diff --git a/java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.qhelp b/java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.qhelp index bda7fd0926d..498094b0ef7 100644 --- a/java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.qhelp +++ b/java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.qhelp @@ -6,11 +6,10 @@

The WebView.setWebContentsDebuggingEnabled method enables or disables the contents of any WebView in the application to be debugged.

-

You should only enable debugging features during development. When you create a production build, you should disable it. If you enable debugging features, this can make your code vulnerable by adding entry points, or leaking sensitive information. +

You should only enable debugging features during development. When you create a production build, you should disable it. If you enable debugging features, this can make your code vulnerable by adding entry points, or leaking sensitive information.

-

Ensure that debugging features are not enabled in production builds. -If WebView.setWebContentsDebuggingEnabled(true) is used, ensure that it is guarded by a flag indicating that this is a debug build.

+

Ensure that debugging features are not enabled in production builds, such as by guarding calls to WebView.setWebContentsDebuggingEnabled(true) by a flag that is only enabled in debug builds.