Skip to content

Commit b23f384

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
Java: update intent-start sink kind to intent-redirection
1 parent 5aa3e57 commit b23f384

5 files changed

Lines changed: 28 additions & 27 deletions

File tree

‎java/ql/lib/ext/android.app.model.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,14 @@ extensions:
33
pack: codeql/java-all
44
extensible: sinkModel
55
data:
6-
- ["android.app", "Activity", True, "bindService", "", "", "Argument[0]", "intent-start", "manual"]
7-
- ["android.app", "Activity", True, "bindServiceAsUser", "", "", "Argument[0]", "intent-start", "manual"]
6+
- ["android.app", "Activity", True, "bindService", "", "", "Argument[0]", "intent-redirection", "manual"]
7+
- ["android.app", "Activity", True, "bindServiceAsUser", "", "", "Argument[0]", "intent-redirection", "manual"]
88
- ["android.app", "Activity", True, "setResult", "(int,Intent)", "", "Argument[1]", "pending-intents", "manual"]
9-
- ["android.app", "Activity", True, "startActivityAsCaller", "", "", "Argument[0]", "intent-start", "manual"]
10-
- ["android.app", "Activity", True, "startActivityForResult", "(Intent,int)", "", "Argument[0]", "intent-start", "manual"]
11-
- ["android.app", "Activity", True, "startActivityForResult", "(Intent,int,Bundle)", "", "Argument[0]", "intent-start", "manual"]
12-
- ["android.app", "Activity", True, "startActivityForResult", "(String,Intent,int,Bundle)", "", "Argument[1]", "intent-start", "manual"]
13-
- ["android.app", "Activity", True, "startActivityForResultAsUser", "", "", "Argument[0]", "intent-start", "manual"]
9+
- ["android.app", "Activity", True, "startActivityAsCaller", "", "", "Argument[0]", "intent-redirection", "manual"]
10+
- ["android.app", "Activity", True, "startActivityForResult", "(Intent,int)", "", "Argument[0]", "intent-redirection", "manual"]
11+
- ["android.app", "Activity", True, "startActivityForResult", "(Intent,int,Bundle)", "", "Argument[0]", "intent-redirection", "manual"]
12+
- ["android.app", "Activity", True, "startActivityForResult", "(String,Intent,int,Bundle)", "", "Argument[1]", "intent-redirection", "manual"]
13+
- ["android.app", "Activity", True, "startActivityForResultAsUser", "", "", "Argument[0]", "intent-redirection", "manual"]
1414
- ["android.app", "AlarmManager", True, "set", "(int,long,PendingIntent)", "", "Argument[2]", "pending-intents", "manual"]
1515
- ["android.app", "AlarmManager", True, "setAlarmClock", "", "", "Argument[1]", "pending-intents", "manual"]
1616
- ["android.app", "AlarmManager", True, "setAndAllowWhileIdle", "", "", "Argument[2]", "pending-intents", "manual"]

