Java: remove version debugging from alert message

Author: Jami Cogswell

java/ql/lib/semmle/code/java/security/SpringBootActuatorsConfigQuery.qll

@@ -11,9 +11,8 @@ private class SpringBootParent extends Parent {
   SpringBootParent() { this.getGroup().getValue() = "org.springframework.boot" }
 }
 
-// TODO: private once done with version string debugging in alert msg.
 /** A `Pom` with a Spring Boot parent node. */
-class SpringBootPom extends Pom {
+private class SpringBootPom extends Pom {
   SpringBootPom() { this.getParentElement() instanceof SpringBootParent }
 
   /** Holds if the Spring Boot Security module is used in the project. */

java/ql/src/Security/CWE/CWE-200/SpringBootActuatorsConfig/SpringBootActuatorsConfig.ql

@@ -15,11 +15,6 @@ import java
 import semmle.code.xml.MavenPom
 import semmle.code.java.security.SpringBootActuatorsConfigQuery
 
-from SpringBootStarterActuatorDependency d, JavaPropertyOption jpOption, SpringBootPom pom
-where
-  exposesSensitiveEndpoint(d, jpOption) and
-  // TODO: remove pom; for debugging versions
-  d = pom.getADependency()
-select d,
-  "Insecure Spring Boot actuator $@ exposes sensitive endpoints (" +
-    pom.getParentElement().getVersionString() + ").", jpOption, "configuration"
+from SpringBootStarterActuatorDependency d, JavaPropertyOption jpOption
+where exposesSensitiveEndpoint(d, jpOption)
+select d, "Insecure Spring Boot actuator $@ exposes sensitive endpoints.", jpOption, "configuration"