Reviewed By: mburman Differential Revision: D4917047 fbshipit-source-id: 994891bmaster
Sam Blackshear
8 years ago
committed by
Facebook Github Bot
parent
05a9270b13
commit
20aff78b36
@ -0,0 +1,77 @@
|
||||
/*
|
||||
* Copyright (c) 2017 - present Facebook, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* This source code is licensed under the BSD style license found in the
|
||||
* LICENSE file in the root directory of this source tree. An additional grant
|
||||
* of patent rights can be found in the PATENTS file in the same directory.
|
||||
*/
|
||||
|
||||
package codetoanalyze.java.quandary;
|
||||
|
||||
import java.io.File;
|
||||
|
||||
import android.content.ContentProvider;
|
||||
import android.content.ContentValues;
|
||||
import android.content.res.AssetFileDescriptor;
|
||||
import android.database.Cursor;
|
||||
import android.net.Uri;
|
||||
import android.os.Bundle;
|
||||
import android.os.CancellationSignal;
|
||||
import android.os.ParcelFileDescriptor;
|
||||
|
||||
public abstract class ContentProviders extends ContentProvider {
|
||||
|
||||
File mFile;
|
||||
|
||||
@Override
|
||||
public int bulkInsert(Uri uri, ContentValues[] values) {
|
||||
mFile = new File(uri.toString());
|
||||
return 0;
|
||||
}
|
||||
|
||||
@Override
|
||||
public int delete(Uri uri, String selection, String[] selectionArgs) {
|
||||
mFile = new File(uri.toString());
|
||||
return 0;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Uri insert(Uri uri, ContentValues values) {
|
||||
mFile = new File(uri.toString());
|
||||
return null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public AssetFileDescriptor openAssetFile(Uri uri, String mode, CancellationSignal signal) {
|
||||
mFile = new File(uri.toString());
|
||||
return null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public ParcelFileDescriptor openFile(Uri uri, String mode, CancellationSignal signal) {
|
||||
mFile = new File(uri.toString());
|
||||
return null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public AssetFileDescriptor openTypedAssetFile(
|
||||
Uri uri, String mimeTypeFilter, Bundle opts, CancellationSignal signal) {
|
||||
mFile = new File(uri.toString());
|
||||
return null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Cursor query(
|
||||
Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder) {
|
||||
mFile = new File(uri.toString());
|
||||
return null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public int update(Uri uri, ContentValues values, String selection, String[] selectionArgs) {
|
||||
mFile = new File(uri.toString());
|
||||
return 0;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,47 @@
|
||||
/*
|
||||
* Copyright (c) 2017 - present Facebook, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* This source code is licensed under the BSD style license found in the
|
||||
* LICENSE file in the root directory of this source tree. An additional grant
|
||||
* of patent rights can be found in the PATENTS file in the same directory.
|
||||
*/
|
||||
|
||||
package codetoanalyze.java.quandary;
|
||||
|
||||
import com.facebook.infer.builtins.InferTaint;
|
||||
import java.io.File;
|
||||
import java.nio.file.FileSystems;
|
||||
import java.nio.file.Path;
|
||||
import java.nio.file.Paths;
|
||||
|
||||
public class Files {
|
||||
|
||||
public File fileConstructorSinkBad() {
|
||||
String taintedString = (String) InferTaint.inferSecretSource();
|
||||
return new File(taintedString);
|
||||
}
|
||||
|
||||
public Path fileSystemConstructorSinkBad1() {
|
||||
String taintedString = (String) InferTaint.inferSecretSource();
|
||||
return FileSystems.getDefault().getPath(taintedString);
|
||||
}
|
||||
|
||||
// testing varags
|
||||
public Path fileSystemConstructorSinkBad2() {
|
||||
String taintedString = (String) InferTaint.inferSecretSource();
|
||||
return FileSystems.getDefault().getPath("", taintedString);
|
||||
}
|
||||
|
||||
public Path pathsSinkBad1() {
|
||||
String taintedString = (String) InferTaint.inferSecretSource();
|
||||
return Paths.get(taintedString);
|
||||
}
|
||||
|
||||
// testing varags
|
||||
public Path pathsSinkBad2() {
|
||||
String taintedString = (String) InferTaint.inferSecretSource();
|
||||
return Paths.get("", taintedString);
|
||||
}
|
||||
|
||||
}
|
||||
Loading…
Reference in new issue