Skip to content

Commit 08a17b3

Browse files
allowBackup documentation updates
Make error messages and descriptions clearer about application backups not being disabled, rather than focusing on `android:allowBackup` specifically. Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
1 parent 83c8e22 commit 08a17b3

File tree

2 files changed

+4
-4
lines changed

2 files changed

+4
-4
lines changed
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
---
22
category: feature
33
---
4-
* Added a new predicate, `allowsBackup`, in the `AndroidApplicationXmlElement` class. This predicate detects if the application element has its `android:allowBackup` attribute enabled.
4+
* Added a new predicate, `allowsBackup`, in the `AndroidApplicationXmlElement` class. This predicate detects if the application element does not disable the `android:allowBackup` attribute.

java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
2-
* @name Android allowBackup attribute enabled
3-
* @description Enabling the `android:allowBackup` attribute may allow an attacker to extract sensitive data.
2+
* @name Application backup allowed
3+
* @description Allowing application backups may allow an attacker to extract sensitive data.
44
* @kind problem
55
* @problem.severity recommendation
66
* @security-severity 7.5
@@ -15,4 +15,4 @@ import semmle.code.xml.AndroidManifest
1515

1616
from AndroidApplicationXmlElement androidAppElem
1717
where androidAppElem.allowsBackup()
18-
select androidAppElem, "The 'android:allowBackup' attribute is enabled."
18+
select androidAppElem, "Backups are allowed in this Android application."

0 commit comments

Comments
 (0)