Skip to content

Commit 1308759

Browse files
michaelnebelmichaelnebel
committed
Java: Improve the Api sources implementation.
1 parent b754706 commit 1308759

13 files changed

+45
-64
lines changed

‎java/ql/lib/semmle/code/java/dataflow/ApiSources.qll‎

Lines changed: 18 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -2,68 +2,33 @@
22

33
private import semmle.code.java.dataflow.DataFlow
44
private import semmle.code.java.dataflow.ExternalFlow
5+
private import semmle.code.java.dataflow.FlowSources as FlowSources
56

6-
/**
7-
* A data flow source node.
8-
*/
9-
abstract class SourceNode extends DataFlow::Node { }
7+
class SourceNode = FlowSources::ApiSourceNode;
108

119
/**
1210
* Module that adds all API like sources to `SourceNode`, excluding some sources for cryptography based
1311
* queries, and queries where sources are not succifiently defined (eg. using broad method name matching).
1412
*/
15-
private module ApiSources {
16-
private import FlowSources as FlowSources
17-
private import semmle.code.java.security.ArbitraryApkInstallation as ArbitraryApkInstallation
18-
private import semmle.code.java.security.CleartextStorageAndroidDatabaseQuery as CleartextStorageAndroidDatabaseQuery
19-
private import semmle.code.java.security.CleartextStorageAndroidFilesystemQuery as CleartextStorageAndroidFilesystemQuery
20-
private import semmle.code.java.security.CleartextStorageCookieQuery as CleartextStorageCookieQuery
21-
private import semmle.code.java.security.CleartextStorageSharedPrefsQuery as CleartextStorageSharedPrefsQuery
22-
private import semmle.code.java.security.ImplicitPendingIntentsQuery as ImplicitPendingIntentsQuery
23-
private import semmle.code.java.security.ImproperIntentVerificationQuery as ImproperIntentVerificationQuery
24-
private import semmle.code.java.security.InsecureTrustManager as InsecureTrustManager
25-
private import semmle.code.java.security.JWT as Jwt
26-
private import semmle.code.java.security.StackTraceExposureQuery as StackTraceExposureQuery
27-
private import semmle.code.java.security.ZipSlipQuery as ZipSlipQuery
28-
29-
private class FlowSourcesSourceNode extends SourceNode instanceof FlowSources::SourceNode { }
30-
31-
private class ArbitraryApkInstallationSources extends SourceNode instanceof ArbitraryApkInstallation::ExternalApkSource
32-
{ }
33-
34-
private class CleartextStorageAndroidDatabaseQuerySources extends SourceNode instanceof CleartextStorageAndroidDatabaseQuery::LocalDatabaseOpenMethodCallSource
35-
{ }
36-
37-
private class CleartextStorageAndroidFilesystemQuerySources extends SourceNode instanceof CleartextStorageAndroidFilesystemQuery::LocalFileOpenCallSource
38-
{ }
39-
40-
private class CleartextStorageCookieQuerySources extends SourceNode instanceof CleartextStorageCookieQuery::CookieSource
41-
{ }
42-
43-
private class CleartextStorageSharedPrefsQuerySources extends SourceNode instanceof CleartextStorageSharedPrefsQuery::SharedPreferencesEditorMethodCallSource
44-
{ }
45-
46-
private class ImplicitPendingIntentsQuerySources extends SourceNode instanceof ImplicitPendingIntentsQuery::ImplicitPendingIntentSource
47-
{ }
48-
49-
private class ImproperIntentVerificationQuerySources extends SourceNode instanceof ImproperIntentVerificationQuery::VerifiedIntentConfigSource
50-
{ }
51-
52-
private class InsecureTrustManagerSources extends SourceNode instanceof InsecureTrustManager::InsecureTrustManagerSource
53-
{ }
54-
55-
private class JwtSources extends SourceNode instanceof Jwt::JwtParserWithInsecureParseSource { }
56-
57-
private class StackTraceExposureQuerySources extends SourceNode instanceof StackTraceExposureQuery::GetMessageFlowSource
58-
{ }
59-
60-
private class ZipSlipQuerySources extends SourceNode instanceof ZipSlipQuery::ArchiveEntryNameMethodSource
61-
{ }
13+
private module AllApiSources {
14+
private import semmle.code.java.security.ArbitraryApkInstallation
15+
private import semmle.code.java.security.CleartextStorageAndroidDatabaseQuery
16+
private import semmle.code.java.security.CleartextStorageAndroidFilesystemQuery
17+
private import semmle.code.java.security.CleartextStorageCookieQuery
18+
private import semmle.code.java.security.CleartextStorageSharedPrefsQuery
19+
private import semmle.code.java.security.ImplicitPendingIntentsQuery
20+
private import semmle.code.java.security.ImproperIntentVerificationQuery
21+
private import semmle.code.java.security.InsecureTrustManager
22+
private import semmle.code.java.security.JWT
23+
private import semmle.code.java.security.StackTraceExposureQuery
24+
private import semmle.code.java.security.ZipSlipQuery
25+
26+
private class AddSourceNode extends SourceNode instanceof FlowSources::SourceNode { }
6227

