Java: Improvements to UnsafeAndroidAccess by atorralba · Pull Request #8537 · github/codeql

atorralba · 2022-03-23T12:48:56Z

Improves the query UnsafeAndroidAccess. When checking that the WebView for which loadUrl is called also has enabled JavaScript (and optionally file access), we weren't taking into account that it could be a ThisAccess instead of a Variable.

There's some code refactoring too (mainly moving predicates from UnsafeAndroidAccess.qll to WebView.qll).

github-actions · 2022-03-23T12:51:19Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Android,``android.*``,46,416,108,,,3,67,,,
+    Android,``android.*``,57,418,108,,,3,67,,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,194,6227,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- android.webkit,3,2,,,,,,,,,,,,,,,,,,,,,,,,3,,,2,,
+ android.webkit,3,13,2,,,,,,,,,,,,,,,,,,,,,,,3,,,13,2,

github-actions · 2022-03-24T08:49:23Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Android,``android.*``,46,416,108,,,3,67,,,
+    Android,``android.*``,57,418,108,,,3,67,,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,194,6227,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- android.webkit,3,2,,,,,,,,,,,,,,,,,,,,,,,,3,,,2,,
+ android.webkit,3,13,2,,,,,,,,,,,,,,,,,,,,,,,3,,,13,2,

smowton

Please expand the tests to include the new sources and models added here (or is this intended as just reorganisation that doesn't change behaviour?)

java/ql/lib/semmle/code/java/frameworks/android/WebView.qll

java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll

github-actions · 2022-03-25T10:02:43Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Android,``android.*``,46,416,108,,,3,67,,,
+    Android,``android.*``,57,418,108,,,3,67,,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,194,6227,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- android.webkit,3,2,,,,,,,,,,,,,,,,,,,,,,,,3,,,2,,
+ android.webkit,3,13,2,,,,,,,,,,,,,,,,,,,,,,,3,,,13,2,

atorralba · 2022-03-25T10:46:07Z

Please expand the tests to include the new sources and models added here (or is this intended as just reorganisation that doesn't change behaviour?)

No, this indeed adds new functionality with the new sources and steps. Added the tests in
c6c72eb, thanks for pointing this out. It actually made me detect a mistake in the sources.

github-actions · 2022-03-25T10:54:14Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Android,``android.*``,46,416,108,,,3,67,,,
+    Android,``android.*``,57,418,108,,,3,67,,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,194,6227,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- android.webkit,3,2,,,,,,,,,,,,,,,,,,,,,,,,3,,,2,,
+ android.webkit,3,13,2,,,,,,,,,,,,,,,,,,,,,,,3,,,13,2,

github-actions · 2022-03-25T10:57:42Z

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

java

Generated file changes for java

Changes to framework-coverage-java.rst:

-    Android,``android.*``,46,416,108,,,3,67,,,
+    Android,``android.*``,57,418,108,,,3,67,,,
-    Totals,,183,6225,1441,106,6,10,107,33,1,81
+    Totals,,194,6227,1441,106,6,10,107,33,1,81

Changes to framework-coverage-java.csv:

- android.webkit,3,2,,,,,,,,,,,,,,,,,,,,,,,,3,,,2,,
+ android.webkit,3,13,2,,,,,,,,,,,,,,,,,,,,,,,3,,,13,2,

smowton

Looking good, just wants a DCA and a FP review. DCA will have to wait til next week; have you already checked with an lgtm all-projects run how many new hits we get and how many look like TPs?

java/ql/src/change-notes/2022-03-24-unsafe-android-access-improvements.md

atorralba · 2022-03-29T08:31:20Z

have you already checked with an lgtm all-projects run how many new hits we get and how many look like TPs?

