Merge pull request #17274 from asgerf/java/implicit-pending-intents-implicit-read

Java: Reveal false negative in test

Author: asgerf

java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.expected

@@ -1,2 +1,2 @@
-failures
 testFailures
+failures

java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.java

@@ -32,8 +32,8 @@ public static void testPendingIntentAsAnExtra(Context ctx)
             PendingIntent pi = PendingIntent.getActivity(ctx, 0, baseIntent, 0);
             Intent fwdIntent = new Intent();
             fwdIntent.putExtra("fwdIntent", pi);
+            ctx.startActivities(new Intent[] {fwdIntent}); // $ MISSING: hasImplicitPendingIntent
             ctx.startActivity(fwdIntent); // $hasImplicitPendingIntent
-            ctx.startActivities(new Intent[] {fwdIntent}); // $hasImplicitPendingIntent
             ctx.startService(fwdIntent); // Safe
             ctx.sendBroadcast(fwdIntent); // $hasImplicitPendingIntent