hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review (typos/formatting)

Browse Source 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
Co-authored-by: Chris Smowton <smowton@github.com>
This commit is contained in:
Artem Smotrakov
2022-02-10 18:37:12 +00:00
committed by GitHub
parent f53b2fcc62
commit 0ba229a64b
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/experimental/Security/CWE/CWE-297/IgnoredHostnameVerification.qhelp
View File

@@ -5,7 +5,7 @@
<p>
The method <code>HostnameVerifier.verify()</code> checks that the hostname from the server's certificate
matches the server hostname after an HTTPS connection is established.
The method returns true if the hostname is acceptable and false otherwise. The contract of the method
The method returns <code>true</code> if the hostname is acceptable and <code>false</code> otherwise. The contract of the method
does not require it to throw an exception if the verification failed.
Therefore, a caller has to check the result and drop the connection if the hostname verification failed.
Otherwise, an attacker may be able to implement a man-in-the-middle attack and impersonate the server.
@@ -28,7 +28,7 @@ As a result, no hostname verification actually happens.
<p>
In the next example, the result of the <code>HostnameVerifier.verify()</code> method is checked
and an exeption is thrown if the verification failed.
and an exception is thrown if the verification failed.
</p>
<sample src="CheckedHostnameVerification.java" />
</example>

2
java/ql/src/experimental/Security/CWE/CWE-297/IgnoredHostnameVerification.ql
View File

@@ -20,7 +20,7 @@ private class HostnameVerifierVerifyMethod extends Method {
}
}
/** Defines `HostnameVerifier.verity()` calls that is not wrapped in another `HostnameVerifier`. */
/** A `HostnameVerifier.verify()` call that is not wrapped in another `HostnameVerifier`. */
private class HostnameVerificationCall extends MethodAccess {
HostnameVerificationCall() {
this.getMethod() instanceof HostnameVerifierVerifyMethod and