Skip to content

Commit 6bfdf8d

Browse files
committed
Java: Fix qhelp errors.
1 parent dc0b06a commit 6bfdf8d

File tree

1 file changed

+6
-7
lines changed

1 file changed

+6
-7
lines changed

java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.qhelp

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,13 @@ An attack might look like this:
1313
</p>
1414

1515
<ol>
16-
<li>The vulnerable program connects to <code>https://example.com</code>.
17-
<li>The attacker intercepts this connection and presents a valid, self-signed certificate for <code>https://example.com</code>.
18-
<li>The vulnerable program calls the <code>checkServerTrusted</code> method to check whether it should trust the certificate.
19-
<li>The <code>checkServerTrusted</code> method of your <code>TrustManager</code> does not throw a <code>CertificateException</code>.
20-
<li>The vulnerable program accepts the certificate and proceeds with the connection since your <code>TrustManager</code> implicitly trusted it by not throwing an exception.
21-
<li>The attacker can now read the data your program sends to <code>https://example.com</code> and/or alter its replies while the program thinks the connection is secure.
16+
<li>The vulnerable program connects to <code>https://example.com</code>.</li>
17+
<li>The attacker intercepts this connection and presents a valid, self-signed certificate for <code>https://example.com</code>.</li>
18+
<li>The vulnerable program calls the <code>checkServerTrusted</code> method to check whether it should trust the certificate.</li>
19+
<li>The <code>checkServerTrusted</code> method of your <code>TrustManager</code> does not throw a <code>CertificateException</code>.</li>
20+
<li>The vulnerable program accepts the certificate and proceeds with the connection since your <code>TrustManager</code> implicitly trusted it by not throwing an exception.</li>
21+
<li>The attacker can now read the data your program sends to <code>https://example.com</code> and/or alter its replies while the program thinks the connection is secure.</li>
2222
</ol>
23-
</p>
2423
</overview>
2524

2625
<recommendation>

0 commit comments

Comments
 (0)