Moved Android manifest incomplete permission logic into library

egregius313 · egregius313 · commit e72963986fa3 · 2022-09-29T14:06:18.000-04:00
diff --git a/java/ql/lib/semmle/code/xml/AndroidManifest.qll b/java/ql/lib/semmle/code/xml/AndroidManifest.qll
@@ -180,6 +180,17 @@ class AndroidProviderXmlElement extends AndroidComponentXmlElement {
       attr.getValue() = "true"
     )
   }
+
+  /**
+   * Holds if the provider element provides only `android:readPermission` or `android:writePermission`.
+   */
+  predicate hasIncompletePermissions() {
+    (
+      this.getAnAttribute().(AndroidPermissionXmlAttribute).isWrite() or
+      this.getAnAttribute().(AndroidPermissionXmlAttribute).isRead()
+    ) and
+    not this.requiresPermissions()
+  }
 }
 
 /**
diff --git a/java/ql/src/Security/CWE/CWE-276/ContentProviderIncompletePermissions.ql b/java/ql/src/Security/CWE/CWE-276/ContentProviderIncompletePermissions.ql
@@ -15,9 +15,8 @@ import semmle.code.xml.AndroidManifest
 
 from AndroidProviderXmlElement provider
 where
-  (
-    provider.getAnAttribute().(AndroidPermissionXmlAttribute).isWrite() or
-    provider.getAnAttribute().(AndroidPermissionXmlAttribute).isRead()
-  ) and
-  not provider.requiresPermissions()
-select provider, "Incomplete permissions"
+  not provider.getFile().(AndroidManifestXmlFile).isInBuildDirectory() and
+  provider.isExported() and
+  provider.hasIncompletePermissions()
+select provider, "Exported provider $@ has incomplete permissions.", provider,
+  provider.getResolvedComponentName()

Original file line number	Diff line number	Diff line change
`@@ -180,6 +180,17 @@ class AndroidProviderXmlElement extends AndroidComponentXmlElement {`
`180`	`180`	`attr.getValue() = "true"`
`181`	`181`	`)`
`182`	`182`	`}`
	`183`	`+`
	`184`	`+ /**`
	`185`	+ * Holds if the provider element provides only `android:readPermission` or `android:writePermission`.
	`186`	`+ */`
	`187`	`+ predicate hasIncompletePermissions() {`
	`188`	`+ (`
	`189`	`+ this.getAnAttribute().(AndroidPermissionXmlAttribute).isWrite() or`
	`190`	`+ this.getAnAttribute().(AndroidPermissionXmlAttribute).isRead()`
	`191`	`+ ) and`
	`192`	`+ not this.requiresPermissions()`
	`193`	`+ }`
`183`	`194`	`}`
`184`	`195`
`185`	`196`	`/**`