Android ContentProvider Incomplete Permissions

[egregius313]

Add a query for checking for an exported <provider> element in AndroidManifest.xml which has improperly configured permissions.

Cf. GHSL Research, CVE-2021-41166

[atorralba]

The CodeQL code itself looks good 👍, just some minor comments. This will need a docs review.

[github-actions]

QHelp previews:

java/ql/src/Security/CWE/CWE-926/ContentProviderIncompletePermissions.qhelp

Missing read or write permission in a content provider

The Android manifest file specifies the content providers for the application using provider elements. The provider element specifies the explicit permissions an application requires in order to access a resource using that provider. You specify the permissions using the android:readPermission, android:writePermission, or android:permission attributes. If you do not specify the permission required to perform an operation, the application will implicitly have access to perform that operation. For example, if you specify only android:readPermission, the application must have explicit permission to read data, but requires no permission to write data.

Recommendation

To prevent permission bypass, you should create provider elements that either specify both the android:readPermission and android:writePermission attributes, or specify the android:permission attribute.

Example

In the following two (bad) examples, the provider is configured with only read or write permissions. This allows a malicious application to bypass the permission check by requesting access to the unrestricted operation.

<manifest ... >
    <application ...>
      <!-- BAD: only 'android:readPermission' is set -->
      <provider
          android:name=".MyContentProvider"
          android:authorities="table"
          android:enabled="true"
          android:exported="true"
          android:readPermission="android.permission.MANAGE_DOCUMENTS">
      </provider>
    </application>
</manifest>

<manifest ... >
    <application ...>
      <!-- BAD: only 'android:writePermission' is set -->
      <provider
          android:name=".MyContentProvider"
          android:authorities="table"
          android:enabled="true"
          android:exported="true"
          android:writePermission="android.permission.MANAGE_DOCUMENTS">
      </provider>
    </application>
</manifest>

In the following (good) examples, the provider is configured with full permissions, protecting it from a permissions bypass.

<manifest ... >
    <application ...>
      <!-- Good: both 'android:readPermission' and 'android:writePermission' are set -->
      <provider
          android:name=".MyContentProvider"
          android:authorities="table"
          android:enabled="true"
          android:exported="true"
          android:writePermission="android.permission.MANAGE_DOCUMENTS"
          android:readPermission="android.permission.MANAGE_DOCUMENTS">
      </provider>
    </application>
</manifest>

<manifest ... >
    <application ...>
      <!-- Good: 'android:permission' is set  -->
      <provider
          android:name=".MyContentProvider"
          android:authorities="table"
          android:enabled="true"
          android:exported="true"
          android:permission="android.permission.MANAGE_DOCUMENTS">
      </provider>
    </application>
</manifest>

References

• Android Documentation: Provider element
• CVE-2021-41166: Insufficient permission control in Nextcloud Android app
• GitHub Security Lab Research: Insufficient permission control in Nextcloud Android app
• Common Weakness Enumeration: CWE-926.

[atorralba]

Once the remaining comments are addressed, we can request a docs review @egregius313.

[felicitymay]

Thanks for your patience in waiting on a review from the docs team. Great to have such clear references.

I've added some text suggestions based on my understanding from reading the help file. Very happy to discuss if I've misunderstood the intended meaning.

[felicitymay]

Thanks for the update @egregius313