JHipster Vuln: Add GOOD/BAD & release note links

Author: JLLeitschuh

java/ql/src/Security/CWE/CWE-338/JHipsterGeneratedPRNG.qhelp

@@ -16,7 +16,7 @@ Using this information, they can create a reset link that allows them to take ov
 
 <example>
 
-<p>The example below shows the vulnerable <code>RandomUtil</code> class generated by JHipster.</p>
+<p>The example below shows the vulnerable <code>RandomUtil</code> class generated by <a href="https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html">JHipster prior to version 6.3.0</a>.</p>
 <sample src="JHipsterGeneratedPRNGVulnerable.java" />
 
 <p>Below is a fixed version of the <code>RandomUtil</code> class.</p>

java/ql/src/Security/CWE/CWE-338/JHipsterGeneratedPRNGFixed.java

@@ -6,7 +6,7 @@
  * Utility class for generating random Strings.
  */
 public final class RandomUtil {
-    private static final SecureRandom SECURE_RANDOM = new SecureRandom();
+    private static final SecureRandom SECURE_RANDOM = new SecureRandom(); // GOOD: Using SecureRandom
 
     private static final int DEF_COUNT = 20;
 
@@ -18,6 +18,7 @@ private RandomUtil() {
     }
 
     private static String generateRandomAlphanumericString() {
+        // GOOD: Passing Secure Random to RandomStringUtils::random
         return RandomStringUtils.random(DEF_COUNT, 0, 0, true, true, null, SECURE_RANDOM);
     }
 

java/ql/src/Security/CWE/CWE-338/JHipsterGeneratedPRNGVulnerable.java

@@ -16,7 +16,7 @@ private RandomUtil() {
      * @return the generated password.
      */
     public static String generatePassword() {
-        return RandomStringUtils.randomAlphanumeric(DEF_COUNT);
+        return RandomStringUtils.randomAlphanumeric(DEF_COUNT); // BAD: RandomStringUtils oes not use SecureRandom
     }
 
     /**
@@ -25,7 +25,7 @@ public static String generatePassword() {
      * @return the generated activation key.
      */
     public static String generateActivationKey() {
-        return RandomStringUtils.randomNumeric(DEF_COUNT);
+        return RandomStringUtils.randomNumeric(DEF_COUNT); // BAD: RandomStringUtils oes not use SecureRandom
     }
 
     /**
@@ -34,7 +34,7 @@ public static String generateActivationKey() {
      * @return the generated reset key.
      */
     public static String generateResetKey() {
-        return RandomStringUtils.randomNumeric(DEF_COUNT);
+        return RandomStringUtils.randomNumeric(DEF_COUNT); // BAD: RandomStringUtils oes not use SecureRandom
     }
 
     /**
@@ -44,7 +44,7 @@ public static String generateResetKey() {
      * @return the generated series data.
      */
     public static String generateSeriesData() {
-        return RandomStringUtils.randomAlphanumeric(DEF_COUNT);
+        return RandomStringUtils.randomAlphanumeric(DEF_COUNT); // BAD: RandomStringUtils oes not use SecureRandom
     }
 
     /**
@@ -53,6 +53,6 @@ public static String generateSeriesData() {
      * @return the generated token data.
      */
     public static String generateTokenData() {
-        return RandomStringUtils.randomAlphanumeric(DEF_COUNT);
+        return RandomStringUtils.randomAlphanumeric(DEF_COUNT); // BAD: RandomStringUtils oes not use SecureRandom
     }
 }