Skip to content

Commit e2acc26

Browse files
egregius313subatoi
andauthored
Apply docs review suggestions
- Punctuation - Rewording Co-authored-by: Ben Ahmady <[email protected]>
1 parent 3ee14f9 commit e2acc26

File tree

1 file changed

+9
-10
lines changed

1 file changed

+9
-10
lines changed

java/ql/src/Security/CWE/CWE-094/ArbitraryApkInstallation.qhelp

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,30 +4,29 @@
44
<qhelp>
55
<overview>
66
<p>
7-
Android allows an application to install an APK (Android package kit)
7+
Android allows an application to install an Android Package Kit (APK)
88
using an <code>Intent</code> with
99
the <code>"application/vnd.android.package-archive"</code> MIME type. If
1010
the file used in the <code>Intent</code> is from a location that is not
11-
controlled by the application (for example, the SD card which is
12-
universally writable), this can result in the installation of an
13-
application which was not intended.
11+
controlled by the application (for example, an SD card that is
12+
universally writable), this can result in the unintended installation of untrusted applications.
1413
</p>
1514
</overview>
1615

1716
<recommendation>
1817
<p>
19-
It is advised to transition to install packages using
18+
You should install packages using
2019
the <code>PackageInstaller</code> class.
2120
</p>
2221

2322
<p>
24-
If installation from a file is necessary, it is best to use
23+
If you need to install from a file, you should use
2524
a <code>FileProvider</code>. Content providers can provide more specific
2625
permissions than file system permissions can.
2726
</p>
2827

2928
<p>
30-
When your application does not require installing packages, do not add
29+
When your application does not require package installations, do not add
3130
the <code>REQUEST_INSTALL_PACKAGES</code> permission in the manifest file.
3231
</p>
3332
</recommendation>
@@ -36,21 +35,21 @@
3635

3736
<p>
3837
In the following (bad) example, the package is installed from a file which
39-
may be altered by another application.
38+
may be altered by another application:
4039
</p>
4140

4241
<sample src="InstallApkWithFile.java"/>
4342

4443
<p>
4544
In the following (good) example, the package is installed by using
46-
a <code>FileProvider</code>.
45+
a <code>FileProvider</code>:
4746
</p>
4847

4948
<sample src="InstallApkWithFileProvider.java"/>
5049

5150
<p>
5251
In the following (good) example, the package is installed using an
53-
instance of the <code>android.content.pm.PackageInstaller</code> class.
52+
instance of the <code>android.content.pm.PackageInstaller</code> class:
5453
</p>
5554

5655
<sample src="InstallApkWithPackageInstaller.java"/>

0 commit comments

Comments
 (0)