hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 21:25:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com>
This commit is contained in:
Erik Krogh Kristensen
2023-01-23 14:58:04 +01:00
committed by GitHub
parent 8251ad5e99
commit 32c4cf5769
4 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ruby/ql/src/queries/security/cwe-079/examples/unsafe-html-construction.rb
View File

@@ -1,6 +1,6 @@
class UsersController < ActionController::Base
# BAD - create a user description, where the name is not escaped
def create_user_description (name)
"<h2>#{name}</h2>".html_safe
"<b>#{name}</b>".html_safe
end
end

2
ruby/ql/src/queries/security/cwe-079/examples/unsafe-html-construction_safe.rb
View File

@@ -1,6 +1,6 @@
class UsersController < ActionController::Base
# Good - create a user description, where the name is escaped
def create_user_description (name)
"<h2>#{ERB::Util.html_escape(name)}</h2>".html_safe
"<b>#{ERB::Util.html_escape(name)}</b>".html_safe
end
end