Java: Add metadata to several more experimental queries.

java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql

@@ -1,8 +1,11 @@
 /**
  * @name Insecure LDAPS Endpoint Configuration
- * @description Java application configured to disable LDAPS endpoint identification does not validate
- *              the SSL certificate to properly ensure that it is actually associated with that host.
+ * @description Java application configured to disable LDAPS endpoint
+ *              identification does not validate the SSL certificate to
+ *              properly ensure that it is actually associated with that host.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/insecure-ldaps-endpoint
  * @tags security
  *       external/cwe-297

java/ql/src/experimental/Security/CWE/CWE-522/InsecureBasicAuth.ql

@@ -1,7 +1,12 @@
 /**
  * @name Insecure basic authentication
- * @description Basic authentication only obfuscates username/password in Base64 encoding, which can be easily recognized and reversed. Transmission of sensitive information not over HTTPS is vulnerable to packet sniffing.
+ * @description Basic authentication only obfuscates username/password in
+ *              Base64 encoding, which can be easily recognized and reversed.
+ *              Transmission of sensitive information not over HTTPS is
+ *              vulnerable to packet sniffing.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/insecure-basic-auth
  * @tags security
  *       external/cwe-522

java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql

@@ -2,6 +2,8 @@
  * @name Insecure LDAP authentication
  * @description LDAP authentication with credentials sent in cleartext.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/insecure-ldap-auth
  * @tags security
  *       external/cwe-522

java/ql/src/experimental/Security/CWE/CWE-532/SensitiveInfoLog.ql

@@ -1,8 +1,11 @@
 /**
- * @id java/sensitiveinfo-in-logfile
  * @name Insertion of sensitive information into log files
- * @description Writing sensitive information to log files can give valuable guidance to an attacker or expose sensitive user information.
+ * @description Writing sensitive information to log files can give valuable
+ *              guidance to an attacker or expose sensitive user information.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/sensitiveinfo-in-logfile
  * @tags security
  *       external/cwe-532
  */

java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql

@@ -2,6 +2,8 @@
  * @name Sensitive GET Query
  * @description Use of GET request method with sensitive query strings.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/sensitive-query-with-get
  * @tags security
  *       external/cwe-598

java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.ql

@@ -1,7 +1,12 @@
 /**
  * @name Uncaught Servlet Exception
- * @description Uncaught exceptions in a servlet could leave a system in an unexpected state, possibly resulting in denial-of-service attacks or the exposure of sensitive information disclosed in stack traces.
+ * @description Uncaught exceptions in a servlet could leave a system in an
+ *              unexpected state, possibly resulting in denial-of-service
+ *              attacks or the exposure of sensitive information disclosed in
+ *              stack traces.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/uncaught-servlet-exception
  * @tags security
  *       external/cwe-600

java/ql/src/experimental/Security/CWE/CWE-749/UnsafeAndroidAccess.ql

@@ -1,8 +1,11 @@
 /**
  * @name Unsafe resource fetching in Android webview
- * @id java/android/unsafe-android-webview-fetch
- * @description JavaScript rendered inside WebViews can access any protected application file and web resource from any origin
+ * @description JavaScript rendered inside WebViews can access any protected
+ *              application file and web resource from any origin
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/android/unsafe-android-webview-fetch
  * @tags security
  *       external/cwe/cwe-749
  *       external/cwe/cwe-079

java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql

@@ -1,8 +1,13 @@
 /**
  * @name Local Android DoS Caused By NumberFormatException
- * @id java/android/nfe-local-android-dos
- * @description NumberFormatException thrown but not caught by an Android application that allows external inputs can crash the application, constituting a local Denial of Service (DoS) attack.
+ * @description NumberFormatException thrown but not caught by an Android
+ *              application that allows external inputs can crash the
+ *              application, constituting a local Denial of Service (DoS)
+ *              attack.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/android/nfe-local-android-dos
  * @tags security
  *       external/cwe/cwe-755
  */

java/ql/src/experimental/Security/CWE/CWE-927/SensitiveBroadcast.ql

@@ -1,8 +1,12 @@
 /**
  * @name Broadcasting sensitive data to all Android applications
- * @id java/sensitive-broadcast
- * @description An Android application uses implicit intents to broadcast sensitive data to all applications without specifying any receiver permission.
+ * @description An Android application uses implicit intents to broadcast
+ *              sensitive data to all applications without specifying any
+ *              receiver permission.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/sensitive-broadcast
  * @tags security
  *       external/cwe-927
  */