hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Add change note for rb/insecure-download

Browse Source
This commit is contained in:
Harry Maclean
2022-04-14 15:30:36 +12:00
parent a85811ad69
commit f35379bf8c
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ruby/ql/src/change-notes/2022-04-14-rb-insecure-download.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: newQuery
---
* Added a new query, `rb/insecure-download`. The query finds cases where executables and other sensitive files are downloaded over an insecure connection, which may allow for man-in-the-middle attacks.

2
ruby/ql/src/queries/security/cwe-829/InsecureDownload.ql
View File

@@ -1,7 +1,7 @@
/**
* @name Download of sensitive file through insecure connection
* @description Downloading executables and other sensitive files over an insecure connection
* opens up for potential man-in-the-middle attacks.
* may allow man-in-the-middle attacks.
* @kind path-problem
* @problem.severity error
* @security-severity 8.1