Java: Improper url validation

[luchua-bc]

This PR is to address CWE-939 "Improper Authorization in Handler for Custom URL Scheme", which is a very common issue in Android mobile development.

For more details, please view the help document.

[aschackmull]

A few inline comments. Also, could you please auto-format the ql file? Otherwise it won't pass PR checks.

[luchua-bc]

Hi @aschackmull ,

Just curious - why the check of Language-Tests/Java failed? Could you shed some light on this issue?

Thanks,
@luchua-bc

[aschackmull]

Just curious - why the check of Language-Tests/Java failed? Could you shed some light on this issue?

The select doesn't follow the correct pattern. The basic pattern is <entity>, <message> where the entity is used for the alert location. If the message includes placeholders then it should be followed by a corresponding number of <entity>, <string> pairs.

[luchua-bc]

Thanks @aschackmull . Details of the Language-Tests/Java error are on the internal Jenkins server and the CodeQL extension with VS Code didn't report it. However, the LGTM query console does report this error.

I've corrected the select statement and will keep on using the query console to validate queries.

Cheers,
@luchua-bc