QLDoc improvements from code review

Co-authored-by: Felicity Chapman <felicitymay@github.com>
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>

Author: 3 people

java/change-notes/2021-05-06-unsafe-android-access-query.md

@@ -1,2 +1,2 @@
 lgtm,codescanning
-* The query "Unsafe resource fetching in Android webview" (`java/android/unsafe-android-webview-fetch`) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @luchua-bc](https://github.com/github/codeql/pull/3706).
+* The query "Unsafe resource fetching in Android WebView" (`java/android/unsafe-android-webview-fetch`) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @luchua-bc](https://github.com/github/codeql/pull/3706).

java/ql/src/Security/CWE/CWE-749/UnsafeAndroidAccess.ql

@@ -1,7 +1,7 @@
 /**
- * @name Unsafe resource fetching in Android webview
- * @description JavaScript rendered inside WebViews can access any protected
- *              application file and web resource from any origin
+ * @name Unsafe resource fetching in Android WebView
+ * @description JavaScript rendered inside WebViews can access protected
+ *              application files and web resources from any origin exposing them to attack.
  * @kind path-problem
  * @problem.severity warning
  * @precision medium
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, FetchUntrustedResourceConfiguration conf
 where conf.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Unsafe resource fetching in Android webview due to $@.",
+select sink.getNode(), source, sink, "Unsafe resource fetching in Android WebView due to $@.",
   source.getNode(), sink.getNode().(UrlResourceSink).getSinkType()

java/ql/src/semmle/code/java/security/UnsafeAndroidAccess.qll

@@ -14,15 +14,15 @@ private import semmle.code.java.dataflow.ExternalFlow
  */
 abstract class UrlResourceSink extends DataFlow::Node {
   /**
-   * Returns a description of this vulnerability,
+   * Gets a description of this vulnerability.
    */
   abstract string getSinkType();
 }
 
 /**
- * Cross-origin access enabled resource fetch.
+ * A cross-origin access enabled resource fetch.
  *
- * It requires JavaScript to be enabled too to be considered a valid sink.
+ * Only considered a valid sink when JavaScript is also enabled.
  */
 private class CrossOriginUrlResourceSink extends JavaScriptEnabledUrlResourceSink {
   CrossOriginUrlResourceSink() {
@@ -61,7 +61,7 @@ private class JavaScriptEnabledUrlResourceSink extends UrlResourceSink {
 }
 
 /**
- * Methods allowing any-local-file and cross-origin access in the WebSettings class
+ * A method allowing any-local-file and cross-origin access in the WebSettings class.
  */
 private class CrossOriginAccessMethod extends Method {
   CrossOriginAccessMethod() {
@@ -71,7 +71,7 @@ private class CrossOriginAccessMethod extends Method {
 }
 
 /**
- * `setJavaScriptEnabled` method for the webview
+ * The `setJavaScriptEnabled` method for the webview.
  */
 private class AllowJavaScriptMethod extends Method {
   AllowJavaScriptMethod() {
@@ -81,7 +81,7 @@ private class AllowJavaScriptMethod extends Method {
 }
 
 /**
- * Holds if a call to `v.setJavaScriptEnabled(true)` exists
+ * Holds if a call to `v.setJavaScriptEnabled(true)` exists.
  */
 private predicate isJSEnabled(Variable v) {
   exists(MethodAccess jsa |

java/ql/src/semmle/code/java/security/UnsafeAndroidAccessQuery.qll

@@ -7,7 +7,7 @@ import semmle.code.java.security.RequestForgery
 import semmle.code.java.security.UnsafeAndroidAccess
 
 /**
- * Taint configuration tracking flow from untrusted inputs to a resource fetching call.
+ * A taint configuration tracking flow from untrusted inputs to a resource fetching call.
  */
 class FetchUntrustedResourceConfiguration extends TaintTracking::Configuration {
   FetchUntrustedResourceConfiguration() { this = "FetchUntrustedResourceConfiguration" }