6328
/**
6429
* Add all models as data sources.
6530
*/
66-
private class SourceNodeExternal extends SourceNode {
67-
SourceNodeExternal() { sourceNode(this, _) }
31+
private class ApiSourceNodeExternal extends SourceNode {
32+
ApiSourceNodeExternal() { sourceNode(this, _) }
6833
}
6934
}

‎java/ql/lib/semmle/code/java/dataflow/FlowSources.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -387,3 +387,9 @@ class AndroidJavascriptInterfaceMethodParameter extends RemoteFlowSource {
387387
result = "Parameter of method with JavascriptInterface annotation"
388388
}
389389
}
390+
391+
/**
392+
* A data flow source node for an API, which should be considered
393+
* supported for a modelling perspective.
394+
*/
395+
abstract class ApiSourceNode extends DataFlow::Node { }

‎java/ql/lib/semmle/code/java/security/ArbitraryApkInstallation.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ class UriConstructorMethod extends Method {
6969
* A dataflow source representing the URIs which an APK not controlled by the
7070
* application may come from. Including external storage and web URLs.
7171
*/
72-
class ExternalApkSource extends DataFlow::Node {
72+
class ExternalApkSource extends ApiSourceNode {
7373
ExternalApkSource() {
7474
sourceNode(this, "android-external-storage-dir") or
7575
this.asExpr().(MethodCall).getMethod() instanceof UriConstructorMethod or

‎java/ql/lib/semmle/code/java/security/CleartextStorageAndroidDatabaseQuery.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import semmle.code.java.frameworks.android.ContentProviders
66
import semmle.code.java.frameworks.android.Intent
77
import semmle.code.java.frameworks.android.SQLite
88
import semmle.code.java.security.CleartextStorageQuery
9+
private import semmle.code.java.dataflow.FlowSources
910

1011
private class LocalDatabaseCleartextStorageSink extends CleartextStorageSink {
1112
LocalDatabaseCleartextStorageSink() { localDatabaseInput(_, this.asExpr()) }
@@ -99,7 +100,7 @@ private predicate localDatabaseStore(DataFlow::Node database, MethodCall store)
99100
/**
100101
* A class of local database open method call source nodes.
101102
*/
102-
class LocalDatabaseOpenMethodCallSource extends DataFlow::Node {
103+
class LocalDatabaseOpenMethodCallSource extends ApiSourceNode {
103104
LocalDatabaseOpenMethodCallSource() { this.asExpr() instanceof LocalDatabaseOpenMethodCall }
104105
}
105106

‎java/ql/lib/semmle/code/java/security/CleartextStorageAndroidFilesystemQuery.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import java
77
import semmle.code.java.dataflow.DataFlow
88
private import semmle.code.java.dataflow.ExternalFlow
9+
private import semmle.code.java.dataflow.FlowSources
910
import semmle.code.java.security.CleartextStorageQuery
1011
import semmle.code.xml.AndroidManifest
1112

@@ -82,7 +83,7 @@ private class CloseFileMethod extends Method {
8283
/**
8384
* A class of local file open call source nodes.
8485
*/
85-
class LocalFileOpenCallSource extends DataFlow::Node {
86+
class LocalFileOpenCallSource extends ApiSourceNode {
8687
LocalFileOpenCallSource() { this.asExpr() instanceof LocalFileOpenCall }
8788
}
8889

