hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-24 02:43:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from doc review

Browse Source 
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
This commit is contained in:
Erik Krogh Kristensen
2020-06-17 17:19:44 +02:00
committed by GitHub
parent 210e71cd93
commit 45e2b94eb5
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/src/Security/CWE-094/ImproperCodeSanitization.qhelp
View File

@@ -6,7 +6,7 @@
<overview>
<p>
Using string concatenation to construct JavaScript code can be error-prone, or in the worst
case enable code-injection if an input is constructed by an attacker.
case, enable code injection if an input is constructed by an attacker.
</p>
</overview>
@@ -20,14 +20,14 @@
<example>
<p>
The below example constructs a function that assigns the number 42 to the property <code>key</code>
The example below constructs a function that assigns the number 42 to the property <code>key</code>
on an object <code>obj</code>. However, if <code>key</code> contains <code>&lt;/script&gt;</code>, then
the generated code will break out of a <code>&lt;script&gt;</code> if the generated code is inserted
into a <code>&lt;script&gt;</code> tag.
</p>
<sample src="examples/ImproperCodeSanitization.js" />
<p>
The issue has been fixed in the below by escaping potentially dangerous characters.
The issue has been fixed by escaping potentially dangerous characters, as shown below.
</p>
<sample src="examples/ImproperCodeSanitizationFixed.js" />
</example>