Skip to content

Commit 56e3334

Browse files
jcogs33jcogs33
authored
Merge pull request #10479 from jcogs33/android-service-sources
Java: add Android service sources
2 parents be9509c + 7e0c61d commit 56e3334

File tree

9 files changed

+215
-51
lines changed

9 files changed

+215
-51
lines changed

‎java/ql/lib/change-notes/2022-09-23-android-service-sources.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added external flow sources for the intents received in exported Android services.

‎java/ql/lib/semmle/code/java/dataflow/FlowSources.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,12 @@ class AndroidIntentInput extends DataFlow::Node {
250250
this.asParameter() = m.getParameter(1) and
251251
receiverType = m.getDeclaringType()
252252
)
253+
or
254+
exists(Method m, AndroidServiceIntentMethod sI |
255+
m.overrides*(sI) and
256+
this.asParameter() = m.getParameter(0) and
257+
receiverType = m.getDeclaringType()
258+
)
253259
}
254260
}
255261

‎java/ql/lib/semmle/code/java/frameworks/android/Intent.qll

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@ class TypeActivity extends Class {
2222
TypeActivity() { this.hasQualifiedName("android.app", "Activity") }
2323
}
2424

25+
/**
26+
* The class `android.app.Service`.
27+
*/
28+
class TypeService extends Class {
29+
TypeService() { this.hasQualifiedName("android.app", "Service") }
30+
}
31+
2532
/**
2633
* The class `android.content.Context`.
2734
*/
@@ -57,6 +64,17 @@ class AndroidReceiveIntentMethod extends Method {
5764
}
5865
}
5966

67+
/**
68+
* The method `Service.onStart`, `onStartCommand`,
69+
* `onBind`, `onRebind`, `onUnbind`, or `onTaskRemoved`.
70+
*/
71+
class AndroidServiceIntentMethod extends Method {
72+
AndroidServiceIntentMethod() {
73+
this.hasName(["onStart", "onStartCommand", "onBind", "onRebind", "onUnbind", "onTaskRemoved"]) and
74+
this.getDeclaringType() instanceof TypeService
75+
}
76+
}
77+
6078
/**
6179
* The method `Context.startActivity` or `startActivities`.
6280
*/

‎java/ql/test/experimental/query-tests/security/CWE-200/FileService.java

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import java.io.FileOutputStream;
2-
2+
import android.os.IBinder;
33
import android.app.Service;
44
import android.content.Intent;
55
import android.net.Uri;
@@ -52,13 +52,18 @@ protected String doInBackground(Object[] params) {
5252
@Override
5353
protected void onPostExecute(String result) {
5454
}
55-
55+
5656
@Override
5757
protected void onPreExecute() {
5858
}
5959

6060
@Override
6161
protected void onProgressUpdate(Void... values) {
62-
}
62+
}
63+
}
64+
65+
@Override
66+
public IBinder onBind(Intent intent) {
67+
return null;
6368
}
6469
}

‎java/ql/test/library-tests/dataflow/taintsources/AndroidManifest.xml

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
<!-- This name is resolved to com.example.myapp.MainActivity
2020
based upon the package attribute -->
21-
<activity android:name=".IntentSources">
21+
<activity android:name=".IntentSourcesActivity">
2222
<intent-filter>
2323
<action android:name="android.intent.action.MAIN" />
2424
<category android:name="android.intent.category.LAUNCHER" />
@@ -28,6 +28,18 @@
2828
<activity
2929
android:name=".DisplayMessageActivity"
3030
android:parentActivityName=".MainActivity" />
31+
32+
<service android:name=".IntentSourcesService">
33+
<intent-filter>
34+
<action android:name="android.intent.action.START_BACKGROUND"/>
35+
</intent-filter>
36+
</service>
37+
38+
<receiver android:name=".IntentSourcesReceiver">
39+
<intent-filter>
40+
<action android:name="android.intent.action.PACKAGE_INSTALL"/>
41+
</intent-filter>
42+
</receiver>
3143
</application>
3244
</manifest>
3345

‎java/ql/test/library-tests/dataflow/taintsources/IntentSources.java renamed to ‎java/ql/test/library-tests/dataflow/taintsources/IntentSourcesActivity.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
import android.app.Activity;
44

