Skip to content

Commit 030c286

Browse files
intrigus-lgtmintrigus
authored andcommitted
Java: Use machine-in-the-middle consistently
1 parent f52e438 commit 030c286

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.qhelp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<overview>
66
<p>
77
If the <code>checkServerTrusted</code> method of a <code>TrustManager</code> never throws a <code>CertificateException</code> it trusts every certificate.
8-
This allows an attacker to perform a Man-in-the-middle attack against the application therefore breaking any security Transport Layer Security (TLS) gives.
8+
This allows an attacker to perform a machine-in-the-middle attack against the application therefore breaking any security Transport Layer Security (TLS) gives.
99

1010
An attack would look like this:
1111
1. The program connects to <code>https://example.com</code>.
@@ -29,7 +29,7 @@ See below for an example of how to do this.
2929
<example>
3030
<p>
3131
In the first (bad) example, the <code>TrustManager</code> never throws a <code>CertificateException</code> thereby trusting any certificate.
32-
This allows an attacker to perform a man-in-the-middle attack.
32+
This allows an attacker to perform a machine-in-the-middle attack.
3333
In the second (good) example, no custom <code>TrustManager</code> is used. Instead, the self-signed certificate that should be trusted
3434
is explicitly trusted by loading it into a <code>KeyStore</code>.
3535
</p>

0 commit comments

Comments
 (0)