From 0b1637a4099416de032b701bd20d812bfaa7560e Mon Sep 17 00:00:00 2001 From: haby0 Date: Tue, 20 Apr 2021 19:32:39 +0800 Subject: [PATCH] Update java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSource.qhelp Co-authored-by: Chris Smowton --- .../Security/CWE/CWE-348/UseOfLessTrustedSource.qhelp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSource.qhelp b/java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSource.qhelp index 48923b85f02..3b56a9650bd 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSource.qhelp +++ b/java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSource.qhelp @@ -3,7 +3,7 @@ "qhelp.dtd"> -

The software obtains the original client IP address through the http header (X-Forwarded-For or X-Real-IP or Proxy-Client-IP +

An original client IP address is retrieved from an http header (X-Forwarded-For or X-Real-IP or Proxy-Client-IP etc.), which is used to ensure security or track it in the log for statistical or other reasons. Attackers can forge the value of these identifiers to attack the software.