GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — codeql/java/ql/src/Security/CWE/CWE-273/UnsafeCertTrust.ql at main · github/codeql Expand file tree/ Copy pathUnsafeCertTrust.qlMore file actions 22 lines (20 loc) · 736 Bytes / Copy pathUnsafeCertTrust.qlFile metadata and controls22 lines (20 loc) · 736 Bytes 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 /** * @name Unsafe certificate trust * @description SSLSocket/SSLEngine ignores all SSL certificate validation * errors when establishing an HTTPS connection, thereby making * the app vulnerable to man-in-the-middle attacks. * @kind problem * @problem.severity warning * @security-severity 9.8 * @precision medium * @id java/unsafe-cert-trust * @tags security * external/cwe/cwe-273 */ import java import semmle.code.java.security.UnsafeCertTrustQuery from Expr unsafeTrust where unsafeTrust instanceof RabbitMQEnableHostnameVerificationNotSet or SslEndpointIdentificationFlow::flowTo(DataFlow::exprNode(unsafeTrust)) select unsafeTrust, "Unsafe configuration of trusted certificates." |
| You are visitor 01402520 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |