This PR adds a query to detect Intent URI Permission Manipulation in Android applications. The query detects when an exported Activity is obtaining a user-provided Intent and redirecting it back to the calling application. Also, it requires that a non-exported Content Provider with the attribute android:grantUriPermissions="true" exists in the project.

Description

When an externally provided Intent is returned to an Activity with setResult, a malicious application could exploit this by manipulating the Intent to grant itself permissions to access arbitrary Content Providers that are accessible by the vulnerable application.

Evaluation

The query finds 3 TP when run on a set of 1k Android open source projects.

By adding the source defined in #6963, this goes up to 4 TP results (the extra result occurs in an intentionally vulnerable application).