diff --git a/java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.qhelp b/java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.qhelp index 6403d24b9b6..d09a7cf923c 100644 --- a/java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.qhelp +++ b/java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.qhelp @@ -2,8 +2,8 @@ -

If a ResultReceiver is obtained from an untrusted source, such as being unparcelled from an Intent that was received by an exported component, - sensitive data such as passwords should not be sent to it. Otherwise, this sensitive information may be leaked to a malicious application.

+

If a ResultReceiver is obtained from an untrusted source, such as an Intent received by an exported component, + do not send it sensitive data. Otherwise, the information may be leaked to a malicious application.

diff --git a/java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.ql b/java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.ql index 552f4a4d248..6be28e71cb8 100644 --- a/java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.ql +++ b/java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.ql @@ -1,7 +1,7 @@ /** * @name Leaking sensitive information through a ResultReceiver - * @description An Android application obtains a ResultReceiver from a - * third-party component and uses it to send sensitive data + * @description Sending sensitive data to a 'ResultReceiver' from an untrusted source + * can allow malicious actors access to your information. * @kind path-problem * @problem.severity error * @security-severity 8.2