hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-Authored-By: Felicity Chapman <felicitymay@github.com>
Co-Authored-By: yo-h <55373593+yo-h@users.noreply.github.com>
This commit is contained in:
Jonathan Leitschuh
2019-12-09 19:17:23 -05:00
committed by GitHub
parent 21193bd780
commit f341234edb
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.qhelp
View File

@@ -12,7 +12,7 @@ against your project's users.
</p> </p>
<p>This vulnerability has a <p>This vulnerability has a
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1"> <a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1">
CVSS v3.1 base score of 8.1/10 CVSS v3.1 base score of 8.1/10
</a>.</p> </a>.</p>
@@ -37,7 +37,7 @@ The first shows the use of HTTP, the second shows the use of HTTPS.
<references> <references>
<li> <li>
Research: Research:
<a href="https://medium.com/bugbountywriteup/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb?source=friends_link&sk=3c99970c55a899ad9ef41f126efcde0e"> <a href="https://medium.com/bugbountywriteup/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb?source=friends_link&amp;sk=3c99970c55a899ad9ef41f126efcde0e">
Want to take over the Java ecosystem? All you need is a MITM! Want to take over the Java ecosystem? All you need is a MITM!
</a> </a>
</li> </li>

6
java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql
View File

@@ -1,9 +1,9 @@
/** /**
* @name Failure to use HTTPS or SFTP URL in Maven artifact upload/download * @name Failure to use HTTPS or SFTP URL in Maven artifact upload/download
* @description Non-HTTPS connections can be intercepted by third parties. * @description Non-HTTPS connections can be intercepted by third parties.
* @kind path-problem * @kind problem
* @problem.severity error * @problem.severity error
* @precision very high * @precision very-high
* @id java/maven/non-https-url * @id java/maven/non-https-url
* @tags security * @tags security
* external/cwe/cwe-319 * external/cwe/cwe-319
@@ -35,4 +35,4 @@ from DeclaredRepository repository
where repository.isInsecureRepositoryUsage() where repository.isInsecureRepositoryUsage()
select select
repository, repository,
"Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to repository " + repository.getUrl() "Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository " + repository.getUrl()