hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: address some comments

Browse Source
This commit is contained in:
Asger F
2018-11-20 18:11:46 +00:00
parent 8aff66616b
commit 1c06f45046
3 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
javascript/ql/src/Security/CWE-094/MethodNameInjection.qhelp
View File

@@ -15,6 +15,7 @@ in its <code>constructor</code> property.
<recommendation>
<p>
Avoid invoking user-controlled methods on the global object or on any function object.
Whitelist the permitted method names or change the type of object the methods are stored on.
</p>
</recommendation>

4
javascript/ql/src/Security/CWE-094/MethodNameInjection.ql
View File

@@ -1,8 +1,8 @@
/**
* @name Method name injection
* @description Invoking user-controlled methods on a arbitrary objects can lead to remote code execution.
* @description Invoking user-controlled methods on arbitrary objects can lead to remote code execution.
* @kind path-problem
* @problem.severity warning
* @problem.severity error
* @precision high
* @id js/method-name-injection
* @tags security