Skip to content

Commit f34079b

Browse files
shivasuryashivasurya
authored
Merge pull request #219 from shivasurya/shiva/playground-iframe
feat/atlas: add payground integration for android ruleset
2 parents 7bce97b + 18deff1 commit f34079b

File tree

2 files changed

+121
-47
lines changed

2 files changed

+121
-47
lines changed

‎docs/src/components/CodeViewer.astro

+36-5
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,39 @@ const { filePath } = Astro.props;
77
88
// Hardcoded rule content mapping
99
export const ruleContent = new Map([
10+
// Android Rules
11+
[
12+
'/pathfinder-rules/android/WebViewJavaScriptEnabled.cql',
13+
`FROM method_invocation AS mi
14+
WHERE mi.getName() == "setJavaScriptEnabled" && "true" in mi.getArgumentName()
15+
SELECT mi.getName(), "JavaScript enabled"`
16+
],
17+
[
18+
'/pathfinder-rules/android/WebViewaddJavascriptInterface.cql',
19+
`FROM method_invocation AS mi
20+
WHERE mi.getName() == "addJavascriptInterface"
21+
SELECT mi.getName(), "JavaScript interface exposed"`
22+
],
23+
[
24+
'/pathfinder-rules/android/WebViewsetAllowContentAccess.cql',
25+
`FROM method_invocation AS mi
26+
WHERE mi.getName() == "setAllowContentAccess" && "true" in mi.getArgumentName()
27+
SELECT mi.getName(), "Content access enabled"`
28+
],
29+
[
30+
'/pathfinder-rules/android/WebViewsetAllowFileAccess.cql',
31+
`FROM method_invocation AS mi
32+
WHERE mi.getName() == "setAllowFileAccess" && "true" in mi.getArgumentName()
33+
SELECT mi.getName(), "File access enabled"`
34+
],
35+
[
36+
'/pathfinder-rules/android/WebViewsetAllowFileAccessFromFileURLs.cql',
37+
`FROM method_invocation AS mi
38+
WHERE mi.getName() == "setAllowFileAccessFromFileURLs" && "true" in mi.getArgumentName()
39+
SELECT mi.getName(), "File access enabled"`
40+
],
41+
42+
// Java Rules
1043
[
1144
'/pathfinder-rules/java/InsecureRandom.cql',
1245
`FROM method_invocation AS mi
@@ -18,15 +51,13 @@ SELECT mi.getName(), "Math.random() is not cryptographically secure. Use SecureR
1851
`FROM method_invocation AS mi
1952
WHERE mi.getName() == "Cipher.getInstance"
2053
&& "Blowfish" in mi.getArgumentName()
21-
SELECT mi.getName(), "Use of Blowfish was detected. Blowfish uses a 64-bit block size
22-
that makes it vulnerable to birthday attacks, and is therefore considered
23-
non-compliant."`
54+
SELECT mi.getName(), "Use of Blowfish was detected. Blowfish uses a 64-bit block size makes it vulnerable to birthday attacks."`
2455
],
2556
[
2657
'/pathfinder-rules/java/DefaultHttpClient.cql',
2758
`FROM ClassInstanceExpr AS cie
28-
WHERE cie.getClassInstanceExpr().GetClassName() == "DefaultHttpClient"
29-
SELECT cie.getName(), "The DefaultHttpClient is deprecated. Use HttpClientBuilder instead."`
59+
WHERE cie.getClassInstanceExpr().GetClassName() == "DefaultHttpClient"
60+
SELECT cie.getName(), "The DefaultHttpClient is deprecated. Use HttpClientBuilder instead."`
3061
],
3162
[
3263
'/pathfinder-rules/java/RC4Usage.cql',

‎docs/src/content/docs/atlas/android/index.mdx

+85-42
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,11 @@ template: splash
44
description: Explore our comprehensive collection of Android-specific rules designed to help you write better, more secure Android applications.
55
---
66

7-
import { Card, CardGrid, Icon } from '@astrojs/starlight/components';
7+
import { Card, CardGrid, Icon, Tabs, TabItem } from '@astrojs/starlight/components';
88
import PostHogLayout from '../../../../layouts/PostHogLayout.astro';
99
import CollapsibleCode from '../../../../components/CollapsibleCode.astro';
1010
import RuleSearch from '../../../../components/RuleSearch.astro';
11+
import { ruleContent } from '../../../../components/CodeViewer.astro';
1112

1213
<PostHogLayout/>
1314

@@ -23,126 +24,168 @@ codepathfinder ci --project /src/project --ruleset cpf/android
2324

2425
#### Rules (5)
2526

26-
<RuleSearch placeholder="Search security rules..." owaspType="mobile" />
27+
Browse our collection of Android security rules. Each rule includes example code and the actual rule implementation.
28+
29+
<RuleSearch placeholder="Search security rules and patterns..." />
2730

2831
<div class="rule-cards-grid">
2932
<div class="rule-card" data-severity="medium" data-type="security" data-owasp="client-code-quality">
3033
<Card title="WebView JavaScript Enabled" icon="warning">
3134
<div class="description">
32-
**Rule ID**: java/android/webview-javascript-enabled
33-
**Severity: Medium** | **CWE: 079**
35+
**Severity: Medium** | **OWASP: Client Code Quality**
3436
Enabling JavaScript execution in a WebView can result in cross-site scripting attacks.
3537
</div>
3638
<div class="code-section">
3739
<CollapsibleCode
38-
code={`// ❌ Vulnerable: JavaScript enabled without safeguards
40+
tabs={[
41+
{
42+
label: "Example",
43+
code: `// ❌ Vulnerable: JavaScript enabled without safeguards
3944
WebView webView = new WebView(context);
4045
webView.getSettings().setJavaScriptEnabled(true);
4146
4247
// ✅ Safe: JavaScript disabled by default
4348
WebView webView = new WebView(context);
4449
// JavaScript remains disabled
45-
webView.loadUrl("https://trusted-domain.com");`}
46-
lang="java"
47-
title="WebView JavaScript Example"
48-
marks={['Vulnerable', 'Safe']}
49-
/>
50+
webView.loadUrl("https://trusted-domain.com");`,
51+
lang: "text/x-java",
52+
marks: ['Vulnerable', 'Safe']
53+
},
54+
{
55+
label: "Rule",
56+
code: ruleContent.get('/pathfinder-rules/android/WebViewJavaScriptEnabled.cql'),
57+
lang: "text/x-sql"
58+
}
59+
]}
60+
/>
5061
</div>
5162
</Card>
5263
</div>
5364

5465
<div class="rule-card" data-severity="medium" data-type="security" data-owasp="client-code-quality">
5566
<Card title="WebView JavaScript Interface" icon="warning">
5667
<div class="description">
57-
**Rule ID**: java/android/webview-javascript-interface <br/>
58-
**Severity: Medium** | **CWE: 079**
68+
**Severity: Medium** | **OWASP: Client Code Quality**
5969
Enabling addJavascriptInterface exposes java methods to JavaScript.
6070
</div>
6171
<div class="code-section">
6272
<CollapsibleCode
63-
code={`// ❌ Vulnerable: Exposing Java interface to JavaScript
73+
tabs={[
74+
{
75+
label: "Example",
76+
code: `// ❌ Vulnerable: Exposing Java interface to JavaScript
6477
webView.addJavascriptInterface(new JavaScriptInterface(), "Android");
6578
6679
// ✅ Safe: Using modern API methods
6780
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
6881
webView.evaluateJavascript("javascript:processData()", null);
69-
}`}
70-
lang="java"
71-
title="JavaScript Interface Example"
72-
marks={['Vulnerable', 'Safe']}
73-
/>
82+
}`,
83+
lang: "text/x-java",
84+
marks: ['Vulnerable', 'Safe']
85+
},
86+
{
87+
label: "Rule",
88+
code: ruleContent.get('/pathfinder-rules/android/WebViewaddJavascriptInterface.cql'),
89+
lang: "text/x-sql"
90+
}
91+
]}
92+
/>
7493
</div>
7594
</Card>
7695
</div>
7796

7897
<div class="rule-card" data-severity="medium" data-type="security" data-owasp="improper-platform-usage">
7998
<Card title="WebView Content Access" icon="warning">
8099
<div class="description">
81-
**Rule ID**: java/android/webview-set-allow-content-access <br/>
82-
**Severity: Medium** | **CWE: 079**
100+
**Severity: Medium** | **OWASP: Improper Platform Usage**
83101
Enabling setAllowContentAccess enables content:// access from webpages.
84102
</div>
85103
<div class="code-section">
86104
<CollapsibleCode
87-
code={`// ❌ Vulnerable: Enabling content access
105+
tabs={[
106+
{
107+
label: "Example",
108+
code: `// ❌ Vulnerable: Enabling content access
88109
webView.getSettings().setAllowContentAccess(true);
89110
90111
// ✅ Safe: Content access disabled
91112
WebView webView = new WebView(context);
92113
webView.getSettings().setAllowContentAccess(false);
93-
// Only load trusted content`}
94-
lang="java"
95-
title="Content Access Example"
96-
marks={['Vulnerable', 'Safe']}
97-
/>
114+
// Only load trusted content`,
115+
lang: "text/x-java",
116+
marks: ['Vulnerable', 'Safe']
117+
},
118+
{
119+
label: "Rule",
120+
code: ruleContent.get('/pathfinder-rules/android/WebViewsetAllowContentAccess.cql'),
121+
lang: "text/x-sql"
122+
}
123+
]}
124+
/>
98125
</div>
99126
</Card>
100127
</div>
101128

102129
<div class="rule-card" data-severity="medium" data-type="security" data-owasp="improper-platform-usage">
103130
<Card title="WebView File Access" icon="warning">
104131
<div class="description">
105-
**Rule ID**: java/android/webview-set-allow-file-access <br/>
106-
**Severity: Medium** | **CWE: 079**
132+
**Severity: Medium** | **OWASP: Improper Platform Usage**
107133
Enabling setAllowFileAccess enables webview access to file:/// URLs.
108134
</div>
109135
<div class="code-section">
110136
<CollapsibleCode
111-
code={`// ❌ Vulnerable: Enabling file access
137+
tabs={[
138+
{
139+
label: "Example",
140+
code: `// ❌ Vulnerable: Enabling file access
112141
webView.getSettings().setAllowFileAccess(true);
113142
114143
// ✅ Safe: File access disabled
115144
WebView webView = new WebView(context);
116145
webView.getSettings().setAllowFileAccess(false);
117-
// Use content providers for controlled file access`}
118-
lang="java"
119-
title="File Access Example"
120-
marks={['Vulnerable', 'Safe']}
121-
/>
146+
// Use content providers for controlled file access`,
147+
lang: "text/x-java",
148+
marks: ['Vulnerable', 'Safe']
149+
},
150+
{
151+
label: "Rule",
152+
code: ruleContent.get('/pathfinder-rules/android/WebViewsetAllowFileAccess.cql'),
153+
lang: "text/x-sql"
154+
}
155+
]}
156+
/>
122157
</div>
123158
</Card>
124159
</div>
125160

126161
<div class="rule-card" data-severity="medium" data-type="security" data-owasp="improper-platform-usage">
127162
<Card title="WebView File URL Access" icon="warning">
128163
<div class="description">
129-
**Rule ID**: java/android/webview-set-allow-file-access-from-file-urls <br/>
130-
**Severity: Medium** | **CWE: 079**
164+
**Severity: Medium** | **OWASP: Improper Platform Usage**
131165
Enabling setAllowFileAccessFromFileURLs leaks sandbox access to file:/// URLs.
132166
</div>
133167
<div class="code-section">
134168
<CollapsibleCode
135-
code={`// ❌ Vulnerable: Enabling file URL access
169+
tabs={[
170+
{
171+
label: "Example",
172+
code: `// ❌ Vulnerable: Enabling file URL access
136173
webView.getSettings().setAllowFileAccessFromFileURLs(true);
137174
138175
// ✅ Safe: File URL access disabled
139176
WebView webView = new WebView(context);
140177
webView.getSettings().setAllowFileAccessFromFileURLs(false);
141-
// Implement proper file access controls`}
142-
lang="java"
143-
title="File URL Access Example"
144-
marks={['Vulnerable', 'Safe']}
145-
/>
178+
// Implement proper file access controls`,
179+
lang: "text/x-java",
180+
marks: ['Vulnerable', 'Safe']
181+
},
182+
{
183+
label: "Rule",
184+
code: ruleContent.get('/pathfinder-rules/android/WebViewsetAllowFileAccessFromFileURLs.cql'),
185+
lang: "text/x-sql"
186+
}
187+
]}
188+
/>
146189
</div>
147190
</Card>
148191
</div>

0 commit comments

Comments
 (0)