Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 75afa01

Browse files
aschackmullaschackmull
committed
Java: Add metadata to several more experimental queries.
1 parent d53c334 commit 75afa01

9 files changed

Lines changed: 44 additions & 12 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
/**
22
* @name Insecure LDAPS Endpoint Configuration
3-
* @description Java application configured to disable LDAPS endpoint identification does not validate
4-
* the SSL certificate to properly ensure that it is actually associated with that host.
3+
* @description Java application configured to disable LDAPS endpoint
4+
* identification does not validate the SSL certificate to
5+
* properly ensure that it is actually associated with that host.
56
* @kind problem
7+
* @problem.severity warning
8+
* @precision medium
69
* @id java/insecure-ldaps-endpoint
710
* @tags security
811
* external/cwe-297

‎java/ql/src/experimental/Security/CWE/CWE-522/InsecureBasicAuth.ql‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
/**
22
* @name Insecure basic authentication
3-
* @description Basic authentication only obfuscates username/password in Base64 encoding, which can be easily recognized and reversed. Transmission of sensitive information not over HTTPS is vulnerable to packet sniffing.
3+
* @description Basic authentication only obfuscates username/password in
4+
* Base64 encoding, which can be easily recognized and reversed.
5+
* Transmission of sensitive information not over HTTPS is
6+
* vulnerable to packet sniffing.
47
* @kind path-problem
8+
* @problem.severity warning
9+
* @precision medium
510
* @id java/insecure-basic-auth
611
* @tags security
712
* external/cwe-522

‎java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
* @name Insecure LDAP authentication
33
* @description LDAP authentication with credentials sent in cleartext.
44
* @kind path-problem
5+
* @problem.severity warning
6+
* @precision medium
57
* @id java/insecure-ldap-auth
68
* @tags security
79
* external/cwe-522

‎java/ql/src/experimental/Security/CWE/CWE-532/SensitiveInfoLog.ql‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
/**
2-
* @id java/sensitiveinfo-in-logfile
32
* @name Insertion of sensitive information into log files
4-
* @description Writing sensitive information to log files can give valuable guidance to an attacker or expose sensitive user information.
3+
* @description Writing sensitive information to log files can give valuable
4+
* guidance to an attacker or expose sensitive user information.
55
* @kind path-problem
6+
* @problem.severity warning
7+
* @precision medium
8+
* @id java/sensitiveinfo-in-logfile
69
* @tags security
710
* external/cwe-532
811
*/

‎java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
* @name Sensitive GET Query
33
* @description Use of GET request method with sensitive query strings.
44
* @kind path-problem
5+
* @problem.severity warning
6+
* @precision medium
57
* @id java/sensitive-query-with-get
68
* @tags security
79
* external/cwe-598

‎java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.ql‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
/**
22
* @name Uncaught Servlet Exception
3-
* @description Uncaught exceptions in a servlet could leave a system in an unexpected state, possibly resulting in denial-of-service attacks or the exposure of sensitive information disclosed in stack traces.
3+
* @description Uncaught exceptions in a servlet could leave a system in an
4+
* unexpected state, possibly resulting in denial-of-service
5+
* attacks or the exposure of sensitive information disclosed in
6+
* stack traces.
47
* @kind path-problem
8+
* @problem.severity warning
9+
* @precision medium
510
* @id java/uncaught-servlet-exception
611
* @tags security
712
* external/cwe-600

‎java/ql/src/experimental/Security/CWE/CWE-749/UnsafeAndroidAccess.ql‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
/**
22
* @name Unsafe resource fetching in Android webview
3-
* @id java/android/unsafe-android-webview-fetch
4-
* @description JavaScript rendered inside WebViews can access any protected application file and web resource from any origin
3+
* @description JavaScript rendered inside WebViews can access any protected
4+
* application file and web resource from any origin
55
* @kind path-problem
6+
* @problem.severity warning
7+
* @precision medium
8+
* @id java/android/unsafe-android-webview-fetch
69
* @tags security
710
* external/cwe/cwe-749
811
* external/cwe/cwe-079

‎java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
/**
22
* @name Local Android DoS Caused By NumberFormatException
3-
* @id java/android/nfe-local-android-dos
4-
* @description NumberFormatException thrown but not caught by an Android application that allows external inputs can crash the application, constituting a local Denial of Service (DoS) attack.
3+
* @description NumberFormatException thrown but not caught by an Android
4+
* application that allows external inputs can crash the
5+
* application, constituting a local Denial of Service (DoS)
6+
* attack.
57
* @kind path-problem
8+
* @problem.severity warning
9+
* @precision medium
10+
* @id java/android/nfe-local-android-dos
611
* @tags security
712
* external/cwe/cwe-755
813
*/

‎java/ql/src/experimental/Security/CWE/CWE-927/SensitiveBroadcast.ql‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
/**
22
* @name Broadcasting sensitive data to all Android applications
3-
* @id java/sensitive-broadcast
4-
* @description An Android application uses implicit intents to broadcast sensitive data to all applications without specifying any receiver permission.
3+
* @description An Android application uses implicit intents to broadcast
4+
* sensitive data to all applications without specifying any
5+
* receiver permission.
56
* @kind path-problem
7+
* @problem.severity warning
8+
* @precision medium
9+
* @id java/sensitive-broadcast
610
* @tags security
711
* external/cwe-927
812
*/

0 commit comments

Comments
 (0)