Skip to content

Java: Add flow step from startActivity to getIntent #8873

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

atorralba
Copy link
Contributor

In exported activities, getIntent() is considered a remote source. Nonetheless, sometimes user input is added to intents (e.g. as extras) that are sent to non-exported activities, tainting the getIntent() calls of those as well.

This PR adds a value-preserving step to support that case.

aschackmull
aschackmull previously approved these changes May 2, 2022
Copy link
Contributor

@aschackmull aschackmull left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks reasonable to me. If the join-order in StartActivityIntentStep::step produces something reasonable, then I'd say this looks good to merge.

@atorralba atorralba force-pushed the atorralba/android-startactivity-flowstep branch from 1054feb to cf55f18 Compare May 3, 2022 13:56
@atorralba
Copy link
Contributor Author

There isn't any bad join order metric being triggered in DCA.

By looking at some query logs manually (I had to change StartActivityIntentStep to extend Unit, otherwise I couldn't find it in the query log, I guess because it got shadowed by AdditionalValueStep tuple counts), I got the following:

[2022-05-10 11:24:11] (0s) Tuple counts for Intent::StartActivityIntentStep::step#dispred#f0820431#cpe#23#ff/2@fea16adh after 1ms:
                      1    ~0%     {0} r1 = SELECT DataFlowPrivate::TNormalReturnKinddom#a63c994e# ON 0 >= 0
                      5730 ~0%     {2} r2 = JOIN r1 WITH Expr::MethodAccess::getArgument#dispred#f0820431#fbf#cpe#13 CARTESIAN PRODUCT OUTPUT Rhs.0, Rhs.1
                      5730 ~0%     {2} r3 = JOIN r2 WITH Expr::MethodAccess::getMethod#dispred#f0820431#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1
                      
                      1    ~0%     {1} r4 = JOIN r3 WITH Intent::ContextStartActivityMethod#class#f5dac5da#f ON FIRST 1 OUTPUT Lhs.1
                      
                      533  ~0%     {2} r5 = JOIN r3 WITH #Member::Method::overrides#dispred#f0820431Plus#bf ON FIRST 1 OUTPUT Rhs.1, Lhs.1
                      4    ~0%     {1} r6 = JOIN r5 WITH Intent::ContextStartActivityMethod#class#f5dac5da#f ON FIRST 1 OUTPUT Lhs.1
                      
                      5    ~0%     {1} r7 = r4 UNION r6
                      5    ~0%     {2} r8 = JOIN r7 WITH DataFlowNodes::TExprNode#b728817f#ff ON FIRST 1 OUTPUT Lhs.0, Rhs.1 'n1'
                      5    ~0%     {2} r9 = JOIN r8 WITH DataFlowNodes::TExprNode#b728817f#ff ON FIRST 1 OUTPUT Rhs.1 'n1', Lhs.1 'n1'
                      
                      4    ~0%     {2} r10 = JOIN r9 WITH #DataFlowUtil::localFlowStep#0516ed17Plus#bf_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'n1'
                      
                      9    ~0%     {2} r11 = r9 UNION r10
                      9    ~0%     {2} r12 = JOIN r11 WITH DataFlowNodes::TExprNode#b728817f#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'n1'
                      4    ~0%     {3} r13 = JOIN r12 WITH Expr::ConstructorCall::getConstructedType#dispred#f0820431#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'n1', Lhs.0
                      4    ~0%     {3} r14 = JOIN r13 WITH Intent::TypeIntent#class#f5dac5da#b ON FIRST 1 OUTPUT Lhs.2, 1, Lhs.1 'n1'
                      4    ~0%     {2} r15 = JOIN r14 WITH Expr::ClassInstanceExpr::getArgument#dispred#f0820431#fff ON FIRST 2 OUTPUT Rhs.2, Lhs.2 'n1'
                      4    ~0%     {2} r16 = JOIN r15 WITH Expr::Expr::getType#dispred#f0820431#bf ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'n1'
                      1    ~0%     {2} r17 = JOIN r16 WITH Generics::ParameterizedType::getATypeArgument#dispred#f0820431#bf ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'n1'
                      72   ~0%     {2} r18 = JOIN r17 WITH Expr::MethodAccess::getReceiverType#dispred#f0820431#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'n1'
                      72   ~0%     {3} r19 = JOIN r18 WITH Expr::MethodAccess::getMethod#dispred#f0820431#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'n1', Lhs.0
                      
                      1    ~0%     {2} r20 = JOIN r19 WITH Intent::AndroidGetIntentMethod#class#f5dac5da#f ON FIRST 1 OUTPUT Lhs.2, Lhs.1 'n1'
                      
                      21   ~0%     {3} r21 = JOIN r19 WITH #Member::Method::overrides#dispred#f0820431Plus#bf ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'n1', Lhs.2
                      0    ~0%     {2} r22 = JOIN r21 WITH Intent::AndroidGetIntentMethod#class#f5dac5da#f ON FIRST 1 OUTPUT Lhs.2, Lhs.1 'n1'
                      
                      1    ~0%     {2} r23 = r20 UNION r22
                      1    ~0%     {2} r24 = JOIN r23 WITH DataFlowNodes::TExprNode#b728817f#ff ON FIRST 1 OUTPUT Lhs.1 'n1', Rhs.1 'n1'
                                   return r24

Nothing unreasonable as far as I can see. The cartesian product with MethodAccess::getArgument seems a bit suspicious, but I'm not sure we can avoid that. Do you think it could be a problem?

@aschackmull
Copy link
Contributor

The cartesian product with MethodAccess::getArgument seems a bit suspicious, but I'm not sure we can avoid that. Do you think it could be a problem?

The left-hand side of that cartesian product is a size 1 constant, so that's completely harmless.

@aschackmull aschackmull merged commit 25336df into github:main May 11, 2022
@atorralba atorralba deleted the atorralba/android-startactivity-flowstep branch May 11, 2022 09:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants