[CWE-925] Intent verification is only needed on non-empty onReceive methods.

[teuron]

The intent verification is currently triggering on empty onReceive methods like

@Override
public void onReceive(Context context, Intent intent) {}

which is not needed and leads to false positives.

[egregius313]

Hi @teuron,

Thank you for the contribution.

I think this change is better suited for the UnverifiedOnReceiveMethod class in java/ql/lib/semmle/code/java/security/ImproperIntentVerificationQuery.qll like so:

  UnverifiedOnReceiveMethod() {
-    not VerifiedIntentFlow::flow(DataFlow::parameterNode(this.getIntentParameter()), _)
+    not VerifiedIntentFlow::flow(DataFlow::parameterNode(this.getIntentParameter()), _) and
+    // Empty methods do not need to be verified since they do not perform any actions.
+    this.getBody().getNumStmt() > 0
  }

Adding it there will update any other location where unverifiedSystemReceiver is used, such as in the tests.

For testing this change, it would make sense to add an empty receiver to the test files (and AndroidManifest) in java/ql/test/query-tests/security/CWE-925.

Finally, this will need a minorAnalysis change note (guide here).