hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

spelling: response

Browse Source 
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
This commit is contained in:
Josh Soref
2022-10-09 06:37:50 -04:00
parent 1a14c06008
commit 08a79531cf
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/experimental/Security/CWE/CWE-094/SpringViewManipulation.qhelp
View File

@@ -19,7 +19,7 @@
<p> <p>
In general, using user input to determine Spring view name should be avoided. In general, using user input to determine Spring view name should be avoided.
If user input must be included in the expression, the controller can be annotated by If user input must be included in the expression, the controller can be annotated by
a <code>@ReponseBody</code> annotation. In this case, Spring Framework does not interpret a <code>@ResponseBody</code> annotation. In this case, Spring Framework does not interpret
it as a view name, but just returns this string in HTTP Response. The same applies to using it as a view name, but just returns this string in HTTP Response. The same applies to using
a <code>@RestController</code> annotation on a class, as internally it inherits <code>@ResponseBody</code>. a <code>@RestController</code> annotation on a class, as internally it inherits <code>@ResponseBody</code>.
</p> </p>
@@ -31,7 +31,7 @@
</p> </p>
<sample src="SpringViewBad.java" /> <sample src="SpringViewBad.java" />
<p> <p>
This can be easily prevented by using the <code>ResponseBody</code> annotation which marks the reponse is already processed preventing exploitation of Spring View Manipulation vulnerabilities. Alternatively, this can also be fixed by adding a <code>HttpServletResponse</code> parameter to the method definition as shown in the example below. This can be easily prevented by using the <code>ResponseBody</code> annotation which marks the response is already processed preventing exploitation of Spring View Manipulation vulnerabilities. Alternatively, this can also be fixed by adding a <code>HttpServletResponse</code> parameter to the method definition as shown in the example below.
</p> </p>
<sample src="SpringViewGood.java" /> <sample src="SpringViewGood.java" />
</example> </example>

2
javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll
View File

@@ -671,7 +671,7 @@ module ClientRequest {
} }
/** /**
* Gets the response type corresponding to `getReponse()` but not * Gets the response type corresponding to `getResponse()` but not
* for explicitly typed calls like `getResponseJson()`. * for explicitly typed calls like `getResponseJson()`.
*/ */
string getAssignedResponseType() { string getAssignedResponseType() {