mirror of
https://github.com/github/codeql.git
synced 2025-12-21 11:16:30 +01:00
Apply suggestions from code review
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
This commit is contained in:
@@ -1,2 +1,2 @@
|
||||
lgtm,codescanning
|
||||
* The query "Broadcasting sensitive data to all Android applications" (`java/android/sensitive-broadcast`) has been promoted from experimental the main query pack. Its results will now appear by default. The query was originally [submitted as an experimental query by @luchua-bc.](https://github.com/github/codeql/pull/4512)
|
||||
* The query "Leaking sensitive information through an implicit Intent" (`java/android/sensitive-communication`) has been promoted from experimental to the main query pack. Its results will now appear by default. The query was originally [submitted as an experimental query by @luchua-bc.](https://github.com/github/codeql/pull/4512)
|
||||
@@ -8,7 +8,7 @@
|
||||
|
||||
<recommendation>
|
||||
<p>
|
||||
For <code>sendBroadcast</code> methods, a receiver permission may be specified so that only applications with a certain permission may read recieve the intent;
|
||||
For <code>sendBroadcast</code> methods, a receiver permission may be specified so that only applications with a certain permission may receive the intent;
|
||||
or a <code>LocalBroadcastManager</code> may be used.
|
||||
Otherwise, ensure that intents containing sensitive data have an explicit receiver class set.
|
||||
</p>
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
/**
|
||||
* @name Leaking sensetive information through an implicit Intent.
|
||||
* @name Leaking sensitive information through an implicit Intent
|
||||
* @description An Android application uses implicit intents containing sensitive data
|
||||
* in a way that exposes it to arbitrary applications on the device.
|
||||
* @kind path-problem
|
||||
* @problem.severity warning
|
||||
* @security-severity 8.2
|
||||
* @precision medium
|
||||
* @id java/android/sensitive-communication
|
||||
* @tags security
|
||||
|
||||
Reference in New Issue
Block a user