hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 03:36:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Felicity Chapman <felicitymay@github.com>
This commit is contained in:
Jonathan Leitschuh
2021-02-15 10:01:03 -05:00
committed by GitHub
parent 35e2ceba13
commit 73fba3a3c0
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp
View File

@@ -4,8 +4,8 @@
<qhelp>
<overview>
<p><a href="https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/">Bintray and JCenter are shutting down on February 1st, 2022</a>.
Relying upon repositories that are deprecated or slated to be shutdown can have unintended consequences;
for example, artifacts being resolved from different artifact server or total breakage of the CI build.</p>
Relying upon repositories that are deprecated or scheduled to be shutdown can have unintended consequences;
for example, artifacts being resolved from a different artifact server or a total failure of the CI build.</p>
<p>When artifact repositories are left unmaintained for a long period of time, vulnerabilities may emerge.
Theoretically, this could allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts

2
java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql
View File

@@ -1,6 +1,6 @@
/**
* @name Depending upon JCenter/Bintray as an artifact repository
* @description JCenter & Bintray are deprecated
* @description Using a deprecated artifact repository may eventually give attackers access for a supply chain attack.
* @kind problem
* @problem.severity error
* @precision very-high