hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Felicity Chapman <felicitymay@github.com>
This commit is contained in:
Jonathan Leitschuh
2021-02-15 10:01:03 -05:00
committed by GitHub
parent 35e2ceba13
commit 73fba3a3c0
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp
View File

@@ -4,8 +4,8 @@
<qhelp> <qhelp>
<overview> <overview>
<p><a href="https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/">Bintray and JCenter are shutting down on February 1st, 2022</a>. <p><a href="https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/">Bintray and JCenter are shutting down on February 1st, 2022</a>.
Relying upon repositories that are deprecated or slated to be shutdown can have unintended consequences; Relying upon repositories that are deprecated or scheduled to be shutdown can have unintended consequences;
for example, artifacts being resolved from different artifact server or total breakage of the CI build.</p> for example, artifacts being resolved from a different artifact server or a total failure of the CI build.</p>
<p>When artifact repositories are left unmaintained for a long period of time, vulnerabilities may emerge. <p>When artifact repositories are left unmaintained for a long period of time, vulnerabilities may emerge.
Theoretically, this could allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts Theoretically, this could allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts

2
java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql
View File

@@ -1,6 +1,6 @@
/** /**
* @name Depending upon JCenter/Bintray as an artifact repository * @name Depending upon JCenter/Bintray as an artifact repository
* @description JCenter & Bintray are deprecated * @description Using a deprecated artifact repository may eventually give attackers access for a supply chain attack.
* @kind problem * @kind problem
* @problem.severity error * @problem.severity error
* @precision very-high * @precision very-high