent-start",
4350
"android.app;Activity;true;startActivityAsCaller;;;Argument[0];intent-start",
4451
"android.app;Activity;true;startActivityForResult;(Intent,int);;Argument[0];intent-start",
4552
"android.app;Activity;true;startActivityForResult;(Intent,int,Bundle);;Argument[0];intent-start",

‎java/ql/lib/semmle/code/java/security/ImplicitPendingIntentsQuery.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,11 @@ private class ImplicitPendingIntentCreation extends Expr {
6060
private class SendPendingIntent extends DataFlow::Node {
6161
SendPendingIntent() {
6262
sinkNode(this, "intent-start") and
63-
// startService can't actually start implicit intents since API 21
63+
// implicit intents can't be started as services since API 21
6464
not exists(MethodAccess ma, Method m |
6565
ma.getMethod() = m and
6666
m.getDeclaringType().getASupertype*() instanceof TypeContext and
67-
m.getName().matches("start%Service%") and
67+
m.getName().matches(["start%Service%", "bindService%"]) and
6868
this.asExpr() = ma.getArgument(0)
6969
)
7070
or

‎java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.java‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,20 @@ public static void testPendingIntentAsAnExtra(Context ctx)
148148
}
149149
}
150150

151+
public static void testPendingIntentWrappedInAnotherPendingIntent(Context ctx,
152+
PendingIntent other) throws PendingIntent.CanceledException {
153+
{
154+
Intent baseIntent = new Intent();
155+
PendingIntent pi = PendingIntent.getActivity(ctx, 0, baseIntent, 0);
156+
Intent fwdIntent = new Intent();
157+
fwdIntent.putExtra("fwdIntent", pi);
158+
other.send(ctx, 0, fwdIntent); // $hasTaintFlow
159+
other.send(ctx, 0, fwdIntent, null, null); // $hasTaintFlow
160+
other.send(ctx, 0, fwdIntent, null, null, null); // $hasTaintFlow
161+
other.send(ctx, 0, fwdIntent, null, null, null, null); // $hasTaintFlow
162+
}
163+
}
164+
151165
public static void testPendingIntentInANotification(Context ctx)
152166
throws PendingIntent.CanceledException {
153167

@@ -194,6 +208,17 @@ public static void testPendingIntentInANotification(Context ctx)
194208

195209
}
196210

211+
static class TestActivity extends Activity {
212+
@Override
213+
public void onCreate(Bundle bundle) {
214+
Intent baseIntent = new Intent();
215+
PendingIntent pi = PendingIntent.getActivity(null, 0, baseIntent, 0);
216+
Intent fwdIntent = new Intent();
217+
fwdIntent.putExtra("fwdIntent", pi);
218+
setResult(0, fwdIntent); // $hasTaintFlow
219+
}
220+
}
221+
197222
static class TestSliceProvider extends SliceProvider {
198223

199224
private PendingIntent mPendingIntent;

0 commit comments

Comments
 (0)