diff --git a/java/change-notes/2021-09-03-android-sensitive-broadcast.md b/java/change-notes/2021-09-03-android-sensitive-broadcast.md index d1b7a287765..283ff591e57 100644 --- a/java/change-notes/2021-09-03-android-sensitive-broadcast.md +++ b/java/change-notes/2021-09-03-android-sensitive-broadcast.md @@ -1,2 +1,2 @@ lgtm,codescanning -* The query "Broadcasting sensitive data to all Android applications" (`java/android/sensitive-broadcast`) has been promoted from experimental the main query pack. Its results will now appear by default. The query was originally [submitted as an experimental query by @luchua-bc.](https://github.com/github/codeql/pull/4512) \ No newline at end of file +* The query "Leaking sensitive information through an implicit Intent" (`java/android/sensitive-communication`) has been promoted from experimental to the main query pack. Its results will now appear by default. The query was originally [submitted as an experimental query by @luchua-bc.](https://github.com/github/codeql/pull/4512) \ No newline at end of file diff --git a/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.qhelp b/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.qhelp index e43970ebf93..6bdb54627cd 100644 --- a/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.qhelp +++ b/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.qhelp @@ -8,7 +8,7 @@

- For sendBroadcast methods, a receiver permission may be specified so that only applications with a certain permission may read recieve the intent; + For sendBroadcast methods, a receiver permission may be specified so that only applications with a certain permission may receive the intent; or a LocalBroadcastManager may be used. Otherwise, ensure that intents containing sensitive data have an explicit receiver class set.

diff --git a/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.ql b/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.ql index 60dd60c4123..c509aa9198f 100644 --- a/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.ql +++ b/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.ql @@ -1,9 +1,10 @@ /** - * @name Leaking sensetive information through an implicit Intent. + * @name Leaking sensitive information through an implicit Intent * @description An Android application uses implicit intents containing sensitive data * in a way that exposes it to arbitrary applications on the device. * @kind path-problem * @problem.severity warning + * @security-severity 8.2 * @precision medium * @id java/android/sensitive-communication * @tags security