Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f963887

Browse files
atorralbaatorralba
committed
Change test to avoid collision with SensitiveCommunication.ql
1 parent 48acff9 commit f963887

3 files changed

Lines changed: 41 additions & 28 deletions

File tree

‎java/ql/lib/semmle/code/java/security/ImplicitPendingIntentsQuery.qll‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,11 @@ class ImplicitPendingIntentStartConf extends TaintTracking::Configuration {
3636
super.allowImplicitRead(node, c)
3737
or
3838
this.isSink(node) and
39-
allowIntentExtrasImplicitRead(node, c)
39+
(
40+
allowIntentExtrasImplicitRead(node, c) or
41+
c.(DataFlow::SyntheticFieldContent).getField() =
42+
["android.app.Notification.action", "androidx.slice.Slice.action"]
43+
)
4044
or
4145
this.isAdditionalTaintStep(node, _) and
4246
c.(DataFlow::FieldContent).getType() instanceof PendingIntent

‎java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.java‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,10 @@ public static void testPendingIntentAsAnExtra(Context ctx)
2929
PendingIntent pi = PendingIntent.getActivity(ctx, 0, baseIntent, 0);
3030
Intent fwdIntent = new Intent();
3131
fwdIntent.putExtra("fwdIntent", pi);
32-
ctx.startActivity(fwdIntent); // $hasTaintFlow
33-
ctx.startActivities(new Intent[] {fwdIntent}); // $hasTaintFlow
32+
ctx.startActivity(fwdIntent); // $hasImplicitPendingIntent
33+
ctx.startActivities(new Intent[] {fwdIntent}); // $hasImplicitPendingIntent
3434
ctx.startService(fwdIntent); // Safe
35-
ctx.sendBroadcast(fwdIntent); // $hasTaintFlow
35+
ctx.sendBroadcast(fwdIntent); // $hasImplicitPendingIntent
3636

3737
fwdIntent.setPackage("a.safe.package"); // Sanitizer
3838
ctx.startActivity(fwdIntent); // Safe
@@ -43,15 +43,15 @@ public static void testPendingIntentAsAnExtra(Context ctx)
4343
PendingIntent pi = PendingIntent.getActivityAsUser(ctx, 0, baseIntent, 0, null, null);
4444
Intent fwdIntent = new Intent();
4545
fwdIntent.putExtra("fwdIntent", pi);
46-
ctx.startActivity(fwdIntent); // $hasTaintFlow
46+
ctx.startActivity(fwdIntent); // $hasImplicitPendingIntent
4747
}
4848

4949
{
5050
Intent baseIntent = new Intent();
5151
PendingIntent pi = PendingIntent.getActivities(ctx, 0, new Intent[] {baseIntent}, 0);
5252
Intent fwdIntent = new Intent();
5353
fwdIntent.putExtra("fwdIntent", pi);
54-
ctx.startActivity(fwdIntent); // $hasTaintFlow
54+
ctx.startActivity(fwdIntent); // $hasImplicitPendingIntent
5555
}
5656

5757
{
@@ -60,39 +60,39 @@ public static void testPendingIntentAsAnExtra(Context ctx)
6060
0, null, null);
6161
Intent fwdIntent = new Intent();
6262
fwdIntent.putExtra("fwdIntent", pi);
63-
ctx.startActivity(fwdIntent); // $hasTaintFlow
63+
ctx.startActivity(fwdIntent); // $hasImplicitPendingIntent
6464
}
6565

6666
{
6767
Intent baseIntent = new Intent();
6868
PendingIntent pi = PendingIntent.getBroadcast(ctx, 0, baseIntent, 0);
6969
Intent fwdIntent = new Intent();
7070
fwdIntent.putExtra("fwdIntent", pi);
71-
ctx.sendBroadcast(fwdIntent); // $hasTaintFlow
71+
ctx.sendBroadcast(fwdIntent); // $hasImplicitPendingIntent
7272
}
7373

7474
{
7575
Intent baseIntent = new Intent();
7676
PendingIntent pi = PendingIntent.getBroadcastAsUser(ctx, 0, baseIntent, 0, null);
7777
Intent fwdIntent = new Intent();
7878
fwdIntent.putExtra("fwdIntent", pi);
79-
ctx.sendBroadcast(fwdIntent); // $hasTaintFlow
79+
ctx.sendBroadcast(fwdIntent); // $hasImplicitPendingIntent
8080
}
8181

8282
{
8383
Intent baseIntent = new Intent();
8484
PendingIntent pi = PendingIntent.getService(ctx, 0, baseIntent, 0);
8585
Intent fwdIntent = new Intent();
8686
fwdIntent.putExtra("fwdIntent", pi);
87-
ctx.startActivity(fwdIntent); // $hasTaintFlow
87+
ctx.startActivity(fwdIntent); // $hasImplicitPendingIntent
8888
}
8989

9090
{
9191
Intent baseIntent = new Intent();
9292
PendingIntent pi = PendingIntent.getForegroundService(ctx, 0, baseIntent, 0);
9393
Intent fwdIntent = new Intent();
9494
fwdIntent.putExtra("fwdIntent", pi);
95-
ctx.startActivity(fwdIntent); // $hasTaintFlow
95+
ctx.startActivity(fwdIntent); // $hasImplicitPendingIntent
9696
}
9797

9898
{
@@ -144,7 +144,7 @@ public static void testPendingIntentAsAnExtra(Context ctx)
144144
PendingIntent pi = PendingIntent.getActivity(ctx, 0, baseIntent, flag); // Sanitizer
145145
Intent fwdIntent = new Intent();
146146
fwdIntent.putExtra("fwdIntent", pi);
147-
ctx.startActivity(fwdIntent); // $ SPURIOUS: $ hasTaintFlow
147+
ctx.startActivity(fwdIntent); // $ SPURIOUS: $ hasImplicitPendingIntent
148148
}
149149
}
150150

