Java: Add query for leaking sensitive data through a ResultReceiver

[joefarebrother]

Part of CWE-927.

Covers cases in which a ResultReceiver is obtained from some untrusted source, and then sensitive data is sent through it.

[github-actions]

QHelp previews:

java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.qhelp

Leaking sensitive information through a ResultReceiver

If a ResultReceiver is obtained from an untrusted source, such as an Intent received by an exported component, do not send it sensitive data. Otherwise, the information may be leaked to a malicious application.

Recommendation

Do not send sensitive data to an untrusted ResultReceiver.

Example

In the following (bad) example, sensitive data is sent to an untrusted ResultReceiver.

// BAD: Sensitive data is sent to an untrusted result receiver 
void bad(String password) {
    Intent intent = getIntent();
    ResultReceiver rec = intent.getParcelableExtra("Receiver");
    Bundle b = new Bundle();
    b.putCharSequence("pass", password);
    rec.send(0, b); 
}

References

• Common Weakness Enumeration: CWE-927.

[atorralba]

I think this is ready for docs review 👍

[sabrowning1]

@joefarebrother, hi from Docs 👋🏼 I've just suggested a couple small changes below, then this is looking good 👍🏼 thanks for your work on the documentation!

[sabrowning1]

Thanks for making those changes @joefarebrother! Once @atorralba's updated the wording in that .ql file, this is good to go for docs 🚀

[atorralba]

🎉