hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
This commit is contained in:
Joe Farebrother
2021-10-22 10:54:57 +01:00
committed by GitHub
parent 2d368a7d9a
commit c89178c0e8
3 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/change-notes/2021-09-03-android-sensitive-broadcast.md
View File

@@ -1,2 +1,2 @@
lgtm,codescanning
* The query "Broadcasting sensitive data to all Android applications" (`java/android/sensitive-broadcast`) has been promoted from experimental the main query pack. Its results will now appear by default. The query was originally [submitted as an experimental query by @luchua-bc.](https://github.com/github/codeql/pull/4512)
* The query "Leaking sensitive information through an implicit Intent" (`java/android/sensitive-communication`) has been promoted from experimental to the main query pack. Its results will now appear by default. The query was originally [submitted as an experimental query by @luchua-bc.](https://github.com/github/codeql/pull/4512)

2
java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.qhelp
View File

@@ -8,7 +8,7 @@
<recommendation>
<p>
For <code>sendBroadcast</code> methods, a receiver permission may be specified so that only applications with a certain permission may read recieve the intent;
For <code>sendBroadcast</code> methods, a receiver permission may be specified so that only applications with a certain permission may receive the intent;
or a <code>LocalBroadcastManager</code> may be used.
Otherwise, ensure that intents containing sensitive data have an explicit receiver class set.
</p>

3
java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.ql
View File

@@ -1,9 +1,10 @@
/**
* @name Leaking sensetive information through an implicit Intent.
* @name Leaking sensitive information through an implicit Intent
* @description An Android application uses implicit intents containing sensitive data
* in a way that exposes it to arbitrary applications on the device.
* @kind path-problem
* @problem.severity warning
* @security-severity 8.2
* @precision medium
* @id java/android/sensitive-communication
* @tags security