5-
public class IntentSources extends Activity {
5+
public class IntentSourcesActivity extends Activity {
66

77
private static void sink(Object o) {}
88

@@ -26,14 +26,13 @@ public void test3() throws java.io.IOException {
2626
sink(trouble); // $hasRemoteTaintFlow
2727

2828
}
29-
3029
}
3130

3231
class OtherClass {
3332

3433
private static void sink(Object o) {}
3534

36-
public void test(IntentSources is) throws java.io.IOException {
35+
public void test(IntentSourcesActivity is) throws java.io.IOException {
3736
String trouble = is.getIntent().getStringExtra("key");
3837
sink(trouble); // $hasRemoteTaintFlow
3938
}

‎java/ql/test/library-tests/dataflow/taintsources/IntentSourcesReceiver.java

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package com.example.myapp;
2+
3+
import android.content.BroadcastReceiver;
4+
import android.content.Context;
5+
import android.content.Intent;
6+
7+
public class IntentSourcesReceiver extends BroadcastReceiver {
8+
9+
private static void sink(Object o) {}
10+
11+
@Override
12+
public void onReceive(Context context, Intent intent) {
13+
{
14+
String trouble = intent.getStringExtra("data");
15+
sink(trouble); // $ hasRemoteTaintFlow
16+
}
17+
{
18+
String trouble = intent.getExtras().getString("data");
19+
sink(trouble); // $ hasRemoteTaintFlow
20+
}
21+
}
22+
}

‎java/ql/test/library-tests/dataflow/taintsources/IntentSourcesService.java

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package com.example.myapp;
2+
3+
import android.app.Service;
4+
import android.content.Context;
5+
import android.content.Intent;
6+
import android.os.IBinder;
7+
8+
public class IntentSourcesService extends Service {
9+
10+
private static void sink(Object o) {}
11+
12+
@Override
13+
public void onStart(Intent intent, int startId) {
14+
{
15+
String trouble = intent.getStringExtra("data");
16+
sink(trouble); // $ hasRemoteTaintFlow
17+
}
18+
{
19+
String trouble = intent.getExtras().getString("data");
20+
sink(trouble); // $ hasRemoteTaintFlow
21+
}
22+
}
23+
24+
@Override
25+
public int onStartCommand(Intent intent, int flags, int startId) {
26+
{
27+
String trouble = intent.getStringExtra("data");
28+
sink(trouble); // $ hasRemoteTaintFlow
29+
}
30+
{
31+
String trouble = intent.getExtras().getString("data");
32+
sink(trouble); // $ hasRemoteTaintFlow
33+
}
34+
return -1;
35+
}
36+
37+
@Override
38+
public IBinder onBind(Intent intent) {
39+
{
40+
String trouble = intent.getStringExtra("data");
41+
sink(trouble); // $ hasRemoteTaintFlow
42+
}
43+
{
44+
String trouble = intent.getExtras().getString("data");
45+
sink(trouble); // $ hasRemoteTaintFlow
46+
}
47+
return null;
48+
}
49+
50+
@Override
51+
public boolean onUnbind(Intent intent) {
52+
{
53+
String trouble = intent.getStringExtra("data");
54+
sink(trouble); // $ hasRemoteTaintFlow
55+
}
56+
{
57+
String trouble = intent.getExtras().getString("data");
58+
sink(trouble); // $ hasRemoteTaintFlow
59+
}
60+
return false;
61+
}
62+
63+
@Override
64+
public void onRebind(Intent intent) {
65+
{
66+
String trouble = intent.getStringExtra("data");
67+
sink(trouble); // $ hasRemoteTaintFlow
68+
}
69+
{
70+
String trouble = intent.getExtras().getString("data");
71+
sink(trouble); // $ hasRemoteTaintFlow
72+
}
73+
}
74+
75+
@Override
76+
public void onTaskRemoved(Intent intent) {
77+
{
78+
String trouble = intent.getStringExtra("data");
79+
sink(trouble); // $ hasRemoteTaintFlow
80+
}
81+
{
82+
String trouble = intent.getExtras().getString("data");
83+
sink(trouble); // $ hasRemoteTaintFlow
84+
}
85+
}
86+
87+
}

0 commit comments

Comments
 (0)