@@ -155,10 +155,10 @@ public static void testPendingIntentWrappedInAnotherPendingIntent(Context ctx,
155155
PendingIntent pi = PendingIntent.getActivity(ctx, 0, baseIntent, 0);
156156
Intent fwdIntent = new Intent();
157157
fwdIntent.putExtra("fwdIntent", pi);
158-
other.send(ctx, 0, fwdIntent); // $hasTaintFlow
159-
other.send(ctx, 0, fwdIntent, null, null); // $hasTaintFlow
160-
other.send(ctx, 0, fwdIntent, null, null, null); // $hasTaintFlow
161-
other.send(ctx, 0, fwdIntent, null, null, null, null); // $hasTaintFlow
158+
other.send(ctx, 0, fwdIntent); // $hasImplicitPendingIntent
159+
other.send(ctx, 0, fwdIntent, null, null); // $hasImplicitPendingIntent
160+
other.send(ctx, 0, fwdIntent, null, null, null); // $hasImplicitPendingIntent
161+
other.send(ctx, 0, fwdIntent, null, null, null, null); // $hasImplicitPendingIntent
162162
}
163163
}
164164

@@ -173,9 +173,9 @@ public static void testPendingIntentInANotification(Context ctx)
173173
new Notification.Builder(ctx).addAction(aBuilder.build());
174174
Notification notification = nBuilder.build();
175175
NotificationManager nManager = new NotificationManager();
176-
nManager.notifyAsPackage("targetPackage", "tag", 0, notification); // $hasTaintFlow
177-
nManager.notify(0, notification); // $hasTaintFlow
178-
nManager.notifyAsUser("", 0, notification, null); // $hasTaintFlow
176+
nManager.notifyAsPackage("targetPackage", "tag", 0, notification); // $hasImplicitPendingIntent
177+
nManager.notify(0, notification); // $hasImplicitPendingIntent
178+
nManager.notifyAsUser("", 0, notification, null); // $hasImplicitPendingIntent
179179
}
180180
{
181181
Intent baseIntent = new Intent();
@@ -215,7 +215,7 @@ public void onCreate(Bundle bundle) {
215215
PendingIntent pi = PendingIntent.getActivity(null, 0, baseIntent, 0);
216216
Intent fwdIntent = new Intent();
217217
fwdIntent.putExtra("fwdIntent", pi);
218-
setResult(0, fwdIntent); // $hasTaintFlow
218+
setResult(0, fwdIntent); // $hasImplicitPendingIntent
219219
}
220220
}
221221

@@ -232,7 +232,7 @@ public Slice onBindSlice(Uri sliceUri) {
232232
ListBuilder listBuilder = new ListBuilder(getContext(), sliceUri, null);
233233
listBuilder.addRow(new ListBuilder.RowBuilder().setTitle("Title")
234234
.setPrimaryAction(activityAction));
235-
return listBuilder.build(); // $hasTaintFlow
235+
return listBuilder.build(); // $hasImplicitPendingIntent
236236

237237
} else if (sliceUri.getAuthority().equals("2")) {
238238
Intent baseIntent = new Intent(getContext(), Activity.class); // Sanitizer
@@ -259,7 +259,7 @@ public Slice onBindSlice(Uri sliceUri) {
259259
SliceAction action = SliceAction.createDeeplink(mPendingIntent, null, 0, "");
260260
ListBuilder listBuilder = new ListBuilder(getContext(), sliceUri, 0);
261261
listBuilder.addRow(new ListBuilder.RowBuilder(sliceUri).setPrimaryAction(action));
262-
return listBuilder.build(); // $hasTaintFlow
262+
return listBuilder.build(); // $hasImplicitPendingIntent
263263
}
264264
}
265265

@@ -268,7 +268,7 @@ public PendingIntent onCreatePermissionRequest(Uri sliceUri, String callingPacka
268268
if (sliceUri.getAuthority().equals("1")) {
269269
Intent baseIntent = new Intent();
270270
PendingIntent pi = PendingIntent.getActivity(getContext(), 0, baseIntent, 0);
271-
return pi; // $hasTaintFlow
271+
return pi; // $hasImplicitPendingIntent
272272
} else {
273273
Intent baseIntent = new Intent();
274274
PendingIntent pi = PendingIntent.getActivity(getContext(), 0, baseIntent,

‎java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.ql‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,20 @@
11
import java
22
import semmle.code.java.security.ImplicitPendingIntentsQuery
3-
import TestUtilities.InlineFlowTest
3+
import TestUtilities.InlineExpectationsTest
44

5-
class ImplicitPendingIntentsTest extends InlineFlowTest {
6-
override DataFlow::Configuration getValueFlowConfig() { none() }
5+
class ImplicitPendingIntentsTest extends InlineExpectationsTest {
6+
ImplicitPendingIntentsTest() { this = "ImplicitPendingIntentsTest" }
77

8-
override DataFlow::Configuration getTaintFlowConfig() {
9-
result instanceof ImplicitPendingIntentStartConf
8+
override string getARelevantTag() { result = ["hasImplicitPendingIntent"] }
9+
10+
override predicate hasActualResult(Location location, string element, string tag, string value) {
11+
tag = "hasImplicitPendingIntent" and
12+
exists(DataFlow::Node src, DataFlow::Node sink |
13+
any(ImplicitPendingIntentStartConf c).hasFlow(src, sink)
14+
|
15+
sink.getLocation() = location and
16+
element = sink.toString() and
17+
value = ""
18+
)
1019
}
1120
}

0 commit comments

Comments
 (0)