I did, and I don't like the results — the new sources add too many FPs. I've removed the CSV models from this PR and will create a specific PR for that, after giving it a second thought so that the FPs can be reduced.

atorralba · 2022-03-31T09:52:24Z

FPs and DCA looking good now.

atorralba · 2022-05-02T10:02:05Z

@smowton this PR was simplified, and FP ratio and performance look good, so I think it should be easy to re-review for a final approval.

smowton

Looks plausible

java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll

Co-authored-by: Chris Smowton <smowton@github.com>

This reverts commit c6c72eb.

…ovements.md Co-authored-by: Chris Smowton <smowton@github.com>

Co-authored-by: Chris Smowton <smowton@github.com>

…nto predicates

atorralba · 2022-05-04T09:59:30Z

Had to rebase to solve an error in the CI.

aschackmull

Looks plausible to me now.

atorralba requested a review from a team as a code owner March 23, 2022 12:48

github-actions bot added the Java label Mar 23, 2022

atorralba changed the title ~~Improvements to UnsafeAndroidAccess~~ Java: Improvements to UnsafeAndroidAccess Mar 23, 2022

github-actions bot added the documentation label Mar 24, 2022

smowton reviewed Mar 24, 2022

View reviewed changes

smowton reviewed Mar 25, 2022

View reviewed changes

java/ql/src/change-notes/2022-03-24-unsafe-android-access-improvements.md Outdated Show resolved Hide resolved

atorralba force-pushed the atorralba/unsafe_android_access_improvs branch from e3ac827 to ef1ef0c Compare March 29, 2022 08:39

smowton previously approved these changes May 3, 2022

View reviewed changes

java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll Outdated Show resolved Hide resolved

atorralba dismissed smowton’s stale review via 1821365 May 3, 2022 12:37

aschackmull reviewed May 3, 2022

View reviewed changes

java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll Outdated Show resolved Hide resolved

aschackmull reviewed May 3, 2022

View reviewed changes

java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll Outdated Show resolved Hide resolved

atorralba and others added 10 commits May 4, 2022 10:53

Improvements to UnsafeAndroidAccess

91bdb42

Add change note

b9859fe

Apply suggestions from code review

51dfebf

Co-authored-by: Chris Smowton <smowton@github.com>

Consider implicit this accesses in WebViewRef

d68311e

Move things around

b678467

Add tests and stubs for the new sources and flow steps

7ba5a03

Remove getUnderlyingExpr

f5e72e6

Removed unnecessary imports

dce11f3

Remove everything related to WebView CSV models

49259a6

This reverts commit c6c72eb.

Update java/ql/src/change-notes/2022-03-24-unsafe-android-access-impr…

1920176

…ovements.md Co-authored-by: Chris Smowton <smowton@github.com>

atorralba and others added 2 commits May 4, 2022 10:53

Update java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll

3b1210e

Co-authored-by: Chris Smowton <smowton@github.com>

Fix bad join order by moving WebViewRef::getAnAccess from callsites i…

8601137

…nto predicates

atorralba force-pushed the atorralba/unsafe_android_access_improvs branch from 1821365 to 8601137 Compare May 4, 2022 09:59

aschackmull approved these changes May 5, 2022

View reviewed changes

atorralba merged commit ca2959c into github:main May 5, 2022

Conversation

atorralba commented Mar 23, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 23, 2022

java

Generated file changes for java

Uh oh!

github-actions bot commented Mar 24, 2022

java

Generated file changes for java

Uh oh!

smowton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 25, 2022

java

Generated file changes for java

Uh oh!

atorralba commented Mar 25, 2022

Uh oh!

github-actions bot commented Mar 25, 2022

java

Generated file changes for java

Uh oh!

github-actions bot commented Mar 25, 2022

java

Generated file changes for java

Uh oh!

smowton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

atorralba commented Mar 29, 2022

Uh oh!

atorralba commented Mar 31, 2022

Uh oh!

atorralba commented May 2, 2022

Uh oh!

smowton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

atorralba commented May 4, 2022

Uh oh!

aschackmull left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

atorralba commented Mar 23, 2022 •

edited

Loading