diff --git a/ruby/ql/src/change-notes/2022-10-10-unsafe-shell-command-construction.md b/ruby/ql/src/change-notes/2022-10-10-unsafe-shell-command-construction.md index d61d32dcc5f..fba6a9304cf 100644 --- a/ruby/ql/src/change-notes/2022-10-10-unsafe-shell-command-construction.md +++ b/ruby/ql/src/change-notes/2022-10-10-unsafe-shell-command-construction.md @@ -1,4 +1,4 @@ --- category: newQuery --- -* Added a new query, `rb/shell-command-constructed-from-input`, to detect libraries that unsafely constructs shell commands from their inputs. +* Added a new query, `rb/shell-command-constructed-from-input`, to detect libraries that unsafely construct shell commands from their inputs. diff --git a/ruby/ql/src/queries/security/cwe-078/UnsafeShellCommandConstruction.qhelp b/ruby/ql/src/queries/security/cwe-078/UnsafeShellCommandConstruction.qhelp index 88cea1d80d3..4231f7cb0b4 100644 --- a/ruby/ql/src/queries/security/cwe-078/UnsafeShellCommandConstruction.qhelp +++ b/ruby/ql/src/queries/security/cwe-078/UnsafeShellCommandConstruction.qhelp @@ -55,7 +55,7 @@

To avoid such potentially catastrophic behaviors, provide the - inputs from exported functions as an argument that does not + input from exported functions as an argument that does not get interpreted by a shell: