Java


JAVA.IO.INJ.ANDROID.URL : Android URL Injection (Java)

Summary

Tainted Android device data flows into an field or method annotated as @UrlTrusted.

Checks for this class use the CodeSonar Java taint analysis. See Taint Tracking for CodeSonar Java Warning Classes for more information on this analysis, including lists of the methods that CodeSonar automatically recognizes as relevant and information about specifying additional methods that CodeSonar should recognize as taint sources, sinks, or sanitizers.

Properties

Class Name Android URL Injection (Java)
Significance security
Mnemonic JAVA.IO.INJ.ANDROID.URL
Categories
CWE CWE:74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  CWE:601 URL Redirection to Untrusted Site ('Open Redirect')
OWASP-2017 OWASP-2017:A3 Sensitive data exposure
OWASP-2021 OWASP-2021:A2 Cryptographic failures
Availability Available for Java only.

Android Only. Warnings of this class will only be reported in Android code: that is, code that uses the Android API.

Enabling Checks for this warning class are disabled by default. To enable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += allow class="Android URL Injection (Java)"

Example

public class MainActivity extends AppCompatActivity {
  private Button button;
  private EditText text;

  @Override
  protected void onCreate(Bundle savedInstanceState) {
      super.onCreate(savedInstanceState);
      setContentView(R.layout.activity_main);
      button = (Button) this.findViewById(R.id.goToSecond);
      button.setOnClickListener( new View.OnClickListener() {
          @Override
          public void onClick(View v) {
              String writeText=text.getText().toString();
              memorizeText(writeText);
          }
      });
  }

  private void memorizeText(String writeText) {
    try {
      OutputStreamWriter outputStreamWriter = new OutputStreamWriter(this.openFileOutput("StoreMyNotes.txt", Context.MODE_PRIVATE));
      outputStreamWriter.write(writeText);
      outputStreamWriter.close();
    }
    catch (IOException e) {
      Log.d("Err",e.getMessage());
      onBugShake();
    }
  }

  private void onBugShake(){
      TelephonyManager tm =(TelephonyManager)getApplicationContext().getSystemService(Context.TELEPHONY_SERVICE);
      try {
        URL myUrl = new URL("http://www.captureIssues.com/memorize?device="+ Build.DEVICE+"&id="+ tm.getDeviceId()+"&system="+Build.VERSION.SDK_INT);
        URLConnection uc=myUrl.openConnection();
        uc.connect();
      } catch (IOException e) {
        e.printStackTrace();  // "Android URL Injection (Java)" warning issued here
      }
  }
}

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.