hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-18 19:31:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

updated overview section of help file; also added 'App Manifest Overview' to references

Browse Source
This commit is contained in:
Jami Cogswell
2022-08-02 15:48:38 -04:00
parent 3714a98403
commit 229324fde0
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
java/ql/src/Security/CWE/CWE-489/DebuggableAttributeEnabled.qhelp
View File

@@ -4,7 +4,14 @@
<qhelp>
<overview>
<p>When a debugger is enabled it could allow for entry points in the application or reveal sensitive information.</p>
<p>The Android manifest file defines configuration settings for Android applications.
In this file, the <code>android:debuggable</code> attribute of the <code>application</code> element can be used to
define whether or not the application can be debugged. When set to <code>true</code>, this attribute will allow the
application to be debugged even when running on a device in user mode.</p>
<p>When a debugger is enabled it could allow for entry points in the application or reveal sensitive information.
As a result, <code>android:debuggable</code> should only be enabled during development and should be disabled in
production builds.</p>
</overview>
<recommendation>
@@ -26,6 +33,10 @@ or do not include it in the manifest. The default value when not included is <co
</example>
<references>
<li>
Android Developers:
<a href="https://developer.android.com/guide/topics/manifest/manifest-intro">App Manifest Overview</a>.
</li>
<li>
Android Developers:
<a href="https://developer.android.com/guide/topics/manifest/application-element#debug">The android:debuggable attribute</a>.