Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Android: Add androidx.slice.builders models #6801

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Android: Add androidx.slice.builders models #6801

wants to merge 7 commits into from

Conversation

@atorralba
Copy link
Contributor

@atorralba atorralba commented Oct 4, 2021 •
edited

This PR adds models for the package androidx.slice.builders. It also adds some sources from androidx.slice.SliceProvider.

It mostly models the fluent behavior of ListBuilder and its inner classes with value-preserving steps, but also adds taint steps for methods that handle PendingIntents. For instance, a PendingIntent can be added to a SliceAction with createDeeplink, then the SliceAction can be added to a ListBuilder$RowBuilder with setPrimaryAction and finally the RowBuilder is added to the ListBuilder with addRow.
@atorralba atorralba requested a review from as a code owner Oct 4, 2021
@github-actions github-actions bot added the Java label Oct 4, 2021
@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Oct 4, 2021

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged. The following differences were found:

java

Generated file changes for java

  • Changes to framework-coverage-java.rst:
-    Others,"``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jooq``, ``org.mvel2``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``",7,28,151,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jooq``, ``org.mvel2``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``",12,116,151,,,,14,18,,
-    Totals,,143,4986,408,13,6,10,107,33,1,66
+    Totals,,148,5074,408,13,6,10,107,33,1,66
  • Changes to framework-coverage-java.csv:
+ androidx.slice,,5,88,,,,,,,,,,,,,,,,,,,5,,26,62

@atorralba atorralba mentioned this pull request Oct 4, 2021
Draft
@atorralba atorralba force-pushed the atorralba/android_slice_models branch from f62a7d3 to a0fd9bb Oct 5, 2021
@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Oct 5, 2021

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged. The following differences were found:

java

Generated file changes for java

  • Changes to framework-coverage-java.rst:
-    Others,"``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jooq``, ``org.mvel2``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``",7,28,151,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jooq``, ``org.mvel2``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``",12,116,151,,,,14,18,,
-    Totals,,143,5125,408,13,6,10,107,33,1,66
+    Totals,,148,5213,408,13,6,10,107,33,1,66
  • Changes to framework-coverage-java.csv:
+ androidx.slice,,5,88,,,,,,,,,,,,,,,,,,,5,,26,62

bmuskalla
bmuskalla reviewed Oct 6, 2021
View changes
Copy link
Contributor

@bmuskalla bmuskalla left a comment

Minor suggestions but LGTM overall

java/ql/lib/semmle/code/java/frameworks/android/Slice.qll Outdated Show resolved Hide resolved
java/ql/lib/semmle/code/java/frameworks/android/Slice.qll Outdated Show resolved Hide resolved
java/ql/lib/semmle/code/java/frameworks/android/Slice.qll Outdated Show resolved Hide resolved
java/ql/lib/semmle/code/java/frameworks/android/Slice.qll Outdated Show resolved Hide resolved
java/ql/test/library-tests/frameworks/android/slice/test.ql Show resolved Hide resolved
@atorralba
Copy link
Contributor Author

@atorralba atorralba commented Oct 7, 2021 •
edited

Thanks for the review @bmuskalla! Some of your comments made me think that using general taint for my purpose (tracking PendingIntent taint for #6779) is probably not the best option, because it can get mixed with other types of taint (like the title or description you mentioned in #6801 (comment)). So I think I'm going to rewrite the taint steps so that they use a more precise synthetic field to carry the taint from a PendingIntent, and thus there's no confusion with other sources of taint.

atorralba added 5 commits Oct 7, 2021
@atorralba
Add Android Slice models
1a04ad9
@atorralba
Add stubs
588dedc
@atorralba
Fix QLDoc
ffa77f0
@atorralba
Reorganize fluent models
0325c07
@atorralba
Use synthetic fields to improve taint precision
91efb61
@atorralba atorralba force-pushed the atorralba/android_slice_models branch from a0fd9bb to 91efb61 Oct 7, 2021
@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Oct 7, 2021

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged. The following differences were found:

java

Generated file changes for java

  • Changes to framework-coverage-java.rst:
-    Others,"``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jooq``, ``org.mvel2``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``",7,28,151,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jooq``, ``org.mvel2``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``",12,116,151,,,,14,18,,
-    Totals,,143,5137,408,13,6,10,107,33,1,66
+    Totals,,148,5225,408,13,6,10,107,33,1,66
  • Changes to framework-coverage-java.csv:
+ androidx.slice,,5,88,,,,,,,,,,,,,,,,,,,5,,27,61

@atorralba
Merge branch 'main' into atorralba/android_slice_models
5deb996
@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Oct 18, 2021

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged. The following differences were found:

java

Generated file changes for java

  • Changes to framework-coverage-java.rst:
-    Others,"``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jooq``, ``org.mvel2``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``",7,28,151,,,,14,18,,
+    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.unboundid.ldap.sdk``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jooq``, ``org.mvel2``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``",12,116,151,,,,14,18,,
-    Totals,,143,5257,408,13,6,10,107,33,1,66
+    Totals,,148,5345,408,13,6,10,107,33,1,66
  • Changes to framework-coverage-java.csv:
+ androidx.slice,,5,88,,,,,,,,,,,,,,,,,,,5,,27,61

@atorralba
Fix stubs
9d50511
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bmuskalla bmuskalla

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
Java
Projects
None yet
Milestone
No milestone
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants
@atorralba @bmuskalla