Skip to content

Commit 28369d1

Browse files
atorralbaguntrip
andcommitted
Apply suggestions from code review
Co-authored-by: Steve Guntrip <[email protected]>
1 parent aa2cdb7 commit 28369d1

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirection.qhelp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,15 @@
66
on behalf of the victim app.</p>
77
</overview>
88
<recommendation>
9-
<p>Do not export compontents that start other components from a user-provided Intent.
9+
<p>Do not export components that start other components from a user-provided Intent.
1010
They can be made private by setting the <code>android:exported</code> property to <code>false</code> in the app's Android Manifest.</p>
1111
<p>If this is not possible, restrict either which apps can send Intents to the affected component, or which components can be started from it.</p>
1212
</recommendation>
1313
<example>
1414
<p>The following snippet contains two examples.
1515
In the first example, an arbitrary component can be started from the externally provided <code>forward_intent</code> Intent.
16-
In the second example, the destination component of the Intent is first checked to make sure it is safe.</p>
16+
In the second example, the destination component of the Intent is first checked to make sure it is safe.
17+
In the third example, the component that created the Intent is first checked to make sure it comes from a trusted origin.</p>
1718
<sample src="AndroidIntentRedirectionSample.java" />
1819
</example>
1920
<references>

0 commit comments

Comments
 (0)