Fixes

Author: joefarebrother

java/ql/lib/semmle/code/java/security/AndroidCertificatePinningQuery.qll

@@ -144,5 +144,5 @@ predicate missingPinning(DataFlow::Node node, string domain) {
 
 /** Gets the domain name from the given string literal */
 private string getDomain(CompileTimeConstantExpr expr) {
-  result = expr.getStringValue().regexpCapture("(https?://)?([^/]*)/?", 2)
+  result = expr.getStringValue().regexpCapture("(https?://)?([^/]*)(/.*)?", 2)
 }

java/ql/src/Security/CWE/CWE-295/AndroidMissingCertificatePinning.qhelp

@@ -3,9 +3,11 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
+<p>
 Certificate pinning is the practice of only trusting a specific set of SSL certificates, rather than those that the device trusts by default.
 In Android applications, it is reccomended to use certificate pinning when communicating over the network, 
 in order to minimize the risk of machine-in-the-middle attacks from a comprimised CA.
+</p>
 </overview>
 
 <recommendation>

java/ql/src/change-notes/2022-11-31-android-certificate-pinning.md renamed to java/ql/src/change-notes/2022-11-30-android-certificate-pinning.md

@@ -9,7 +9,7 @@ class Test extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location loc, string el, string tag, string value) {
     exists(DataFlow::Node node |
-      missingPinning(node) and
+      missingPinning(node, _) and
       loc = node.getLocation() and
       el = node.toString() and
       value = "" and

java/ql/test/query-tests/security/CWE-295/AndroidMissingCertificatePinning/Test1/test.ql

@@ -9,7 +9,7 @@ class Test extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location loc, string el, string tag, string value) {
     exists(DataFlow::Node node |
-      missingPinning(node) and
+      missingPinning(node, _) and
       loc = node.getLocation() and
       el = node.toString() and
       value = "" and

java/ql/test/query-tests/security/CWE-295/AndroidMissingCertificatePinning/Test2/test.ql

@@ -9,7 +9,7 @@ class Test extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location loc, string el, string tag, string value) {
     exists(DataFlow::Node node |
-      missingPinning(node) and
+      missingPinning(node, _) and
       loc = node.getLocation() and
       el = node.toString() and
       value = "" and

java/ql/test/query-tests/security/CWE-295/AndroidMissingCertificatePinning/Test3/test.ql

@@ -9,7 +9,7 @@ class Test extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location loc, string el, string tag, string value) {
     exists(DataFlow::Node node |
-      missingPinning(node) and
+      missingPinning(node, _) and
       loc = node.getLocation() and
       el = node.toString() and
       value = "" and

java/ql/test/query-tests/security/CWE-295/AndroidMissingCertificatePinning/Test4/test.ql

@@ -9,7 +9,7 @@ class Test extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location loc, string el, string tag, string value) {
     exists(DataFlow::Node node |
-      missingPinning(node) and
+      missingPinning(node, _) and
       loc = node.getLocation() and
       el = node.toString() and
       value = "" and