hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Fix typos/formatting in setJavascriptEnabled query

Browse Source 
Typos and formatting changes.

Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
This commit is contained in:
Edward Minnix III
2022-11-14 10:02:20 -05:00
committed by GitHub
parent b4cd1ee34d
commit 7e5970f338
2 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
java/ql/src/Security/CWE/CWE-079/AndroidWebViewSettingsEnabledJavaScript.qhelp
View File

@@ -11,22 +11,22 @@ man-in-the-middle attack, where the attacker can inject arbitrary JavaScript.
<p>
You can enable or disbale Javascript execution using
the <code>setJavaScriptEnabled</code> method of the settings of a webview.
the <code>setJavaScriptEnabled</code> method of the settings of a WebView.
</p>
</overview>
<recommendation>
<p>If Javascript does not need to be enabled, call <code>setJavaScriptEnabled(false)</code> on the settings of the webview.</p>
<p>If Javascript does not need to be enabled, call <code>setJavaScriptEnabled(false)</code> on the settings of the WebView.</p>
<p>If JavaScript is necessary, only load content from trusted servers using encrypted channels, such as https with certificate verification.</p>
<p>If JavaScript is necessary, only load content from trusted servers using encrypted channels, such as HTTPS with certificate verification.</p>
</recommendation>
<example>
<p>In the following (bad) example, a webview has JavaScript enabled in its settings.</p>
<p>In the following (bad) example, a WebView has JavaScript enabled in its settings.</p>
<sample src="WebSettingsEnableJavascript.java"/>
<p>In the following (good) example, a webview explicitly disallows JavaScript execution.</p>
<p>In the following (good) example, a WebView explicitly disallows JavaScript execution.</p>
<sample src="WebSettingsDisableJavascript.java"/>

6
java/ql/src/Security/CWE/CWE-079/AndroidWebViewSettingsEnabledJavaScript.ql
View File

@@ -15,8 +15,6 @@ import semmle.code.java.frameworks.android.WebView
from MethodAccess ma
where
(
ma.getMethod() instanceof AllowJavaScriptMethod and
ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true
)
ma.getMethod() instanceof AllowJavaScriptMethod and
ma.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() = true
select ma, "JavaScript execution enabled in WebView."