hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from docs review

Browse Source 
Co-authored-by: Sam Browning <106113886+sabrowning1@users.noreply.github.com>
This commit is contained in:
Joe Farebrother
2023-02-01 12:54:19 +00:00
committed by GitHub
parent cca6a13fbb
commit 74dba953ca
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.qhelp
View File

@@ -2,8 +2,8 @@
<qhelp> <qhelp>
<overview> <overview>
<p>If a <code>ResultReceiver</code> is obtained from an untrusted source, such as being unparcelled from an <code>Intent</code> that was received by an exported component, <p>If a <code>ResultReceiver</code> is obtained from an untrusted source, such as an <code>Intent</code> received by an exported component,
sensitive data such as passwords should not be sent to it. Otherwise, this sensitive information may be leaked to a malicious application.</p> do not send it sensitive data. Otherwise, the information may be leaked to a malicious application.</p>
</overview> </overview>
<recommendation> <recommendation>

4
java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.ql
View File

@@ -1,7 +1,7 @@
/** /**
* @name Leaking sensitive information through a ResultReceiver * @name Leaking sensitive information through a ResultReceiver
* @description An Android application obtains a ResultReceiver from a * @description Sending sensitive data to a 'ResultReceiver' from an untrusted source
* third-party component and uses it to send sensitive data * can allow malicious actors access to your information.
* @kind path-problem * @kind path-problem
* @problem.severity error * @problem.severity error
* @security-severity 8.2 * @security-severity 8.2