‎java/ql/lib/semmle/code/java/security/CleartextStorageCookieQuery.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import java
44
import semmle.code.java.dataflow.DataFlow
55
deprecated import semmle.code.java.dataflow.DataFlow3
66
import semmle.code.java.security.CleartextStorageQuery
7+
private import semmle.code.java.dataflow.FlowSources
78

89
private class CookieCleartextStorageSink extends CleartextStorageSink {
910
CookieCleartextStorageSink() { this.asExpr() = cookieInput(_) }
@@ -40,7 +41,7 @@ private predicate cookieStore(DataFlow::Node cookie, Expr store) {
4041
/**
4142
* A class of cookie source nodes.
4243
*/
43-
class CookieSource extends DataFlow::Node {
44+
class CookieSource extends ApiSourceNode {
4445
CookieSource() { this.asExpr() instanceof Cookie }
4546
}
4647

‎java/ql/lib/semmle/code/java/security/CleartextStorageSharedPrefsQuery.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import java
44
import semmle.code.java.dataflow.DataFlow
55
import semmle.code.java.frameworks.android.SharedPreferences
66
import semmle.code.java.security.CleartextStorageQuery
7+
private import semmle.code.java.dataflow.FlowSources
78

89
private class SharedPrefsCleartextStorageSink extends CleartextStorageSink {
910
SharedPrefsCleartextStorageSink() {
@@ -70,7 +71,7 @@ private predicate sharedPreferencesStore(DataFlow::Node editor, MethodCall m) {
7071
/**
7172
* A shared preferences editor method call source nodes.
7273
*/
73-
class SharedPreferencesEditorMethodCallSource extends DataFlow::Node {
74+
class SharedPreferencesEditorMethodCallSource extends ApiSourceNode {
7475
SharedPreferencesEditorMethodCallSource() {
7576
this.asExpr() instanceof SharedPreferencesEditorMethodCall
7677
}

‎java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import java
44
private import semmle.code.java.dataflow.ExternalFlow
5+
private import semmle.code.java.dataflow.FlowSources
56
private import semmle.code.java.dataflow.TaintTracking
67
private import semmle.code.java.frameworks.android.Intent
78
private import semmle.code.java.frameworks.android.PendingIntent
@@ -27,7 +28,7 @@ class NoState extends PendingIntentState, TNoState {
2728
}
2829

2930
/** A source for an implicit `PendingIntent` flow. */
30-
abstract class ImplicitPendingIntentSource extends DataFlow::Node {
31+
abstract class ImplicitPendingIntentSource extends ApiSourceNode {
3132
/**
3233
* DEPRECATED: Open-ended flow state is not intended to be part of the extension points.
3334
*

‎java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import java
44
import semmle.code.java.dataflow.DataFlow
55
import semmle.code.xml.AndroidManifest
66
import semmle.code.java.frameworks.android.Intent
7+
private import semmle.code.java.dataflow.FlowSources
78

89
/** An `onReceive` method of a `BroadcastReceiver` */
910
private class OnReceiveMethod extends Method {
@@ -16,7 +17,7 @@ private class OnReceiveMethod extends Method {
1617
/**
1718
* A class of verified intent source nodes.
1819
*/
19-
class VerifiedIntentConfigSource extends DataFlow::Node {
20+
class VerifiedIntentConfigSource extends ApiSourceNode {
2021
VerifiedIntentConfigSource() {
2122
this.asParameter() = any(OnReceiveMethod orm).getIntentParameter()
2223
}

‎java/ql/lib/semmle/code/java/security/InsecureTrustManager.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
/** Provides classes and predicates to reason about insecure `TrustManager`s. */
22

33
import java
4+
private import semmle.code.java.dataflow.FlowSources
45
private import semmle.code.java.controlflow.Guards
56
private import semmle.code.java.security.Encryption
67
private import semmle.code.java.security.SecurityFlag
78

89
/** The creation of an insecure `TrustManager`. */
9-
abstract class InsecureTrustManagerSource extends DataFlow::Node { }
10+
abstract class InsecureTrustManagerSource extends ApiSourceNode { }
1011

1112
private class DefaultInsecureTrustManagerSource extends InsecureTrustManagerSource {
1213
DefaultInsecureTrustManagerSource() {

0 commit comments

Comments
 (0)