Skip to content

Java: Create new query Cleartext storage of sensitive information in Android databases #6492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
atorralba merged 13 commits into from
Feb 2, 2022
Merged

Java: Create new query Cleartext storage of sensitive information in Android databases #6492

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
f0604e2
Added query for Cleartext Storage in Android Database
atorralba Sep 3, 2021
16b61f7
Fix QLDocs and the qhelp example
atorralba Sep 3, 2021
ee84dae
Fix predicate name
atorralba Nov 11, 2021
c5ed5fc
Apply suggestions from code review
atorralba Nov 12, 2021
4e4f619
Update java/ql/lib/semmle/code/java/security/CleartextStorageAndroidD…
atorralba Jan 17, 2022
baa1f71
Add QLDoc
atorralba Jan 17, 2022
5cf6644
Remove unneeded nonSuspicious values
atorralba Jan 17, 2022
652a1d2
Fix wrongly resolved rebase conflicts
atorralba Jan 17, 2022
4f25359
Fix method name in LocalDatabaseOpenMethodAccess
atorralba Jan 20, 2022
c6dd7dd
Fix stub
atorralba Jan 20, 2022
4df0f39
Move ContentProvider models to the appropriate file
atorralba Jan 20, 2022
4f4f531
Add missing QLDoc
atorralba Jan 24, 2022
54e8ea5
Apply suggestions from code review
atorralba Feb 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix method name in LocalDatabaseOpenMethodAccess
  • Loading branch information
@atorralba
atorralba committed Jan 21, 2022
commit 4f253590f184f05109d30e98c3e8b699d8f33d43
2 changes: 1 addition & 1 deletion java/ql/lib/semmle/code/java/security/CleartextStorageAndroidDatabaseQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ class LocalDatabaseOpenMethodAccess extends Storable, Call {
m.hasName("getWritableDatabase")
or
m.getDeclaringType() instanceof TypeSQLiteDatabase and
m.hasName(["create", "open%Database", "compileStatement"])
m.hasName(["create", "openDatabase", "openOrCreateDatabase", "compileStatement"])
or
m.getDeclaringType().getASupertype*() instanceof TypeContext and
m.hasName("openOrCreateDatabase")
Expand Down
10 changes: 8 additions & 2 deletions java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidDatabaseTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,14 +19,20 @@ public void testCleartextStorageAndroiDatabaseSafe2(Context ctx, String name, St
db.execSQL("DROP TABLE passwords;"); // Safe - no sensitive value being stored
}

public void testCleartextStorageAndroiDatabase1(Context ctx, String name, String password) {
public void testCleartextStorageAndroiDatabase0(Context ctx, String name, String password) {
SQLiteDatabase db = ctx.openOrCreateDatabase("test", Context.MODE_PRIVATE, null);
String query = "INSERT INTO users VALUES ('" + name + "', '" + password + "');";
db.execSQL(query); // $ hasCleartextStorageAndroidDatabase
}

public void testCleartextStorageAndroiDatabase1(Context ctx, String name, String password) {
SQLiteDatabase db = SQLiteDatabase.openDatabase("", null, 0);
String query = "INSERT INTO users VALUES ('" + name + "', '" + password + "');";
db.execSQL(query); // $ hasCleartextStorageAndroidDatabase
}

public void testCleartextStorageAndroiDatabase2(String name, String password) {
SQLiteDatabase db = SQLiteDatabase.create(null);
SQLiteDatabase db = SQLiteDatabase.openOrCreateDatabase("", null);
String query = "INSERT INTO users VALUES (?, ?)";
db.execSQL(query, new String[] {name, password}); // $ hasCleartextStorageAndroidDatabase
}
Expand Down