Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d53c334

Browse files
aschackmullaschackmull
committed
Merge branch 'java/fix-experimental-query-metadata' into java/cleanup
2 parents 5b905cf + 28ff3f4 commit d53c334

11 files changed

Lines changed: 48 additions & 9 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
/**
22
* @name openStream called on URLs created from remote source
33
* @description Calling openStream on URLs created from remote source
4-
* can lead to local file disclosure.
4+
* can lead to local file disclosure.
55
* @kind path-problem
6+
* @problem.severity warning
7+
* @precision medium
8+
* @id java/openstream-called-on-tainted-url
9+
* @tags security
10+
* external/cwe/cwe-036
611
*/
712

813
import java

‎java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.ql‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
/**
22
* @name Unsafe certificate trust
3-
* @description Unsafe implementation of the interface X509TrustManager and SSLSocket/SSLEngine ignores all SSL certificate validation errors when establishing an HTTPS connection, thereby making the app vulnerable to man-in-the-middle attacks.
3+
* @description Unsafe implementation of the interface X509TrustManager and
4+
* SSLSocket/SSLEngine ignores all SSL certificate validation
5+
* errors when establishing an HTTPS connection, thereby making
6+
* the app vulnerable to man-in-the-middle attacks.
47
* @kind problem
8+
* @problem.severity warning
9+
* @precision medium
510
* @id java/unsafe-cert-trust
611
* @tags security
712
* external/cwe-273

‎java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
/**
22
* @name JxBrowser with disabled certificate validation
3-
* @description Insecure configuration of JxBrowser disables certificate validation making the app vulnerable to man-in-the-middle attacks.
3+
* @description Insecure configuration of JxBrowser disables certificate
4+
* validation making the app vulnerable to man-in-the-middle
5+
* attacks.
46
* @kind problem
7+
* @problem.severity warning
8+
* @precision medium
59
* @id java/jxbrowser/disabled-certificate-validation
610
* @tags security
711
* external/cwe/cwe-295

‎java/ql/src/experimental/Security/CWE/CWE-297/InsecureJavaMail.ql‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
/**
2-
* @id java/insecure-smtp-ssl
32
* @name Insecure JavaMail SSL Configuration
4-
* @description Java application configured to use authenticated mail session over SSL does not validate the SSL certificate to properly ensure that it is actually associated with that host.
3+
* @description Java application configured to use authenticated mail session
4+
* over SSL does not validate the SSL certificate to properly
5+
* ensure that it is actually associated with that host.
56
* @kind problem
7+
* @problem.severity warning
8+
* @precision medium
9+
* @id java/insecure-smtp-ssl
610
* @tags security
711
* external/cwe-297
812
*/

‎java/ql/src/experimental/Security/CWE/CWE-312/CleartextStorageSharedPrefs.ql‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
/**
22
* @name Cleartext storage of sensitive information using `SharedPreferences` on Android
3-
* @description Cleartext Storage of Sensitive Information using SharedPreferences on Android allows access for users with root privileges or unexpected exposure from chained vulnerabilities.
3+
* @description Cleartext Storage of Sensitive Information using
4+
* SharedPreferences on Android allows access for users with root
5+
* privileges or unexpected exposure from chained vulnerabilities.
46
* @kind problem
7+
* @problem.severity warning
8+
* @precision medium
59
* @id java/android/cleartext-storage-shared-prefs
610
* @tags security
711
* external/cwe/cwe-312

‎java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
* @name Weak encryption: Insufficient key size
33
* @description Finds uses of encryption algorithms with too small a key size
44
* @kind problem
5+
* @problem.severity warning
6+
* @precision medium
57
* @id java/insufficient-key-size
68
* @tags security
79
* external/cwe/cwe-326

‎java/ql/src/experimental/Security/CWE/CWE-489/EJBMain.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
* @name Main Method in Enterprise Java Bean
33
* @description Java EE applications with a main method.
44
* @kind problem
5+
* @problem.severity warning
6+
* @precision medium
57
* @id java/main-method-in-enterprise-bean
68
* @tags security
79
* external/cwe-489

‎java/ql/src/experimental/Security/CWE/CWE-489/WebComponentMain.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
* @name Main Method in Java EE Web Components
33
* @description Java EE web applications with a main method.
44
* @kind problem
5+
* @problem.severity warning
6+
* @precision medium
57
* @id java/main-method-in-web-components
68
* @tags security
79
* external/cwe-489

‎java/ql/src/experimental/Security/CWE/CWE-548/InsecureDirectoryConfig.ql‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
/**
22
* @name Directories and files exposure
3-
* @description A directory listing provides an attacker with the complete index of all the resources located inside of the complete web directory, which could yield files containing sensitive information like source code and credentials to the attacker.
3+
* @description A directory listing provides an attacker with the complete
4+
* index of all the resources located inside of the complete web
5+
* directory, which could yield files containing sensitive
6+
* information like source code and credentials to the attacker.
47
* @kind problem
8+
* @problem.severity warning
9+
* @precision medium
510
* @id java/server-directory-listing
611
* @tags security
712
* external/cwe-548

‎java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
* @name Password in configuration file
33
* @description Finds passwords in configuration files.
44
* @kind problem
5+
* @problem.severity warning
6+
* @precision medium
57
* @id java/password-in-configuration
68
* @tags security
79
* external/cwe/cwe-555

0 commit comments

Comments
 (0)