hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix qhelp & ql-for-ql errors

Browse Source
This commit is contained in:
Joe Farebrother
2022-08-31 15:24:29 +01:00
parent 414e0b20b3
commit eed2df0fb3
3 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/lib/semmle/code/java/security/WebviewDubuggingEnabledQuery.qll
View File

@@ -22,7 +22,7 @@ private predicate isDebugCheck(Expr ex) {
)
}
/** Configuration to find instances of `setWebContentDebuggingEnabled` called with `true` values. */
/** A configuration to find instances of `setWebContentDebuggingEnabled` called with `true` values. */
class WebviewDebugEnabledConfig extends DataFlow::Configuration {
WebviewDebugEnabledConfig() { this = "WebviewDebugEnabledConfig" }

2
java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.qhelp
View File

@@ -7,7 +7,7 @@
<p>The <code>WebView.setWebContentsDebuggingEnabled</code> method enables or disables the contents of any <code>WebView</code> in the application to be debugged.</p>
<p>Enabling debugging featues could allow for additional entry points or leaking sensitive information.
As such, debugging should only be anabled during development, and disabled during production builds.
As such, debugging should only be anabled during development, and disabled during production builds.</p>
</overview>
<recommendation>
Ensure that debugging features are not enabled during production builds.

1
java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.ql
View File

@@ -12,7 +12,6 @@
import java
import semmle.code.java.security.WebviewDubuggingEnabledQuery
import semmle.code.java.dataflow.DataFlow
import DataFlow::PathGraph
from WebviewDebugEnabledConfig conf, DataFlow::PathNode source, DataFlow::PathNode sink