Apply suggestions from code review

OWASP · Dec 7, 2024 · 8df64f5 · 8df64f5
1 parent 4c18f3a
commit 8df64f5
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 4 deletions.
diff --git a/weaknesses/MASVS-NETWORK/MASWE-0047.md b/weaknesses/MASVS-NETWORK/MASWE-0047.md
@@ -33,7 +33,6 @@ This highlights the importance of implementing certificate pinning **alongside o
 
 - **Improper Configuration of Pinning Libraries**: Misconfiguring libraries like TrustKit, OkHttp's `CertificatePinner`, Volley, or AFNetworking's `SSLPinningMode`, leading to ineffective pinning.
 - **Dynamic Pinning without Security**: Retrieving pins dynamically over insecure channels without proper validation, making it easy for attackers to supply malicious pins.
-- **Pinning to Insecure Certificates**: Pinning to self-signed, expired, or untrusted certificates that can be exploited.
 - **Weak Validation Logic**: Custom pinning implementations that do not correctly validate the certificate chain or public key. For example, accepting any certificate that chains to a trusted root CA instead of a specific certificate or public key.
 - **Lack of Backup Pins**: Not including backup pins to prevent connectivity issues if the primary pin is no longer valid.
 

diff --git a/weaknesses/MASVS-NETWORK/MASWE-0050.md b/weaknesses/MASVS-NETWORK/MASWE-0050.md
@@ -53,7 +53,7 @@ If the connections were secured using encryption and proper authentication mecha
 - **Usage of Non-HTTP Insecure Protocols:** Using insecure protocols such as FTP, SMTP without TLS, TCP sockets or custom protocols which do not encrypt data in transit.
 - **Usage of Low-Level Network APIs:** Use of low-level network APIs that do not enforce encryption and do not honor the platform's network security settings, such as `Socket` on Android or `NSURLConnection` on iOS.
 - **Cross-Platform Framework Misconfiguration:** Improper settings in cross-platform frameworks may allow cleartext traffic for both Android and iOS versions of an app.
-- **Third-Party Libraries**: Using third-party libraries or SDKs that default to insecure communication methods.
+- **Third-Party Libraries**: Using third-party libraries or SDKs that default to insecure communication methods or are improperly configured.
 
 ## Mitigations
 

diff --git a/weaknesses/MASVS-NETWORK/MASWE-0052.md b/weaknesses/MASVS-NETWORK/MASWE-0052.md
@@ -45,8 +45,7 @@ Apps that do not properly validate TLS certificates during secure communication
 ## Mitigations
 
 - **Enforce Strict Certificate Validation**: Always validate TLS certificates against a trusted set of Certificate Authorities (CAs) provided by the operating system or a trusted third party.
+- **Avoid Accepting Self-Signed Certificates**: Do not accept self-signed or untrusted certificates in production environments unless there is a secure mechanism to trust them explicitly.
 - **Enable Hostname Verification**: Ensure that the application's network layer verifies the server's hostname against the certificate's Subject Alternative Name (SAN) or Common Name (CN).
 - **Use Standard Trust Managers**: Utilize well-established libraries and platform-provided APIs for certificate validation instead of custom implementations.
 - **Handle Validation Errors Properly**: Terminate the connection and alert the user whenever certificate validation fails due to issues like expiration, revocation, or mismatch.
-- **Avoid Accepting Self-Signed Certificates**: Do not accept self-signed or untrusted certificates in production environments unless there is a secure mechanism to trust them explicitly.
-- **Stay Updated with Security Protocols**: Use the latest versions of TLS protocols and ensure that weak ciphers and protocols are disabled.