You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.qhelp
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@
5
5
<overview>
6
6
<p>
7
7
If the <code>checkServerTrusted</code> method of a <code>TrustManager</code> never throws a <code>CertificateException</code> it trusts every certificate.
8
-
This allows an attacker to perform a Man-in-the-middle attack against the application therefore breaking any security Transport Layer Security (TLS) gives.
8
+
This allows an attacker to perform a machine-in-the-middle attack against the application therefore breaking any security Transport Layer Security (TLS) gives.
9
9
10
10
An attack would look like this:
11
11
1. The program connects to <code>https://example.com</code>.
@@ -29,7 +29,7 @@ See below for an example of how to do this.
29
29
<example>
30
30
<p>
31
31
In the first (bad) example, the <code>TrustManager</code> never throws a <code>CertificateException</code> thereby trusting any certificate.
32
-
This allows an attacker to perform a man-in-the-middle attack.
32
+
This allows an attacker to perform a machine-in-the-middle attack.
33
33
In the second (good) example, no custom <code>TrustManager</code> is used. Instead, the self-signed certificate that should be trusted
34
34
is explicitly trusted by loading it into a <code>KeyStore</code>.
0 commit comments