hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add the domain used to the alert message

Browse Source
This commit is contained in:
Joe Farebrother
2022-11-30 11:37:08 +00:00
parent ceb253e6d1
commit 603c1c1693
2 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/src/Security/CWE/CWE-295/AndroidMissingCertificatePinning.ql
View File

@@ -13,10 +13,10 @@
import java
import semmle.code.java.security.AndroidCertificatePinningQuery
from DataFlow::Node node, string msg
from DataFlow::Node node, string domain, string msg
where
missingPinning(node) and
if exists(string x | trustedDomain(x))
then msg = "(untrusted domain)"
else msg = "(no trusted domains)"
missingPinning(node, domain) and
if domain = ""
then msg = "(no explicitly trusted domains)"
else msg = "(" + domain + " is not trusted by a pin)"
select node, "This network call does not implement certificate pinning. " + msg