Skip to content

Java: Create new query Cleartext storage of sensitive information in Android databases #6492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
atorralba merged 13 commits into from
Feb 2, 2022
Merged

Java: Create new query Cleartext storage of sensitive information in Android databases #6492

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
f0604e2
Added query for Cleartext Storage in Android Database
atorralba Sep 3, 2021
16b61f7
Fix QLDocs and the qhelp example
atorralba Sep 3, 2021
ee84dae
Fix predicate name
atorralba Nov 11, 2021
c5ed5fc
Apply suggestions from code review
atorralba Nov 12, 2021
4e4f619
Update java/ql/lib/semmle/code/java/security/CleartextStorageAndroidD…
atorralba Jan 17, 2022
baa1f71
Add QLDoc
atorralba Jan 17, 2022
5cf6644
Remove unneeded nonSuspicious values
atorralba Jan 17, 2022
652a1d2
Fix wrongly resolved rebase conflicts
atorralba Jan 17, 2022
4f25359
Fix method name in LocalDatabaseOpenMethodAccess
atorralba Jan 20, 2022
c6dd7dd
Fix stub
atorralba Jan 20, 2022
4df0f39
Move ContentProvider models to the appropriate file
atorralba Jan 20, 2022
4f4f531
Add missing QLDoc
atorralba Jan 24, 2022
54e8ea5
Apply suggestions from code review
atorralba Feb 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix predicate name
  • Loading branch information
@atorralba
atorralba committed Jan 21, 2022
commit ee84dae164d774eb07bf9bc0a4518e0f3b1c2922
2 changes: 1 addition & 1 deletion java/ql/src/Security/CWE/CWE-312/CleartextStorageAndroidDatabase.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,6 @@ from SensitiveSource data, LocalDatabaseOpenMethodAccess s, Expr input, Expr sto
where
input = s.getAnInput() and
store = s.getAStore() and
data.flowsToCached(input)
data.flowsTo(input)
select store, "SQLite database $@ containing $@ is stored $@. Data was added $@.", s, s.toString(),
data, "sensitive data", store, "here", input, "here"
2 changes: 1 addition & 1 deletion java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidDatabaseTest.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ class CleartextStorageAndroidDatabaseTest extends InlineExpectationsTest {
exists(SensitiveSource data, LocalDatabaseOpenMethodAccess s, Expr input, Expr store |
input = s.getAnInput() and
store = s.getAStore() and
data.flowsToCached(input)
data.flowsTo(input)
|
input.getLocation() = location and
element = input.toString() and
Expand Down
1 change: 1 addition & 0 deletions java/ql/test/stubs/google-android-9.0.0/android/database/sqlite/SQLiteDatabase.java
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.