Merge branch 'https-fix' of github.com:erik-krogh/ql into https-fix

Author: erik-krogh

javascript/ql/src/Security/CWE-829/InsecureDownload.qhelp

@@ -6,28 +6,28 @@
 		<p>
 			Downloading executeables or other sensitive files over an unencrypted connection 
 			can leave a server open to man-in-the-middle attacks (MITM). 
-			Such a man-in-the-middle attack can allow an attacker to insert arbitary content 
-			into the downloaded file, and in the worst case allow the attacker to execute 
-			arbitary code on the vulnerable system.
+			Such an attack can allow an attacker to insert arbitrary content 
+			into the downloaded file, and in the worst case, allow the attacker to execute 
+			arbitrary code on the vulnerable system.
 		</p>
 	</overview>
 	<recommendation>
 		<p>
-			Use an transfer protocol that includes encryption when downloading executeables or other sensitive files.
+			Use a secure transfer protocol when downloading executables or other sensitive files.
 		</p>
 	</recommendation>
 	<example>
 		<p>
-			In this example a server downloads a shell script from a remote URL using the <code>node-fetch</code> 
+			In this example, a server downloads a shell script from a remote URL using the <code>node-fetch</code> 
 			library, and then executes this shell script. 
 		</p>
 		<sample src="examples/insecure-download.js" />
 		<p>
 			The HTTP protocol is vulnerable to MITM, and thus an attacker could potentially replace the downloaded
-			shell script with arbitary code, which allows the attacker complete control over the attacked system.
+			shell script with arbitrary code, which gives the attacker complete control over the system.
 		</p>
 		<p>
-			The issue has been fixed in the below example by replacing the HTTP protocol with the HTTPS protocol.
+			The issue has been fixed in the example below by replacing the HTTP protocol with the HTTPS protocol.
 		</p>
 		<sample src="examples/insecure-download.js" />
 	</example>

javascript/ql/src/semmle/javascript/security/dataflow/InsecureDownload.qll

@@ -18,7 +18,7 @@ module InsecureDownload {
    * A taint tracking configuration for download of sensitive file through insecure connection.
    */
   class Configuration extends DataFlow::Configuration {
-    Configuration() { this = "HTTP/HTTPS" }
+    Configuration() { this = "InsecureDownload" }
 
     override predicate isSource(DataFlow::Node source) { source instanceof Source }