hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add a bit of additional context to the alert message; fix issue with finding the config file

Browse Source
This commit is contained in:
Joe Farebrother
2022-11-07 13:21:45 +00:00
parent 17348fbd32
commit c3da3a9aef
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/semmle/code/java/security/AndroidCertificatePinningQuery.qll
View File

@@ -1,3 +1,5 @@
/** Definitiona for the Android Missing Certificate Pinning query. */
import java
import semmle.code.xml.AndroidManifest
import semmle.code.java.dataflow.TaintTracking
@@ -8,7 +10,7 @@ class AndroidNetworkSecurityConfigFile extends XmlFile {
exists(AndroidApplicationXmlElement app, AndroidXmlAttribute confAttr, string confName |
confAttr.getElement() = app and
confAttr.getValue() = "@xml/" + confName and
this.getRelativePath() = "res/xml/" + confName + ".xml" and
this.getRelativePath().matches("%res/xml/" + confName + ".xml") and
this.getARootElement().getName() = "network-security-config"
)
}