diff --git a/infer/src/quandary/JavaTrace.ml b/infer/src/quandary/JavaTrace.ml index aa24b0135..14c0d2c68 100644 --- a/infer/src/quandary/JavaTrace.ml +++ b/infer/src/quandary/JavaTrace.ml @@ -202,7 +202,18 @@ module SinkKind = struct Some (taint_nth 0 Intent ~report_reachable:true) | "android.content.Context", "startIntentSender" -> Some (taint_nth 1 Intent ~report_reachable:true) - | "android.content.Intent", ("fillIn" | "parseIntent" | "parseUri") -> + | "android.content.Intent", + ("parseUri" | + "getIntent" | + "getIntentOld" | + "setComponent" | + "setData" | + "setDataAndNormalize" | + "setDataAndType" | + "setDataAndTypeAndNormalize" | + "setPackage") -> + Some (taint_nth 0 Intent ~report_reachable:true) + | "android.content.Intent", "setClassName" -> Some (taint_all Intent ~report_reachable:true) | "android.webkit.WebChromeClient", ("onJsAlert" | "onJsBeforeUnload" | "onJsConfirm" | "onJsPrompt") -> diff --git a/infer/tests/codetoanalyze/java/quandary/Intents.java b/infer/tests/codetoanalyze/java/quandary/Intents.java index 5a0db8010..c4bceec03 100644 --- a/infer/tests/codetoanalyze/java/quandary/Intents.java +++ b/infer/tests/codetoanalyze/java/quandary/Intents.java @@ -75,17 +75,20 @@ public class Intents { activity.stopService(intent); // 20 sinks, 20 expected reports } - public void callAllIntentSinksBad(Intent cleanIntent) throws - IOException, URISyntaxException, XmlPullParserException { - String taintedString = cleanIntent.getStringExtra(""); - Intent taintedIntent = (Intent) InferTaint.inferSecretSource(); - Resources taintedResources = (Resources) ((Object) taintedString); - Uri taintedUri = taintedIntent.getData(); - - Intent intent = new Intent(); - intent.fillIn(taintedIntent, 0); - intent.makeMainSelectorActivity(taintedString, null); - intent.parseIntent(taintedResources, null, null); // 3 sinks, 3 expected results + public void callAllIntentSinks() throws IOException, URISyntaxException, XmlPullParserException { + String taintedString = (String) InferTaint.inferSecretSource(); + Intent.parseUri(taintedString, 0); + Intent.getIntent(taintedString); + Intent.getIntentOld(taintedString); + + Uri taintedUri = (Uri) InferTaint.inferSecretSource(); + Intent i = new Intent(); + i.setClassName(taintedString, ""); + i.setData(taintedUri); + i.setDataAndNormalize(taintedUri); + i.setDataAndType(taintedUri, ""); + i.setDataAndTypeAndNormalize(taintedUri, ""); + i.setPackage(taintedString); // 9 sinks, 9 expected reports } // make sure the rules apply to subclasses of Intent and Context too diff --git a/infer/tests/codetoanalyze/java/quandary/issues.exp b/infer/tests/codetoanalyze/java/quandary/issues.exp index f789b8291..59d815fe0 100644 --- a/infer/tests/codetoanalyze/java/quandary/issues.exp +++ b/infer/tests/codetoanalyze/java/quandary/issues.exp @@ -77,8 +77,15 @@ codetoanalyze/java/quandary/Intents.java, void Intents.callAllActivitySinksBad(A codetoanalyze/java/quandary/Intents.java, void Intents.callAllActivitySinksBad(Activity,String), 21, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to void Activity.startIntentSenderFromChild(Activity,IntentSender,int,Intent,int,int,int)] codetoanalyze/java/quandary/Intents.java, void Intents.callAllActivitySinksBad(Activity,String), 22, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to ComponentName ContextWrapper.startService(Intent)] codetoanalyze/java/quandary/Intents.java, void Intents.callAllActivitySinksBad(Activity,String), 23, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to boolean ContextWrapper.stopService(Intent)] -codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinksBad(Intent), 8, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to int Intent.fillIn(Intent,int)] -codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinksBad(Intent), 10, QUANDARY_TAINT_ERROR, [return from String Intent.getStringExtra(String),call to Intent Intent.parseIntent(Resources,XmlPullParser,AttributeSet)] +codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinks(), 2, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to Intent Intent.parseUri(String,int)] +codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinks(), 3, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to Intent Intent.getIntent(String)] +codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinks(), 4, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to Intent Intent.getIntentOld(String)] +codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinks(), 8, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to Intent Intent.setClassName(String,String)] +codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinks(), 9, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to Intent Intent.setData(Uri)] +codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinks(), 10, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to Intent Intent.setDataAndNormalize(Uri)] +codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinks(), 11, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to Intent Intent.setDataAndType(Uri,String)] +codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinks(), 12, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to Intent Intent.setDataAndTypeAndNormalize(Uri,String)] +codetoanalyze/java/quandary/Intents.java, void Intents.callAllIntentSinks(), 13, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to Intent Intent.setPackage(String)] codetoanalyze/java/quandary/Intents.java, void Intents.reuseIntentBad(Activity), 1, QUANDARY_TAINT_ERROR, [return from Intent Activity.getIntent(),call to void Activity.startActivity(Intent)] codetoanalyze/java/quandary/Intents.java, void Intents.subclassCallBad(IntentSubclass,ContextSubclass), 3, QUANDARY_TAINT_ERROR, [return from Object InferTaint.inferSecretSource(),call to void Context.startActivity(Intent)] codetoanalyze/java/quandary/Intents.java, void MyActivity.onActivityResult(int,int,Intent), 1, QUANDARY_TAINT_ERROR, [return from void MyActivity.onActivityResult(int,int,Intent),call to ComponentName ContextWrapper.startService(Intent)]