/* * Copyright (c) 2017 - present Facebook, Inc. * All rights reserved. * * This source code is licensed under the BSD style license found in the * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. */ package codetoanalyze.java.quandary; import android.app.Activity; import android.content.ClipboardManager; import android.text.Html; import android.text.Spanned; import android.widget.EditText; import java.io.IOException; import java.lang.Runtime; import com.facebook.infer.builtins.InferTaint; public class UserControlledStrings { ClipboardManager clipboard; void readClipboardSourcesBad() { InferTaint.inferSensitiveSink(clipboard.getText()); InferTaint.inferSensitiveSink(clipboard.getPrimaryClip()); InferTaint.inferSensitiveSink(clipboard.getPrimaryClip().getItemAt(5)); InferTaint.inferSensitiveSink(clipboard.getPrimaryClip().getItemAt(5).getText()); InferTaint.inferSensitiveSink(clipboard.getPrimaryClip().toString()); // 5 reports } Spanned clipboardToHtmlBad() { return Html.fromHtml(clipboard.getText().toString()); } EditText mEditText; Spanned editTextToHtmlBad() { return Html.fromHtml(mEditText.getText().toString()); } void clipboardToShellDirectBad() throws IOException { Runtime.getRuntime().exec(clipboard.getText().toString()); } void clipboardToShellArrayBad() throws IOException { String[] cmds = new String[] { "ls", clipboard.getText().toString() }; Runtime.getRuntime().exec(cmds); } }