‎java/ql/lib/ext/android.content.model.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -47,22 +47,22 @@ extensions:
4747
- ["android.content", "ContentResolver", True, "query", "(Uri,String[],String,String[],String)", "", "Argument[2]", "sql-injection", "manual"]
4848
- ["android.content", "ContentResolver", True, "query", "(Uri,String[],String,String[],String,CancellationSignal)", "", "Argument[2]", "sql-injection", "manual"]
4949
- ["android.content", "ContentResolver", True, "update", "(Uri,ContentValues,String,String[])", "", "Argument[2]", "sql-injection", "manual"]
50-
- ["android.content", "Context", True, "sendBroadcast", "", "", "Argument[0]", "intent-start", "manual"]
51-
- ["android.content", "Context", True, "sendBroadcastAsUser", "", "", "Argument[0]", "intent-start", "manual"]
52-
- ["android.content", "Context", True, "sendBroadcastWithMultiplePermissions", "", "", "Argument[0]", "intent-start", "manual"]
53-
- ["android.content", "Context", True, "sendStickyBroadcast", "", "", "Argument[0]", "intent-start", "manual"]
54-
- ["android.content", "Context", True, "sendStickyBroadcastAsUser", "", "", "Argument[0]", "intent-start", "manual"]
55-
- ["android.content", "Context", True, "sendStickyOrderedBroadcast", "", "", "Argument[0]", "intent-start", "manual"]
56-
- ["android.content", "Context", True, "sendStickyOrderedBroadcastAsUser", "", "", "Argument[0]", "intent-start", "manual"]
57-
- ["android.content", "Context", True, "startActivities", "", "", "Argument[0]", "intent-start", "manual"]
58-
- ["android.content", "Context", True, "startActivity", "", "", "Argument[0]", "intent-start", "manual"]
59-
- ["android.content", "Context", True, "startActivityAsUser", "", "", "Argument[0]", "intent-start", "manual"]
60-
- ["android.content", "Context", True, "startActivityFromChild", "", "", "Argument[1]", "intent-start", "manual"]
61-
- ["android.content", "Context", True, "startActivityFromFragment", "", "", "Argument[1]", "intent-start", "manual"]
62-
- ["android.content", "Context", True, "startActivityIfNeeded", "", "", "Argument[0]", "intent-start", "manual"]
63-
- ["android.content", "Context", True, "startForegroundService", "", "", "Argument[0]", "intent-start", "manual"]
64-
- ["android.content", "Context", True, "startService", "", "", "Argument[0]", "intent-start", "manual"]
65-
- ["android.content", "Context", True, "startServiceAsUser", "", "", "Argument[0]", "intent-start", "manual"]
50+
- ["android.content", "Context", True, "sendBroadcast", "", "", "Argument[0]", "intent-redirection", "manual"]
51+
- ["android.content", "Context", True, "sendBroadcastAsUser", "", "", "Argument[0]", "intent-redirection", "manual"]
52+
- ["android.content", "Context", True, "sendBroadcastWithMultiplePermissions", "", "", "Argument[0]", "intent-redirection", "manual"]
53+
- ["android.content", "Context", True, "sendStickyBroadcast", "", "", "Argument[0]", "intent-redirection", "manual"]
54+
- ["android.content", "Context", True, "sendStickyBroadcastAsUser", "", "", "Argument[0]", "intent-redirection", "manual"]
55+
- ["android.content", "Context", True, "sendStickyOrderedBroadcast", "", "", "Argument[0]", "intent-redirection", "manual"]
56+
- ["android.content", "Context", True, "sendStickyOrderedBroadcastAsUser", "", "", "Argument[0]", "intent-redirection", "manual"]
57+
- ["android.content", "Context", True, "startActivities", "", "", "Argument[0]", "intent-redirection", "manual"]
58+
- ["android.content", "Context", True, "startActivity", "", "", "Argument[0]", "intent-redirection", "manual"]
59+
- ["android.content", "Context", True, "startActivityAsUser", "", "", "Argument[0]", "intent-redirection", "manual"]
60+
- ["android.content", "Context", True, "startActivityFromChild", "", "", "Argument[1]", "intent-redirection", "manual"]
61+
- ["android.content", "Context", True, "startActivityFromFragment", "", "", "Argument[1]", "intent-redirection", "manual"]
62+
- ["android.content", "Context", True, "startActivityIfNeeded", "", "", "Argument[0]", "intent-redirection", "manual"]
63+
- ["android.content", "Context", True, "startForegroundService", "", "", "Argument[0]", "intent-redirection", "manual"]
64+
- ["android.content", "Context", True, "startService", "", "", "Argument[0]", "intent-redirection", "manual"]
65+
- ["android.content", "Context", True, "startServiceAsUser", "", "", "Argument[0]", "intent-redirection", "manual"]
6666
- addsTo:
6767
pack: codeql/java-all
6868
extensible: summaryModel

‎java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -276,8 +276,8 @@ module ModelValidation {
276276
[
277277
"open-url", "jndi-injection", "ldap-injection", "sql-injection", "jdbc-url",
278278
"log-injection", "mvel-injection", "xpath-injection", "groovy-injection", "xss",
279-
"ognl-injection", "intent-start", "pending-intents", "url-redirection", "create-file",
280-
"read-file", "write-file", "set-hostname-verifier", "header-splitting",
279+
"ognl-injection", "intent-redirection", "pending-intents", "url-redirection",
280+
"create-file", "read-file", "write-file", "set-hostname-verifier", "header-splitting",
281281
"information-leak", "xslt-injection", "jexl-injection", "bean-validation",
282282
"template-injection", "fragment-injection", "command-injection"
283283
] and

‎java/ql/lib/semmle/code/java/security/AndroidIntentRedirection.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ class IntentRedirectionAdditionalTaintStep extends Unit {
3030

3131
/** Default sink for Intent redirection vulnerabilities. */
3232
private class DefaultIntentRedirectionSink extends IntentRedirectionSink {
33-
DefaultIntentRedirectionSink() { sinkNode(this, "intent-start") }
33+
DefaultIntentRedirectionSink() { sinkNode(this, "intent-redirection") }
3434
}
3535

3636
/**

‎java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@ private class IntentCreationSource extends ImplicitPendingIntentSource {
5454

5555
private class SendPendingIntent extends ImplicitPendingIntentSink {
5656
SendPendingIntent() {
57-
sinkNode(this, "intent-start") and
57+
// intent redirection sinks are method calls that start Android components
58+
sinkNode(this, "intent-redirection") and
5859
// implicit intents can't be started as services since API 21
5960
not exists(MethodAccess ma, Method m |
6061
ma.getMethod() = m and

0 commit comments

Comments
 (0)