hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Fix qhelp errors.

Browse Source
This commit is contained in:
intrigus
2021-04-28 22:11:43 +02:00
parent dc0b06a735
commit 6bfdf8d148
1 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.qhelp
View File

@@ -13,14 +13,13 @@ An attack might look like this:
</p>
<ol>
<li>The vulnerable program connects to <code>https://example.com</code>.
<li>The attacker intercepts this connection and presents a valid, self-signed certificate for <code>https://example.com</code>.
<li>The vulnerable program calls the <code>checkServerTrusted</code> method to check whether it should trust the certificate.
<li>The <code>checkServerTrusted</code> method of your <code>TrustManager</code> does not throw a <code>CertificateException</code>.
<li>The vulnerable program accepts the certificate and proceeds with the connection since your <code>TrustManager</code> implicitly trusted it by not throwing an exception.
<li>The attacker can now read the data your program sends to <code>https://example.com</code> and/or alter its replies while the program thinks the connection is secure.
<li>The vulnerable program connects to <code>https://example.com</code>.</li>
<li>The attacker intercepts this connection and presents a valid, self-signed certificate for <code>https://example.com</code>.</li>
<li>The vulnerable program calls the <code>checkServerTrusted</code> method to check whether it should trust the certificate.</li>
<li>The <code>checkServerTrusted</code> method of your <code>TrustManager</code> does not throw a <code>CertificateException</code>.</li>
<li>The vulnerable program accepts the certificate and proceeds with the connection since your <code>TrustManager</code> implicitly trusted it by not throwing an exception.</li>
<li>The attacker can now read the data your program sends to <code>https://example.com</code> and/or alter its replies while the program thinks the connection is secure.</li>
</ol>
</p>
</overview>
<recommendation>