hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
This commit is contained in:
Jonathan Leitschuh
2021-02-10 10:51:37 -05:00
committed by GitHub
parent f00b0baaea
commit 49985a77e3
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp
View File

@@ -10,21 +10,21 @@ for example, artifacts being resolved from different artifact server or total br
<p>When artifact repositories are left unmaintained for a long period of time, vulnerabilities may emerge.
Theoretically, this could allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts
that are being produced. This can be used by attackers to perform a
<a href="https://en.wikipedia.org/wiki/Supply_chain_attack">Supply chain attack</a>
<a href="https://en.wikipedia.org/wiki/Supply_chain_attack">supply chain attack</a>
against your project's users.
</p>
</overview>
<recommendation>
<p>Always use the cononical repository for resolving your dependencies.</p>
<p>Always use the canonical repository for resolving your dependencies.</p>
</recommendation>
<example>
<p>This examples show examples of locations in Maven POM files where artifact repository upload/download is configured.
The use of Bintray in any of these locaitons is not advised.
<p>The following example shows locations in a Maven POM file where artifact repository upload/download is configured.
The use of Bintray in any of these locations is not advised.
</p>
<sample src="bad-bintray-pom.xml" />
@@ -32,7 +32,7 @@ The use of Bintray in any of these locaitons is not advised.
</example>
<references>
<li>
Blog:
JFrog blog:
<a href="https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/">
Into the Sunset on May 1st: Bintray, JCenter, GoCenter, and ChartCenter
</a>